10 Signs Your Website Has Been Hacked (and What to Do Next)
Many hacked websites look normal to their owners for weeks. Learn the warning signs, the first steps to take and how to prevent a repeat attack.
Modern website attacks are designed to stay hidden. Attackers often want to use your site to send spam, host phishing pages or redirect your visitors, and they cannot do that if you notice. That is why many owners only discover a hack when Google or a customer tells them. Here are the signs to watch for.
The warning signs
- Browser warnings. Chrome shows "Deceptive site ahead" or similar.
- Strange search results. Searching site:yourdomain.com shows pages about pharmacy, casinos or foreign language spam.
- Unexpected redirects. Visitors, especially on mobile or from Google, are sent to other websites.
- Unknown admin users. New administrator accounts you did not create.
- Search Console alerts. Google reports security issues or manual actions.
- Hosting suspension. Your host disables the account for malware or spam.
- Sudden slowness or high resource usage. Hidden scripts consuming server power.
- Unfamiliar files. PHP files in upload folders or odd file names in core directories.
- Email problems. Your domain is blacklisted or your server is sending spam.
- Modified content. Links or text you did not add, sometimes hidden from logged in users.
What to do immediately
- Do not panic, and do not delete everything. You may destroy evidence needed to find the entry point.
- Take a full backup of the current state for investigation.
- Change passwords for WordPress admins, hosting, FTP, database and email.
- Contact your host to learn what they have detected.
- Get a professional cleanup if you are not experienced with malware removal.
Removing the visible malware is easy. Finding the backdoor the attacker left behind is the real job.
Why surface cleanups fail
Attackers usually leave backdoors: hidden scripts, rogue admin users or modified files that let them return. If the original vulnerability, often an outdated plugin, is not fixed, the site is reinfected within days. A thorough cleanup covers files, database, users, scheduled tasks and server configuration, and then closes the entry point.
After the cleanup
- Request a review in Google Search Console to remove warnings
- Check email blacklists and request delisting if needed
- Enable a web application firewall
- Turn on two factor authentication for all admins
- Set up off site backups and file change monitoring
- Keep everything updated through a care plan
