You type your own domain into the browser and get a parked page, a host’s error screen, or a search result full of Japanese product titles you never wrote. The site that was there last month is gone, or it is still there and no longer yours.
Website recovery is three different problems wearing one name. Find which one you have first, because the fix for each is different:
- The site is hacked → it still loads, but someone else is writing pages on it.
- The site is gone → host closed, domain lapsed, files deleted, no backup.
- The site is fine but has to move → new host, new domain, new platform, and you don’t want to lose what it earned in search.
My stance, in one line: stop the damage first, rebuild second, polish last. Restoring a hacked site over the same hole just gives the attacker a fresh copy to work with.
Which recovery problem do you have?
Before you spend an hour on the wrong fix, match your situation to the row below. The first move is the one thing to do today; the rest can wait until you know the lie of the land.
| Situation | What it looks like | First move | DIY guide | Done-for-you |
|---|---|---|---|---|
| Hacked | Site loads, but Google shows spam pages you never wrote; odd redirects; warnings in Search Console | Stop editing, pull a copy of the current files, then clean on a copy | Fix hacked WordPress site; Japanese keyword hack; security checklist | Hacked repair; malware removal, human-reviewed |
| Domain lapsed | Parked page with ads; email stopped; WHOIS shows an expiry date in the past | Log in to the registrar that held the name and check the status code today | Domain expired: how to get it back | Restore the files from the archive once the name is back |
| Files gone, you have a backup | Host account closed or site blank, but you kept a backup file | Find the newest backup you trust and the database that matches it | Restore WordPress from backup | We rebuild from your backup if the restore won’t take |
| Files gone, no backup | No backup anywhere; the old site was public at some point | Check the Wayback Machine for captures of your pages | Use the Wayback Machine; alternatives | Restore from the archive as HTML or WordPress |
| Has to move | Site is healthy; you’re changing host, domain or platform | Map every old URL to its new address before you switch | Migration checklist | We run the move and the redirects |
The rest of this page takes those rows one at a time.
If the site was hacked
The common sign is spam pages in Google that you never published. If the titles are in Japanese and sell things you don’t sell, read the guide on the Japanese keyword hack — it covers how the injected pages get in and how to get them out of the index. For the cleanup itself on WordPress, the step-by-step is here: How to fix a hacked WordPress site.
Contain it before you clean it
The first instinct is to delete the bad pages. Resist it for ten minutes. If you start editing a live, compromised site, you’re fighting someone who may still have a way back in, and you’re destroying the evidence of how they got there. Take a full copy of the current files and database first — even the infected one — so you can compare and roll back. WordPress’s own “My site was hacked” FAQ walks through the containment order: change passwords, check which accounts exist, then work on a copy rather than on the live install.
Find the hack, then clean to a known-good state
Guesswork is slow. Confirm what kind of compromise you have — injected spam pages, a malicious redirect, a backdoor in a theme or plugin file — before you touch anything. Google’s guidance on fixing a hacked site and web.dev’s clean-and-maintain notes both push the same discipline: identify the hack, remove it everywhere it lives (files and database), and replace core files from a clean source rather than patching line by line. A single missed backdoor undoes the whole job.
Ask Google to recheck, then close the hole
Once the site is clean and the spam is gone, you can request a review so the warnings and the spam listings clear from search. Then keep it clean. The WordPress security checklist is the short list of things that close the usual doors: updates, users, plugins, file permissions, logins. Skipping this step is why some sites get re-hacked within days — the pages were cleaned but the door was left open.
If you’d rather not touch it yourself, my agent can fix a hacked website for you, and for WordPress specifically there is a WordPress malware removal service. A human reviews every job before it’s handed back.
If the site is gone
Start with the cause. Three sub-cases live under “gone”, and they don’t share a fix: the domain lapsed, the files vanished but you have a backup, or the files vanished and you don’t.
If the domain lapsed, move on the clock
Time matters more than anything else on this page. There is a renewal window after expiry, then a redemption period, and then the name can go to someone else. For generic names (.com, .net and the rest), ICANN’s Expired Registration Recovery Policy sets the minimum rules your registrar must follow, including a 30-day Redemption Grace Period after the name is deleted, during which only the deleting registrar can restore it. The flow, roughly: active → expired but still renewable by you → deleted → 30-day redemption → released to anyone. Country-code domains (.uk, .de and so on) are not covered by that policy and set their own rules. The guide “Domain expired: how to get it back” walks through each stage, what the status codes mean, and exactly what to ask your registrar.
If you have a backup, it’s the easy case
You’re in the lucky lane. Here is how to restore a WordPress website from a backup, file and database both — including the part people forget, matching the database to the files from the same date so you don’t restore a mismatched pair. If the backup is older than you’d like, it still beats rebuilding from memory.
No backup? The Wayback Machine is usually the last copy
If there’s no backup anywhere, the Internet Archive’s Wayback Machine is usually the last copy of your site that exists. It isn’t a backup, though — it’s a library that visited your site now and then and filed what it could carry by date. This guide covers how to use the Wayback Machine to find your old pages, read capture dates and spot the gaps. The Internet Archive’s help page is the source for how captures and the calendar work. If it didn’t capture what you need, there are other places to look; I compared the sites like the Wayback Machine that I could verify.
Before you pay anyone, preview an archived site for free: the scan shows the old design, the URL structure and a few sample pages, so you know what’s actually recoverable. The free open-source downloader (no AI) gets you the raw files to run yourself.
If you want it done, you can restore a lost website as plain HTML or as editable WordPress. My agent picks the best snapshot per page, fixes layout breaks, drops junk and spam pages and keeps the old URLs. If you’d rather end up on WordPress, here’s how to convert an archived site to WordPress. One condition on every restore: you must own the rights to the content you’re bringing back.
Case study. We restored undertheleague.com, a football blog offline since 2019, twice with the same model: once by an AI agent on its own, once on our Revive flow. Same 29 posts both times; only one of them looked like the site. What happens when an AI agent restores a website without WaybackPress?
If the site has to move
Moves are where sites quietly lose traffic: a missed redirect here, a changed URL there. The website migration SEO checklist covers URL mapping, 301 redirects and what to watch in Search Console afterwards, based on Google’s own site-move documentation. The short version: keep the URLs the same if you can; if you can’t, map every old address to its new one and redirect, one to one, before you flip the switch. A move with a clean redirect map is almost invisible to search. A move without one teaches Google that half your pages are gone.
What a recovery job actually looks like, stage by stage
People picture one button and a finished site. The honest version is a short assembly line, and most of it is checking.
- Scan and preview. The archive gets scanned so you can see the old design, the URL structure and a few sample pages. This is where you decide whether a rebuild is realistic before any money changes hands.
- Snapshot selection. The archive holds many captures per URL, and the newest is often the worst — captured after the site was already breaking. The best copy of a page may be months older than the day it died, so each page is chosen on its own merits, not by one blanket date.
- Machine review. An LLM reads the design and every page, picks the best snapshot per page, fixes layout breaks, drops junk, spam and thin pages, keeps the URL structure and 301-maps the rest, and flags anything it can’t resolve.
- Human review. A person checks the result before it ships. The machine is fast and occasionally confident about the wrong thing; the review is where that gets caught.
- Delivery. You get plain HTML or editable WordPress, with the old URLs kept. Prices and turnaround are on the pricing page, not promised here.
That’s the short of it: scan → choose → machine clean → human check → ship. No step is skippable, and the human one is the point.
Mistakes that make it worse
Most recovery jobs get harder because of something done in the first panicked hour. The common ones:
- Cleaning a hacked site live, with no copy. You delete the evidence of how they got in, and if you miss one backdoor, the spam is back by morning. Copy first, then clean on the copy.
- Restoring over the same hole. Putting the old site back without closing the entry point just hands the attacker a fresh target. Clean, then harden, then restore.
- Waiting on a lapsed domain. Redemption lasts 30 days and doesn’t reopen, so every day you wait narrows your options. The restore fee itself doesn’t rise: it’s a set fee your registrar has to publish up front (ICANN). The clock doesn’t care that it’s the weekend.
- Grabbing the newest archive capture. The last snapshot before a site died is often half-broken. Read the calendar and pick a good day, page by page.
- Moving a site with no redirect map. Changing URLs without one-to-one 301s is how a healthy site loses its search traffic in a week.
- Trusting a mismatched backup. Restoring files from one date and a database from another leaves a site that half-works. Match the pair.
So it doesn’t happen again
Most of the guides above exist because a backup didn’t. Learn how to back up a WordPress site on a schedule (files and database), and store a copy somewhere that isn’t your host. It is the dullest page in this section and the one that would have made the rest unnecessary.
Website recovery FAQ
Can I recover a site with no backup?
Often, yes — if the site was public, the Wayback Machine may hold copies of many of your pages. How complete the recovery is depends entirely on what got captured and when. A homepage that drew links might have hundreds of captures; a quiet blog post might have none. Run a free preview first to see what’s actually there before you count on it.
Is the Wayback Machine the same as the Internet Archive?
The Wayback Machine is the Internet Archive’s web-archiving service — the part that lets you browse old captures of web pages by date. The Internet Archive is the non-profit library that runs it, along with archives of books, audio and software. We’re not affiliated with either; we just use the public archive the way anyone can.
Do you guarantee a full, pixel-perfect restore?
No. Anyone who promises a perfect restore from an archive hasn’t looked at enough archives. What’s recoverable is whatever was captured, and some pages, scripts or form actions simply weren’t. The free scan tells you up front how much is realistic, and a human checks the result before delivery. No ranking promises either — just the work and the pages that actually come back.
How long do I have to get a lapsed domain back?
It depends on the stage. While the name is merely expired, you can usually still renew it in your registrar account, sometimes with a late fee. After the registrar deletes it, generic domains get a 30-day Redemption Grace Period during which only that registrar can restore the name. After that it can be released to anyone. Country-code domains follow their own registry’s rules. The point stands: check your status today, not next week.
Can you clean a hacked site and stop it coming back?
Cleaning and hardening are two jobs, and both matter. The cleanup removes the spam and the backdoors; the hardening — updates, locked-down logins, file permissions, removing unused plugins and users — closes the door that let them in. Skip the second half and you’ll likely be back here. We do both, and a human reviews the result before it’s handed over.
Do I have to own the content you restore?
Yes. Every restore carries one condition: you must hold the rights to the content being brought back. Recovering your own site from the archive is fine; using the archive to copy someone else’s site is not, and we won’t do it.
What’s the difference between the free tools and the paid restore?
The free tools work: the scan previews what’s recoverable, and the open-source downloader pulls the raw files for you to run yourself. The paid difference is the LLM quality check — best snapshot per page, layout fixes, junk and spam removed, URLs kept — plus a human review and the done-for-you option. The free tool isn’t a crippled version of the paid one; it’s the honest starting point.
A note on who’s writing
I run a small team of AI agents and review their work. This site was built end to end by the same agent pipeline that does the restores. No ranking promises; just the work and the numbers. Prices are on the pricing page.
A backup is a boring file. Until the day it’s the only interesting one.