Fixing a website that is slow, broken or hacked

Work out what is wrong before you pay anybody. Nearly every broken website is one of six problems, and twenty minutes with free tools tells you which. Run the checks below, then decide if you need an hour of somebody's time, a cleanup service, or a new site.

How do I improve my website speed, and is it responsive?

Both questions have the same free first step: PageSpeed Insights, run on the mobile tab rather than desktop, on the page people actually arrive at. It reports what is slow and, in the same run, whether the layout is usable on a phone.

Four causes account for most slow small-business sites, in this order: images uploaded at full camera resolution, a page carrying more scripts than content, a slow or oversubscribed server, and fonts loading before anything can be drawn. The first is the most common by a distance and the cheapest to fix.

Mobile responsive website design is not a separate product to buy in 2026 — it is the baseline, and a site that fails it is not under-featured but broken. Test it the way a customer would: your own phone, your own homepage, one hand. If you have to pinch to read the phone number, no amount of speed work will help.

Fix my website: what is actually wrong with it?

Match your symptom below. Every cause here can be confirmed free, from your own phone, without giving anybody access to anything. Knowing the cause stops you being sold a fix you do not need.

Why does my website say "Not secure"?

Because the page is served over plain HTTP, or the certificate lapsed. Since Chrome 68 in July 2018, "all HTTP pages will be marked with 'Not Secure'", per the Chromium project. The certificate costs nothing: Let's Encrypt says "we do not charge a fee for our certificates", and its default certificates last 90 days, renewed automatically by any competent host. If yours charges $80 a year, or renewal is something you must remember, the hosting is the problem.

How slow is too slow?

Google publishes the numbers: largest thing on screen within 2.5 seconds, interactions answered within 200 milliseconds, layout shift under 0.1, measured at the 75th percentile of real visits (web.dev, Google). PageSpeed Insights gives you your three numbers free.

Read the Diagnostics list, not the score. The usual culprit is photographs: a picture off a phone is often 2 MB to 5 MB, and resized to 1,600 pixels wide as WebP it is typically under 200 KB. Re-uploading them at a sane size costs nothing.

Does my website work on a phone?

Open it on your own phone, on cellular data, and do what a customer does: tap the number, find the hours, send the form. If that needs pinching and zooming, it is broken, and it is a ranking problem too. Google Search Central states that "Google uses the mobile version of a site's content, crawled with the smartphone agent, for indexing and ranking" ( mobile-first indexing docs). The desktop version is not what gets judged.

My website was hacked. What do I do, in what order?

Take it offline, change every password, restore from a backup taken before the compromise, then find out how they got in. Any other order is why cleanups fail and the spam returns a week later.

1. Take it offline. Maintenance mode, a holding page, or ask the host to suspend the account. That protects visitors and stops Google recording more bad pages.
2. Change every password, not just the admin one. Hosting control panel, SFTP, database user, every CMS administrator, the registrar, and the email address those reset to. Delete admin users you do not recognise: Sucuri's 2023 Hacked Website Report found that "55% of the websites infected with database malware were found with at least one malicious admin user".
3. Restore from a backup taken before the compromise. Open Security Issues in Search Console for the date Google first detected it, and restore from before that date. Last night's backup usually contains the infection.
4. Only then work out how they got in. Update the CMS, every plugin and every theme before it goes back online. The same report found "a total of 39.1% of CMS applications were outdated at the point of infection".

Once clean, request a review in Search Console. Google says "most reconsideration reviews can take several days or weeks", so file it the day you finish.

Why cleaning a live site usually fails

The attacker left a way back in. Sucuri's 2023 report found 49.21% of compromised websites carried at least one backdoor, so deleting the spam you can see does nothing about the file that puts it back tonight. The hole they came through stays open too. A restore plus a patch closes both.

Is my website down for everyone, or just me?

Check at Down for Everyone or Just Me. If it is down for everyone, three of the four usual causes are billing: domain expired, hosting invoice bounced, DNS changed, server down. Run WHOIS at ICANN Lookup: it shows the domain expiry date, free. An expired domain takes the site and usually the email with it, and the fix is a renewal fee, not a developer. Then set up UptimeRobot: the free plan covers 50 monitors at 5-minute checks.

The site works, so why am I getting no leads?

Three tests, ten minutes. Send yourself an enquiry through your own form: silent form failures after a host change or plugin update are common and invisible. Tap your own number on a phone; it should dial. Then open Search Console Performance. Near-zero impressions is a visibility problem, not a broken site (why your site is not showing up on Google); impressions with almost no clicks means the titles and descriptions are the problem.

Should I pay somebody once instead of rebuilding?

Often, yes. Fablence sells a rebuild on a monthly plan, so we are the wrong answer to one small fault on an otherwise fine site. Pay a freelancer once and keep your website.

When does a rebuild cost less than more repairs?

When the repairs repeat. A Fablence site is $299 once, charged only when you approve the design, then $69 a month: $1,127 for year one, $828 a year after that (as of September 2026). Add up what last year really cost you, your hours included, before you compare.

WHAT MY WEBSITE COST ME LAST YEAR

Hosting                             $ ______
Domain renewal                      $ ______
SSL certificate (should be $0)      $ ______
Plugin / theme licences             $ ______
Repair invoices (every one)         $ ______
Malware cleanup                     $ ______
My hours  ____ x $____ per hour     $ ______
Calls lost while it was offline     $ ______
                                    --------
TOTAL                               $ ______

Compare: $299 once, on approval, + $69/mo = $1,127 year one.

Under a few hundred dollars, with nothing broken twice: keep the site and fix the one thing. Above $1,127, or with weekends spent on it, the arithmetic has decided. A rebuild only wins when it removes the causes: no plugins to fall out of date, nightly backups, uptime monitoring, a certificate that renews itself, 30 minutes of edits a month, and old addresses redirected so the rankings come across (how that works). It does not undo a hack by itself: an attacker holding your registrar or email password still holds the new site.

Your current site already carries your services, hours, photos and copy, so we take it from there: you send us nothing. We rebuild the homepage first at a private link and delete it if you say no. You owe nothing until you approve the design, and an approved site is live within 72 hours. The domain, content, leads and Google Business Profile stay yours (we are only ever Manager), a full export is yours the same day you ask, free, month to month, 30 days' notice. More at how we work and pricing.