A small business homepage incident needs two tracks at once: protect visitors and preserve enough evidence to understand what happened. Avoid making many unrecorded changes. Open an incident log, contain the harmful behavior, recover from a known-good source, and validate the customer and search-engine views before closing the event.
Record what is actually wrong
Capture the discovery time, reporter, exact URL, device, browser, network, HTTP result, visible content, redirects, certificate warnings, and whether the problem affects other pages. Save relevant screenshots and server, hosting, deployment, DNS, form, and security alerts under the authorized account. Record the most recent known-good deployment and the people with access. Do not put customer submissions or credentials into the incident log.
NIST's incident-response guidance integrates preparation, detection, response, and recovery with cybersecurity risk management. For a homepage, that means preserving records while making a bounded containment decision rather than treating the first visible symptom as the cause.
Protect visitors first
If the page is serving malware, phishing, an unsafe redirect, or exposed private data, use the hosting provider's supported containment controls and escalate to the responsible security contact. If the problem is a simple outage or broken component, avoid a broad shutdown when a narrower rollback or temporary static page will protect users. Record every change, operator, timestamp, and rollback route.
Google's malware-prevention guidance says the Search Console Security Issues report shows hacked pages Google has identified and offers instructions for fixing them. The same guidance recommends monitoring logs, protecting access-control files, keeping site software current, and using secure transfer protocols. These checks can contribute evidence, but an empty Search Console report does not prove the site is clean.
Determine the boundary
Test the homepage from more than one network and a clean browser. Compare the origin, CDN, DNS, and deployed artifact when the platform exposes them. Check whether the response differs by device, location, login state, or user agent. Review recent deployments, plugin or dependency changes, account activity, redirects, and content edits. Preserve logs before retention or cleanup removes them.
Recover from a known-good source
Prefer a versioned deployment or verified backup whose content and configuration are understood. Restore into a safe preview first when possible. Rotate compromised credentials through the provider's official process, remove unauthorized access, patch the confirmed entry point, and avoid copying suspicious files into the clean release. A visual match is not enough; compare hashes or version identifiers when the platform supports them.
Validate the customer path
Check the canonical homepage over HTTPS, navigation, contact method, primary call to action, forms, consent notices, mobile layout, keyboard use, and any checkout or login link. Submit only test data to forms. Confirm that redirects stay within intended domains and that error messages do not expose internal details. Ask a second authorized person to repeat the critical path.
Google's Search Console overview says URL Inspection can show a page's index status and test a live URL, while the Security Issues report warns about suspected hacked or harmful behavior. Use these after the live page is safe and stable. They validate Google's observed view; they do not replace direct browser, server, and security checks.
Close with evidence
Record the scope, confirmed cause or explicit unknown, containment, restored version, credentials or components changed, validation results, customer communications, and follow-up owner. Keep a short monitoring window for redirects, form delivery, uptime, and new security warnings. The incident is complete only when customers reach the intended safe page, the important actions work, and the recovery can be explained and reversed.
Sources
- NIST SP 800-61 Rev. 3 — National Institute of Standards and Technology, April 3, 2025
- How to prevent malware infection — Google Search Central
- Get started with Search Console — Google Search Central