When a change looks suspicious, protect the website and its users, preserve records and establish the scope. Restoring a clean backup is not enough on its own: close the entry point, secure relevant access and test the service again. Regular maintenance supports this preparation.
A compromised website does not always announce itself with a changed homepage. Visitors may be redirected elsewhere, a form may send data to another destination, or search results may display unrelated pages. Sometimes only one file changes. Checking that a website opens is different from checking that it works securely. First establish what changed and which risks users may face.
How can you distinguish a fault from an attack?
A blank page, incorrect redirect or broken form is not proof of an attack by itself. Updates, expirations and server problems can produce similar symptoms. Review recent changes, file dates, access records and server warnings together. An unfamiliar administrator, unexpected file or form transmitting data to a foreign destination requires closer investigation.
Do more than save a screenshot of a security warning: record the address, time and behaviour observed. Do not distribute suspicious links to customers or upload confidential records to random checking tools. Investigate only systems the business is authorised to examine. Neither a definite attack announcement without evidence nor ignoring the signs is appropriate.
Protect users first and preserve evidence
If visitors are redirected to harmful content or data collection is suspected, restrict access to the affected service. An authorised technician and the hosting provider should choose a safe intervention. Fixing the homepage alone may miss affected forms, subpages or payment flows. When needed, show a maintenance page and temporarily stop the risky function.
Before cleaning, preserve copies of files and relevant logs. Keep them outside publicly downloadable directories and restrict access to authorised people. Immediately deleting a suspicious file may destroy evidence of the entry point. The NCSC incident management guidance recommends recording response decisions and collected data. Assess the scope of each incident separately.
Recovery is incomplete until the entry point is closed
Restoring old files can repair appearances, but a compromised account or vulnerable software can let the problem return. Review management access, the hosting account, software and recent changes. An authorised person should assess unnecessary accounts and permissions. Terminating relevant sessions, renewing passwords and enabling supported multi-factor authentication should be planned according to the findings.
Websites use different technologies. A static site, PHP application and content management system require different component checks. Installing a random plugin for software the business does not use is not a solution. Assess an unknown file through its function and relationship to records, rather than its name alone. Give technical access only to those who need it, within the necessary scope.
How should you choose a clean backup?
The newest backup is not necessarily clean: the suspicious change may predate it. Compare backup dates, the first symptom and file changes. Check the proposed copy in a separate environment. Restoration should include files, and where needed, the database and relevant configuration. Agree beforehand which point in time the business data will return to.
Having a backup is different from being able to restore it. The NCSC data security guidance explains backup and recovery preparation. The business should know where copies are held, who can access them and how restoration is tested. A file archive alone does not prove that the entire service will restart correctly.
What should you verify before reopening?
Check the homepage and critical journeys: service pages, contact forms, login and any payment flow. Send test messages or make test payments only through the safe method the business has agreed. Verify form destinations, the absence of foreign redirects and retained access restrictions. If a search engine has raised a security warning, follow the remediation steps in its relevant panel.
Keep a brief record of the outcome: which file was restored, which access changed and what was tested and verified. Normal visitor numbers do not prove security. Continue monitoring logs and unexpected file changes after the incident. If the same symptom returns, do not accept cleanup as successful; investigate the underlying cause again.
What preparation does regular maintenance provide?
URİKEM website maintenance and security monitors the website and sends an email if it goes down. SSL certificate and domain expiry dates are tracked. A backup is taken before every update, with rollback if a problem occurs. A status summary is sent each morning. These checks help detect difficulties before customers have to report them.
Maintenance does not guarantee that attacks cannot happen. Safe updates, access management and monitoring need to work together. Discuss them when building a website too: questions to ask when commissioning a website go beyond appearance. An understandable technical structure also supports clear presentation to search and AI systems.
Points to consider
A cyber incident and a personal data breach require different assessments. If personal data may be affected, involve the business's relevant specialists and legal adviser. This article does not replace legal advice or a technical diagnosis of your incident. Do not attach confidential files indiscriminately to support requests or leave backups public. Prioritise security and verified service during recovery.
Prepare a response plan, responsible person and tested recovery route before an incident occurs. Discuss maintenance suitable for your systems among URİKEM business solutions. When the website opens, keep evidence that the cause was addressed and critical functions work. That prevents the same uncertainty returning with the next change or fault.
Frequently asked questions
Does restoring a backup completely resolve an attack?
Not necessarily. Verify the backup is clean, close the entry point, secure relevant access and retest critical functions.
Does URİKEM maintenance guarantee there will be no attacks?
No. It provides monitoring, SSL and domain tracking, backups before updates and recovery preparation, rather than a guarantee against attacks.
Should suspicious files be deleted immediately?
An authorised technician should first preserve secure copies of files and relevant records, restrict the affected service and investigate the scope. Uncontrolled deletion can destroy evidence.
Is there a job that keeps repeating at your company? Tell us about it and we will build the tool that does it.
Tell us what you needOther articles
Customers missing appointments: do reminders help?
A reminder brings a forgotten appointment back into view; it does not guarantee attendance. Collect accurate contact details, send a confirmation and follow up with a short reminder before the appointment. Measure completed appointments, rather than bookings alone.
1 October 2026Read →How do you clean up duplicate records built up over the years?
The safe way to clean up duplicate records is to first define a matching rule that finds records that are the same, decide which record stays in each group, and never delete anything without approval. A full backup is taken before the cleanup starts and every merge is written to a report, so a record that was merged by mistake can be restored.
30 September 2026Read →Quote, proforma and invoice: which one is prepared when?
A quote tells the customer the price and terms; a proforma is a preliminary invoice prepared before the sale is final, for payment or advance approval, and it is not a tax document; an invoice is the official document issued after the sale takes place. Since all three carry the same customer and product information, producing them from a single source prevents the errors that come from typing the same information three times by hand.
30 September 2026Read →Why do automation projects fail?
Automation projects usually fail not because the software is broken, but because the organisation around the work was never set up. The five most common reasons are: the scope growing along the way, messy data, only one person using the tool, no training for the team, and nobody owning maintenance after setup. All five can be discussed before the work begins.
29 September 2026Read →The AI assistant on your website and KVKK: where are chats stored, and for how long?
When you put an AI assistant on your website, the messages visitors write may be personal data. In the URİKEM AI Customer Assistant, chats are stored on a server in Istanbul, are deleted automatically 180 days after the last message, and the business can delete a chat at any time. Messages are sent to an AI provider abroad so that a reply can be generated; visitors are informed of this and asked for consent before their first message.
29 September 2026Read →What should you check before having a website built?
When having a website built, most attention goes to design, yet the issues that cause the most trouble later stay on the unseen side: whose name the domain and hosting are registered under, who holds the text, how fast the site opens on a phone, and whether it has been submitted to Google. A company that settles these four points from the start also removes the risk of losing its site years later.
28 September 2026Read →Does automating social media make a brand feel like a robot?
Automating social media does not make a brand feel robotic; what does is text published without anyone reading it and comments left unanswered. In the right setup, the calendar, preparation and timed publishing run automatically; the brand's voice, final approval and conversation with customers stay with a person.
28 September 2026Read →Is it safe to move our data to the cloud, or should we keep it on our own server?
The cloud is neither safe nor unsafe in itself; what determines security is whose responsibility the data sits under, who can access it and how it is backed up. If you can answer these three questions clearly, your data is safe whether it is on your own server or in the cloud; if you cannot, changing its location will not solve the problem.
27 September 2026Read →What determines the cost of AI software?
The cost of AI software is made up of four items: setting up the work, monthly use and hosting, the usage fee for the AI model, and maintenance. In a ready-made package these items are combined into a single monthly fee; for a custom tool, a separate quote is given according to the size of the job. The hidden cost is often in maintenance and data preparation.
27 September 2026Read →Do you have to prepare the monthly sales report by hand every month?
If the report is prepared every month from the same source, in the same layout and with the same calculations, you do not have to prepare it by hand. An automation that takes the data and produces the tables, charts and summary by the same rules reduces copy-paste errors and delivers the report in the same format every month.
26 September 2026Read →What does an unanswered phone cost a business?
The cost of an unanswered phone is the customer who made that call ringing another company instead. An online booking system lets customers book their own appointment outside business hours and at busy times too; reminders and easy cancellation reduce the slots that go unused.
26 September 2026Read →Which questions can an AI customer assistant answer?
An assistant answers well the questions that can be answered with the information the company gives it: prices, opening hours, address, scope of services, appointments and return terms. Questions that require a decision, negotiation or individual review should be passed to a person without guesswork.
25 September 2026Read →Turning hundreds of PDFs and documents into one table: by hand or with AI?
If there are few documents and they share the same layout, manual entry may be enough. If documents number in the hundreds, their layouts differ and new ones keep arriving, reading them with AI and turning them into a table makes more sense; but suspicious fields must be checked by a person.
25 September 2026Read →How many days does an automation project take?
Duration is set not by how much code is written but by how organized the data is and who needs to approve, and when. Even a simple task can stretch out as more approvers get involved.
23 September 2026Read →Does a small company need an AI budget?
The budget is not set by the size of the company but by how many hours a specific task wastes. A small company can also start with a single repeating task and a measurable budget.
23 September 2026Read →Who benefits from an appointment system?
An appointment system can help when customers need to reserve a time slot and arranging those slots by phone interrupts your work. First clarify service durations, shared resources and exceptions.
22 September 2026Read →What if AI makes things up?
A fluent answer is not verified information. A business tool needs more than well-written output: it needs a workflow that prevents actions based on incorrect or incomplete information.
22 September 2026Read →Can a spreadsheet with thousands of rows be entered into a system in bulk?
In most cases, yes. The hard part is not the entry itself but getting the data into the shape the system expects and verifying that every row was really saved. If the system offers no bulk route, the work goes through the screen, and that depends on the rules of that system.
21 September 2026Read →Why does preparing a quote take so long?
Writing the quote does not take long; the time goes into hunting for the price, copying and correcting an old quote, and rebuilding the layout every time. Once the price list sits in one place and the rules are written down, a quote comes out in minutes.
21 September 2026Read →Which jobs are suited to automation, and which are not?
The job best suited to automation is one that repeats often, whose rules can be written down and whose data is already digital. Work that needs judgement, is full of exceptions or has its data on paper needs another step first.
18 September 2026Read →What if the AI assistant on your site gives a wrong answer?
The risk is real, but manageable. An assistant's wrong answer usually comes from guessing about something it does not know. The solution is to draw a clear line from the start around what the assistant knows and does not know, and to have it hand over to a person when it does not know.
18 September 2026Read →Is ranking in Google the same as being mentioned by AI?
Partly. Both draw on the same foundation, but they do not reward the same thing: Google ranks a page, while AI reads several sources, writes an answer and decides for itself who to mention in it.
17 September 2026Read →Why doesn't ChatGPT mention my company?
The reason is rarely “the AI does not like us”. Usually it is a technical block, scattered company information, or the company not being mentioned anywhere else online. All three can be fixed.
17 September 2026Read →What should your site have so AI describes you correctly?
When AI describes a company, it uses the clearest sentences it finds on the site. The list below goes page by page through where those sentences should sit, how they should be written and the markup machines will read.
17 September 2026Read →What is GEO? Being visible in AI answers
GEO (Generative Engine Optimization) is the work of making sure that when ChatGPT, Gemini, Perplexity and Google's AI Overviews answer a question, they find your business, describe it correctly and cite it as a source. It does not replace SEO; it builds on top of it.
17 September 2026Read →Will an AI tool learn my company's data?
Short answer: not in a tool running through a commercial API. But that answer depends on how the setup was done, so it is worth knowing what goes where.
16 September 2026Read →When does a spreadsheet stop being enough?
Excel is not a bad tool; it handles most jobs and more. The problem is carrying on with it for months after the point where it stopped being the right fit.
16 September 2026Read →Off-the-shelf software or custom-built?
The right answer depends on how specific the work is to you. Work that everyone does the same way is cheaper off the shelf; work you do your own way is cheaper built for you.
16 September 2026Read →