How to tell if your website has been hacked

Warning signs most owners miss

• Visitors get redirected to spam, gambling or fake shop sites — sometimes only on mobile, or only when arriving from Google, so you never see it yourself.
• Strange pages appear in Google under your domain, often in Japanese or other languages you don't use, selling products you've never heard of.
• Browsers or Google show warnings like "This site may be hacked" or "Deceptive site ahead".
• Admin users you didn't create appear in your CMS.
• New or changed files on your server, especially PHP files in upload folders.
• Your host suspends the account or reports high resource usage or outgoing spam.
• Your emails start bouncing or landing in spam, because your server was used to send spam.
• The site is suddenly slow, or customers report pop-ups, odd payment pages or antivirus warnings.

Five-minute checks you can do right now

1. Search Google for site:yourdomain.com. Scroll through the results. Any pages or titles you don't recognise?
2. Check Google's Safe Browsing status for your domain on Google's Transparency Report site.
3. Open Google Search Console and look at Security & Manual Actions → Security issues. (If you haven't set it up, do it now — it's free.)
4. Visit your site on your phone using mobile data, arriving from a Google search rather than typing the address.
5. Review admin users in your CMS and hosting account. Remove anyone you don't recognise — after noting their details.

If you think you've been hacked: first steps

1. Don't panic, and don't delete things yet. The changed files are evidence of how the attacker got in. Deleting them may leave the door open.
2. Take a snapshot backup of the current (infected) site for investigation.
3. Change passwords from a clean device: hosting, CMS admins, FTP/SFTP, database, domain registrar and email. Turn on two-factor authentication.
4. Put the site in maintenance mode if it's sending visitors to malware or phishing pages, so customers aren't harmed.
5. Tell your hosting provider. They may be able to see logs and scan the account.
6. Find and close the entry point — usually an outdated plugin, a stolen password or an upload flaw. Cleaning without fixing this means you'll be hacked again, often within days.
7. Clean or restore from a backup taken before the hack, then update everything.
8. Ask Google to review your site in Search Console once it's clean, to remove warnings.

Should you handle it yourself?

If the site is simple and you have a clean backup from before the hack, you may be able to restore and update it yourself. If you take payments, store customer data, or the hack keeps coming back, get help — a hidden backdoor will undo your clean-up.

Once you're back online, work through our website security checklist so it doesn't happen again.