Squarespace Account Locked or Hacked: What to Do in the First Hour

Either you cannot get in, or someone else can. Both start the same way.

Minute 0 to 10: copy the site while it is intact

If the site is still up and looks normal, copy it now, before someone changes or deletes anything. A copy of the public pages needs no login: paste the address into the free backup for the homepage, and start the monthly plan for every page with full-page screenshots and images. The first backup runs within minutes. If the attacker later defaces or removes pages, you have the site from before.

Minute 10 to 30: lock what you can reach

• Email. Most account takeovers go through the email account. Change that password first and turn on two-factor authentication there.
• Squarespace. Try the password reset. If it works, change the password, turn on two-factor authentication, and check the contributors list for anyone you do not know. Remove them.
• Domain. If the domain is at another registrar, log in there, change the password, and lock transfers.
• Payments. If a card is on file that the attacker could use or change, tell your bank.

Minute 30 to 60: recovery through Squarespace

If the reset does not work (the email was changed), contact Squarespace support with the domain, the account email you last used, billing details, and anything that proves you own the business. They have a recovery process; it takes time. Meanwhile, if you own the domain, you can point it at a holding page so visitors do not see a defaced site.

Afterward

• Compare the recovered site against the backup screenshots, page by page. Attackers sometimes make small changes: a phone number, a payment link, a hidden block of spam links. The screenshot from before makes those visible.
• Rebuild anything damaged from the backup's HTML and images.
• Keep two-factor authentication on for the email, Squarespace, and the registrar.
• Keep the monthly backup running. The next incident is easier when the past is on file.

Q: Can a hacker delete my Squarespace site?

With owner access, yes, and Squarespace may not be able to restore it. A copy of the public pages stored outside Squarespace is the protection.

Q: How do I recover a Squarespace account without the email?

Through Squarespace support, with proof that you own the business and the site. Owning the domain in your own name helps.