Not every security alert requires immediate escalation to a specialist. Some alerts are informational — a routine scan of your domain, a failed login from a known address, a certificate approaching its renewal window. Others indicate active risk: a successful login from an unusual location, a new admin account you did not create, or evidence that your domain is being used to send spam. The challenge is distinguishing between the two quickly enough to act when it matters.
Money, credentials, and customer data
The clearest triggers for fast escalation involve financial systems, login credentials, and personal data. If you have evidence that a bank account, payment gateway, or accounting system may have been accessed by an unauthorised party — even if you are not sure — contact your bank and your platform provider immediately. Do not wait for confirmation. The cost of a fraud prevention hold is vastly lower than the cost of an unauthorised transfer that cleared before you noticed.
Stolen credentials are similarly time-sensitive. If your hosting, email, or WordPress admin password may have been compromised, change it immediately. Every minute of valid compromised access represents time an attacker can use to establish persistence — forwarding rules, new admin accounts, injected code — that survives a password reset.
Customer personal data — names, emails, phone numbers, payment details, health information — carries notification obligations in Australia under the Notifiable Data Breaches scheme. You do not need certainty that data was accessed; you need reasonable grounds to believe it may have been exposed. If you are in that zone, seek legal advice before making decisions about disclosure, public statements, or remediation steps that might inadvertently waive privilege.
Repeated failed logins and new admins
A single failed login attempt is background noise. Hundreds of failed attempts over a short period from one or a few IP addresses, followed by a successful login, is a pattern worth investigating immediately. The successful login may be yours — but it may also be the result of a credential stuffing or brute force attack that finally found the right password.
An admin account that appeared in your WordPress user list or hosting control panel that you did not create is a strong indicator of active compromise. It should be removed, but not before you record the account details (username, email, registration date, last login) as evidence. After removal, conduct a full credential rotation and review for other signs of compromise — new plugins, modified theme files, forwarding rules.
Public website changes and malware warnings
If your website is displaying content you did not put there — redirects, injected text, spam links, or a browser warning — visitors are being actively affected. This is the category of incident that needs same-day response, not a ticket logged for next week. Your hosting provider's support team can often help identify the nature of an infection and take the site offline temporarily if needed.
A Google Search Console alert or Safe Browsing warning is also a fast-escalation trigger. These warnings tell search engines and browsers to warn visitors away from your site. Every day a warning is active, you lose visitor trust and potentially search ranking. The review process after cleanup is not instant — acting fast on the underlying issue gets you through the review queue sooner.
- Escalate immediately: suspicious banking transactions, compromised payment gateway, customer data exposure.
- Escalate same-day: unknown admin accounts, active website redirects, Google Safe Browsing warning.
- Investigate promptly: bulk failed logins followed by a success, sign-in from an unexpected location.
- Monitor and schedule: missing security headers, approaching certificate expiry, low-severity scan findings.
- Contact ReportCyber (cyber.gov.au/report) for cybercrime reporting in Australia.
- Contact the OAIC if personal data may have been accessed without authorisation.
Some alerts can wait, but others need fast human review.
Open the cyber protection tools