Is my website hacked? Signs, how to check, what to do

Common signs your website has been hacked

Few hacks today replace your home page with a taunting message. Most are quiet: the attacker wants to use your site's reputation to send visitors elsewhere, rank spam pages, or send email. Many hide from the owner on purpose, showing you the normal site while search visitors and phone users see something else.

• Redirects to other sites. Visitors, especially those arriving from Google or on a phone, land on a shop, a prize draw, an adult site or a fake update page.
• Unknown pages in search results. Searching your company name shows pages on your domain that you never wrote, often in Japanese or another foreign language, or pushing pharmaceuticals and knock-off goods.
• A warning screen. The browser shows a red "Dangerous site" page, or you receive a security issue email from Google Search Console.
• Admin users you don't recognise in WordPress or whatever system runs the site.
• Files you didn't put there, or files that changed on a day nobody on your team touched the site.
• A burst of outgoing email, or a flood of bounce messages for mail you never sent.
• A notice from your hosting provider that they found malicious files or suspended the account.
• A customer tells you their antivirus blocked your site or they ended up somewhere odd.

One sign on its own does not prove a hack. A bad ad network, a browser extension or a problem on the visitor's own device can look similar. The checks below tell you which it is.

How to check if your website is hacked, step by step

These are ordered from easiest to hardest. The first four need no login to your site.

1. 1

   Search Google for site:yourdomain.com

   Type site: followed by your domain into Google. You get the pages Google has indexed for your site. Scan the titles for anything you did not write, and note whether the number of results is far larger than your real page count.

2. 2

   Check Google Safe Browsing

   Open the Safe Browsing site status tool and enter your address. It tells you whether Google currently finds unsafe content on the site, without you having to visit it.

3. 3

   Visit like a stranger would

   Open a private (incognito) window, search for your business on Google and click through to your site from the results. Repeat on a phone using mobile data with Wi-Fi turned off. This is how you catch hacks that hide from logged-in owners.

4. 4

   Open the Security issues report

   If your site is verified in Google Search Console, go to Security & Manual Actions, then Security issues. Google lists hacked content, malware and deceptive pages it has found, with example URLs. If you are not set up yet, do it now; future alerts will reach you by email.

5. 5

   Review your admin users

   In WordPress, open Users and filter by Administrator. An account you don't recognise is close to conclusive. Look for plugins you did not install while you are there.

6. 6

   Look for recently changed files

   In your host's file manager or over SFTP, sort files by date modified. Be suspicious of program files (.php) inside image or upload folders, files with random-looking names, and changes on dates when nobody was working on the site.

7. 7

   Ask your hosting provider

   If you still cannot tell, ask your host whether they see malicious files or unusual logins on the account. Many will run a malware scan or check the logs for you.

A clean result on every check is not proof that the site is clean. Google may simply not have noticed yet. If the symptoms continue, have your host or a specialist look inside the server.

Website hacked? What to do first

The instinct is to delete the bad pages immediately. Hold off for a moment: once the evidence is gone, nobody can work out how the attacker got in or what they touched.

1. 1

   Preserve evidence

   Take screenshots of what you saw and save any notices. If you can, download a copy of the site files and the server access logs as they are now, or ask your host to preserve them.

2. 2

   Take the site offline

   Switch to a maintenance page or suspend the site so visitors are not harmed while you work. Your host can do this if you are unsure how.

3. 3

   Change every password from a clean device

   Hosting control panel, SFTP, database, site admin accounts and email. Do it from a device you have scanned for malware, because stolen passwords often come from an infected office computer.

4. 4

   Bring in your host and your developer

   Tell them what you noticed and when, and agree who is investigating and who is restoring.

5. 5

   Restore from a clean backup

   Use a backup taken before the hack began. If you don't know when it started, you risk restoring an already infected copy, which is why the logs matter. With no usable backup, the malicious code has to be removed by hand, usually by a specialist.

6. 6

   Update everything and close the way in

   Update the core software, plugins, themes and server software. Remove unused plugins, unknown users and old test copies of the site.

7. 7

   Ask Google to review

   If Google flagged the site, fix every issue and then select Request Review in the Security issues report, explaining what happened and what you did. Google says reviews usually take from several days to a few weeks, and resubmitting while one is pending slows things down.

Who to tell when your website is hacked

• Your hosting provider. They can suspend the site, provide logs and backups, and often scan for malware.
• Your web developer or agency, or a specialist cleanup service if nobody maintains the site.
• Your payment provider, if the site takes card payments in any form.
• Your customers and regulators, where the law requires it. If the site or server holds personal data (contact forms, orders, member accounts), check the breach-notification rules that apply where you operate and where your customers live. Deadlines can be short, so take advice early rather than after the cleanup.

How do websites get hacked in the first place?

Small business sites are rarely singled out. Attackers scan the internet automatically for known weaknesses and break into whatever they find. The ways in are predictable.

If your site runs on WordPress, our guide to checking WordPress for vulnerabilities walks through the specifics.

How to stop your website being hacked again

• Check for updates at least monthly, and turn on automatic updates where they are available.
• Keep admin accounts to the people who need them, with long unique passwords and two-factor authentication.
• Delete unused plugins, test sites and backup files sitting in public folders.
• Run automatic backups, keep a copy away from the server, and test a restore once.
• Stay verified in Google Search Console so alerts reach you.
• Have the outside of your site checked for weaknesses on a schedule.

On that last point, here is plainly what Security Ready does and does not do. We do not clean up or recover hacked sites, and we do not remove malware. A scan from the outside also cannot prove that a site is clean.

What it does is find the weaknesses attackers use to get in, before they do: known flaws in outdated software, files that should not be public, encryption and security settings, and forgotten subdomains, each with instructions for the fix. On the Standard plan, the internal check on Linux servers also counts signs of compromise, such as files written the way backdoors (web shells) usually are. Only the count and the file locations are sent. Finding nothing is not a guarantee, and a match is a prompt to look, not a verdict.

For a first look at what is visible from outside, the 30-second quick check reads your certificate, https setup, email spoofing protection and forgotten subdomains. It does not detect malware or hacked pages. Once you have recovered, a free first full scan is a sensible way to confirm the doors are closed.