Whether your online business is small or large, there will always be some risk of a web attack by hackers . Cybercriminals look for both technical and human vulnerabilities, and any site that stores or transmits data can become a target. That's why it's crucial to know how to react to a web attack and what steps to take from the first sign to full recovery.
It's important to be informed about what to do if this happens and how to prepare in advance, following tips to improve your website's security , since the first minutes and hours after an incident are crucial for containing the damage , protecting information , and complying with legal obligations . If this applies to you, or if you want to know how to react if it happens, here you'll find a complete and practical guide.
Steps to react to a web attack on our page
Contact support staff
If you have your own server, contact your systems engineering team or cybersecurity officer (CISO, systems administrator, etc.). They will know how to handle the situation, can analyze the technical signs of the attack (logs, antivirus or EDR alerts, web messages, unusual server slowness), and activate the incident response plan if one exists.
If your website is hosted on an external server or with a hosting provider , find their support number or channel and describe the situation in as much detail as possible: when the problem started, what messages or errors appear, if content has changed, and if any security alerts have been received. They will guide you in resolving your issue, isolate the affected site , review their infrastructure, and, if necessary, collaborate with other specialized teams (for example, the relevant CERT).
Redirect your page to a "maintenance" page
Prevent your customers from thinking your website has disappeared or been compromised by displaying malicious content. Set up a temporary "under construction" or "under maintenance" page , always apologizing for the inconvenience and inviting them to return later. This protects your brand image and reduces users' exposure to potential scripts, banners, or redirects injected by the attacker.
This maintenance page should be simple, free of suspicious code , and hosted in an environment that the technical team has verified as secure. Meanwhile, the main site can remain isolated for analysis while still informing users that work is underway to address the issue.
Check if any damage was caused
Often, hackers' only goal is to gain a foothold on other people's websites, modify the homepage, or leave visible messages (defacement). However, in many other cases, the objective is to steal information , implant malware , use the server in attacks against third parties, or encrypt data using ransomware . Therefore, it is essential to thoroughly investigate whether any data theft or loss has occurred and document everything.
Together with your engineering team, review the following key aspects :
- File integrity from the site (unauthorized changes, suspicious new files, unknown scripts).
- Databases: altered tables, deleted or exported records, presence of users created without authorization.
- Unusual entrances: unknown IP addresses, after-hours logins, multiple failed attempts.
- Availability Server issues: extreme slowness, continuous crashes, or abnormal resource usage may indicate a denial-of-service attack or the presence of malware.
This review will help determine the true extent of the incident , decide which systems need to be restored from backups and what data may have been compromised, which is crucial for communication with customers and, where appropriate, with the authorities.
Change all passwords and acquire new protocols
Once your website is fixed and the threat contained, add security plugins and new passwords so that if the attacker tries again, they will encounter measures that will stop them. It is recommended that you:
- Use strong and individual passwords for each service (hosting panel, FTP/SFTP, database, CMS, email, etc.).
- Activate multi-factor authentication (MFA) whenever possible, especially in critical access points.
- Review and limit the user permissionsby removing unnecessary or old accounts.
- Update all extensions, themes, and components of the content manager to close known vulnerabilities.
In addition to credential changes, consider implementing tools such as a web application firewall (WAF) , intrusion detection systems, or continuous monitoring services, which help identify anomalous behavior in the early stages of a potential attack.
Take steps to prevent it from happening again
Always maintain a backup of your website , including both files and the database, and implement security protocols such as SSL/TLS certificates to encrypt communications and install various antivirus or antimalware solutions on the computers that manage the site. Establish a clear policy for all staff to avoid opening suspicious files, clicking on dubious links, or providing credentials through unverified emails or forms.
It is also recommended :
- Define a incident response plan that indicates who does what, how the incident is documented and who is notified.
- Perform vulnerability analysis periodic checks or penetration tests to discover flaws before attackers do.
- Form the team in good cybersecurity practicesbecause human error is often the entry point for many attacks.
- Evaluate the hiring of cyber risk insurance and specialized external services to have expert support in critical moments.
The likelihood of suffering a cyberattack is reduced if we have the necessary measures in place to ensure a secure website and a cybersecurity-conscious organization. Remember that we are not only compromising our own information but also that of our clients, so acting quickly, relying on professionals, and learning from each incident becomes a decisive factor in protecting business continuity and reputation.
Having a comprehensive approach that combines prevention, early detection, organized response, and continuous improvement will lessen the impact of each attack attempt and allow your website and e-commerce platform to remain a reliable environment for your users.
