Part of The Nuance of Takedowns series · By Chad Los Schumacher · Last updated: November 4, 2026
A compromised website takedown removes phishing or malicious files that an attacker planted on a legitimate, hacked site, while the site itself stays online. Because suspending the domain would also cut off the owner’s website and email, registrars rarely act. The request goes to the hosting provider, and in parallel to the site owner.
Summary
- Registrars can only act on the whole domain, so for a hacked site they usually decline and point to the host.
- Domain age is the first signal of whether a domain was hacked or registered for abuse, and it decides who you contact first.
- What works is evidence sent to the hosting provider, a separate warning to the owner, a blocklist entry while the page is live and a recheck for reinfection.
What is a compromised website?
A compromised website is a legitimate site that attackers have broken into, usually through a vulnerable plugin, a stolen admin password or an outdated content management system (CMS), and now use to host content the owner did not put there. For a brand protection team, the typical finding is a page impersonating their login or checkout, sitting inside the folders of an unrelated business.
The distinction that shapes the whole takedown is who controls the domain:
| Malicious registration | Compromised domain | |
|---|---|---|
| Who controls the domain | The attacker | A legitimate owner who does not know about the abuse |
| Typical age | Days or weeks | Usually more than a year |
| Rest of the site | Nothing, or only the phishing kit | A real business: pages, email, subdomains |
| Owner’s intent | Malicious | Legitimate, but the current activity is malicious |
| Right tool | Domain suspension by the registrar | File removal by the hosting provider |
Why do registrars refuse to suspend a compromised domain?
Registrars refuse because their only tool, suspending the whole domain, would hurt an innocent owner more than the attacker. Since April 2024, ICANN’s contracts require registrars to take prompt and appropriate mitigation action when they receive actionable evidence of Domain Name System (DNS) abuse, which includes phishing and malware. On a compromised site, the word “appropriate” is where the request gets stuck.
A registrar works at the level of the second-level domain (example.com). Its standard action is a status called clientHold, which takes the domain out of the DNS. If a hacker plants one login page at example.com/wp-content/login.php, a clientHold stops that page, and it also takes down the company’s website, its email servers and every subdomain. Suspending a compromised domain is like burning down a house to kill a spider.
Two more factors keep registrars conservative with aged domains. An old domain is treated as an established business asset, so suspending it carries legal and reputational risk for the registrar. The burden of proof also sits with the reporter, who would have to show that the domain was taken over or was malicious from the start. Faced with that, registrars treat the case as a content problem and send it to the party that can remove one file without touching the rest: the hosting provider.
How do you tell a compromised site from a malicious registration?
Domain age is the first signal registrars look at, and it decides who you contact first:
- Registered less than about two weeks ago: generally accepted as created for abuse. Suspension is low risk, so the registrar is the first contact.
- Registered more than a year ago: presumed to be a compromised legitimate asset. The hosting provider is the first contact.
- In between: age alone does not decide. The other signals do.
The other signals are quick to check. A real business usually has its own content and years of history, which archived snapshots in the Wayback Machine will show. The phishing page tends to sit deep in a path unrelated to the brand, such as a /wp-content/ or /images/ folder. And a lookup with the Registration Data Access Protocol (RDAP), the current replacement for WHOIS, shows whether the registrant or the name servers changed recently. A recent change made without the owner points to a hijacked domain, which is a registrar case even when the domain is old.
The full set of factors a registrar weighs before any suspension is covered in what decides whether a registrar suspends a domain.
How do you remove a phishing page from a compromised site?
You remove it at the source: the hosting provider deletes the files, the owner closes the entry point, and the page is blocked for visitors while that happens. In practice it takes seven steps:
- Collect the evidence first. Save the full URL with its path, screenshots of the fake page and of the real page it copies, the date and time you saw it and the IP address it resolves to. If you can, also record where the form sends the stolen data. A report the host can verify in a few minutes is easier to act on than a bare link.
- Report it to the hosting provider. Look up the IP address to find the network that hosts it, then send the evidence to that provider’s abuse contact. Ask for the removal of the specific files, not of the site. If the page copies your login page or brand assets, a notice under the Digital Millennium Copyright Act (DMCA) is often the strongest legal lever with the host; see how to file a DMCA takedown notice. If the planted files spread malware instead of a phishing page, the path is slightly different: see how malware takedowns work.
- Report it to the CDN if the site sits behind one. When the IP belongs to a content delivery network (CDN) such as Cloudflare, use the CDN’s abuse form. Cloudflare does not store the site’s files, so it forwards the report to the hosting provider and the site owner.
- Warn the site owner through a separate channel. The owner is also a victim, and often the fastest to fix the problem, because they can delete the files and patch the hole. Use a contact form, a phone number or an
abuse@address, but assume the attacker may read the owner’s email or control the server. This step runs in parallel to the host report and never replaces it. - Block the URL while it is live. Report it to browser blocklists, such as Google Safe Browsing, so visitors see a warning while the removal is pending.
- Go back to the registrar only with a reason. Two reasons work: the host does not respond after a follow-up, or the evidence shows the domain registration itself was taken over. Include the history of your reports to the host.
- Recheck for reinfection. Attackers who break into a site often leave a backdoor, so the same kit can reappear in another folder days later. Check the domain again after the removal and ask the owner to patch the entry point, not only delete the files.
What are the most common mistakes?
- Stopping at the registrar’s refusal. For a compromised site, a “no” from the registrar is expected. It means the case belongs to the host.
- Warning the owner only by email. If the attacker controls the mailbox, the warning goes straight to them.
- Asking the host to “take the site down”. A request to remove specific files on a named path is easier to approve than a request to disable a customer’s website.
- Closing the case when the URL returns a 404. The page may have moved to another folder on the same server.
How does PhishFort handle a compromised site?
PhishFort handles a compromised site as a file removal, not a domain suspension. PhishFort analysts confirm whether the domain was compromised or registered for abuse, file the evidence with the hosting provider through direct channels, warn the owner when it is safe to do so and follow the case until the content is offline. While the host works, the URL goes into the PhishFort Blocklist, the feed of analyst-confirmed phishing domains that warns users while a takedown is in progress. The PhishFort Blocklist reaches 418M+ users through browsers, DNS providers, antivirus tools and wallets.
If the kit comes back, PhishFort Brand Monitoring, which runs 24/7/365, re-engages the takedown. PhishFort has a 99%+ takedown success rate.
Which party should you contact first?
- If the domain is new and has nothing else on it, start with the registrar.
- If the domain is old and the rest of the site is a real business, start with the hosting provider and warn the owner in parallel.
- If the host goes silent or the domain registration was hijacked, go back to the registrar with your evidence.
If you would rather hand these cases to a team that files and follows them every day, see PhishFort’s managed takedown service.
FAQs
What does 'website blocked due to compromised' mean?
Does the owner of a compromised website know it was hacked?
How long does it take to remove phishing from a compromised website?
Is a compromised domain the same as a hijacked domain?
Sources
- ICANN, amendments to the Registrar Accreditation Agreement and the Base gTLD Registry Agreement on DNS abuse mitigation (in force since April 2024).
- Google Safe Browsing, public form to report phishing pages.
- Cloudflare, abuse reporting process.
