Is My Website Hacked? The Signs, Checked in Order

Most hacked websites do not announce themselves with a skull and crossbones. They whisper. A customer mentions your site sent them somewhere weird. Traffic dips for no clear reason. Google puts a little warning next to your listing. By the time I get the call, the infection has usually been sitting there for weeks, sometimes months.

Here is how to check your own site, in roughly the order I check them. The further down this list you get a yes, the more certain the answer is.

The signs, in order

• Visitors get redirected to spam. Someone clicks your site and lands on a gambling page, a pharmacy store, or a fake prize giveaway. You may never see it yourself, because these redirects often only fire for visitors arriving from Google, or only on phones.
• Pages you never wrote exist. Foreign language content, cheap watch stores, essay writing services, loan offers. Search your own site on Google with site:yourwebsite.com and look for anything you do not recognize.
• Google warns about you. Your listing shows "This site may be hacked" or your browser shows a red warning screen. That is Google telling the whole world before it told you.
• New admin users you did not create. In WordPress, check Users. If there is an administrator account you do not know, somebody has a key to your house.
• Your host emails you about malware. Hosting companies scan for this. Owners ignore those emails all the time, or they land in spam. Search your inbox for your host's name plus the word malware.
• Traffic or rankings suddenly change. A cliff drop, or a strange spike from countries you do not serve. Either one can mean your site is busy doing somebody else's work.

What to do in the first hour

Stay calm and do less than you want to. Take screenshots of anything strange. Write down exactly what you saw and when. Change your hosting and WordPress admin passwords from a clean device. Then stop clicking around inside the site. Every plugin you install and every file you delete makes the cleanup harder to do properly, because the evidence of how they got in disappears.

If customers are being sent to spam right now, that is same day territory. That is what the emergency website help on this site exists for.

What not to do

Do not just restore an old backup over the top of it. I know it is tempting, and it feels decisive. The problem is you rarely know when the infection started. Restore a backup from after they got in, and you have simply reinstalled the hack with extra steps. Restore one from before, and the hole they walked through is still open in it, because the hole was there when the backup was made too. Backups are part of a cleanup. They are not the cleanup.

Also skip the free security plugin and the one click fix button. Those tools find the loud files. Hackers count on you stopping there. The quiet stuff, the extra admin account, the scheduled task that reinfects the site overnight, survives.

If your site runs on WordPress, my WordPress troubleshooting guide walks through the broader checks I run when a site is acting wrong, hacked or not.

How sure do you need to be?

One sign from the list is a reason to look closer. Two signs is a cleanup conversation. The redirect, the foreign pages, and the unknown admin account are the three I treat as confirmed until proven otherwise. When a site is flagged by Google as hacked, the clock is already running on your search traffic. And the redirect sign deserves its own read, because a website redirecting visitors to spam is the one owners miss the longest.

This is my daily work, and it is exactly the kind of thing I handle live on a screen share while you watch. We look at your actual site together, I show you what I am seeing and why, and we clean it with you in the room, not after a ticket disappears into a queue.