A wine club member emailed us last Thursday to ask if we knew Google shows "This site may be hacked" under our name. I didn't. I'm the office manager and bookkeeper here, and I ended up with the website because nobody else would take it.

I searched site: with our domain and Google says about 2,300 results, almost all Japanese. Google translate says it's mostly handbags and watches. When I click one I just get our normal 404 page, which I don't understand. There are also two admin users I've never seen, one is just random letters.

Background. A local agency built the site in 2018 with Elementor. The owners canceled their $150 a month maintenance plan in 2023 because it never seemed like anything was happening, which in hindsight, yeah. We have 31 plugins and 9 are out of date, and the dashboard has been nagging me since this summer about WordPress updates I kept putting off because I was scared of breaking the shop. Hosting is $12 a month shared and they keep 14 days of backups. Nobody knows when this started.

So do I restore the 14 day backup, or is that pointless if the hack is older than that? Is cleaning it in place realistic for someone non-technical with a lot of googling, or is this pay-a-professional territory?

Wine club signups and online orders go through WooCommerce. Do I need to be worried about card data?

If you've been through this, how long did Google take to drop the hacked warning once it was clean? One of the owners asked me if the shop should even be on the same site as the regular pages (hours, events, tasting room stuff). Is that a real thing or is that overreacting to one hack?

It's harvest, our busiest month, and I'm doing this at night after payroll. Please tell me this is fixable.