9 Signs Your Website Has Been Hacked (and How to Check)

Short answer: The most common signs of a hacked website are browser or search engine warnings, redirects to unrelated sites (often only on mobile or only for visitors from search), spam pages or foreign-language results in search, unknown admin users, unexpected file changes, strange outgoing e-mail, a sudden slowdown or traffic spike, hosting account warnings, and security tools reporting malware. Many hacks are designed to hide from the site owner, so check from outside – in a private window, from search results and on a phone – not only while logged in.

Website owners often imagine a hack as a defaced home page with a hacker’s message. That still happens, but it is rare. Modern compromises are usually quiet, because a hidden hack is more profitable: the attacker wants to keep using your site to send spam, host phishing pages, inject links for search manipulation or redirect your visitors to scams for as long as possible. That is why hacked sites often run for weeks before anybody notices. Here are the signs to look for, how to check each one, and what to do next.

Signs visible from the outside

1. Browser or search engine warnings

A red full-page warning such as “Deceptive site ahead” or “The site ahead contains malware”, or a note in search results saying “This site may be hacked”, means a security service has already detected something. These warnings are serious: they stop most visitors and can affect your search traffic until the problem is cleaned and a review is requested.

How to check: open your site in a private window in Chrome and Firefox, search for your brand name, and look at your site’s security issues report in Google Search Console, which lists detected problems and affected URLs.

2. Redirects to other websites

Visitors land on a pharmacy shop, a fake prize page, a gambling site or a tech-support scam instead of your content. Malicious redirects are often conditional, which makes them hard to reproduce: they may trigger only on mobile devices, only for visitors coming from search engines or social media, only once per visitor, or never for logged-in administrators.

How to check: search for your site on a phone using mobile data and click the result; repeat in a private desktop window. Ask a colleague on another network to do the same. Use curl -sI with different user agents to see whether the server returns unexpected redirects.

3. Spam pages and strange search results

Search for site:yourdomain.com and scroll through the results. Signs of a hack include pages you never created, titles about pharmaceuticals, replica goods, loans or adult content, and results in languages your site does not use. Attackers create thousands of such pages to profit from your domain’s reputation – sometimes visible only to search engines, a technique called cloaking.

How to check: besides the search, look at the pages and sitemaps reported in your search console. A sudden jump in indexed pages or unfamiliar URLs in the performance report are strong indicators.

Signs on the server and in your accounts

4. Unknown users or changed permissions

An administrator account you do not recognise, an existing user suddenly promoted to administrator, or changed e-mail addresses on accounts are classic signs. Attackers create accounts so they can come back even after you fix the original hole.

How to check: review the user list in your CMS, the hosting control panel’s FTP/SSH accounts, database users and any API keys. Compare with who should have access.

5. Unexpected file and content changes

New PHP files in upload folders, modified core files, unfamiliar plugins, odd code at the top of index.php or wp-config.php, heavily obfuscated code (long strings of random characters, eval and base64_decode combinations), or hidden links in page footers all point to a compromise.

How to check: compare files with a known-good backup or the original software package, check recently modified files on the server (for example with find . -mtime -7), and look for PHP files in folders that should only contain images and documents.

Signs in e-mail, resources and reports

6. E-mail problems

A compromised site or hosting account is often used to send spam. Symptoms include bounce messages for e-mails you never sent, your hosting provider suspending outgoing mail, your domain or server IP appearing on blocklists, or customers receiving suspicious e-mails that seem to come from you.

How to check: look at the mail queue or sending logs in your hosting panel, check blocklist status for your server IP, and review your domain’s DMARC reports if you receive them.

7. Performance changes and resource spikes

A sudden slowdown, CPU usage at its limit, a jump in bandwidth, or the hosting account hitting resource limits can indicate that the server is being used for something else – mining cryptocurrency, attacking other sites, serving spam pages or sending mail.

How to check: compare resource graphs in your hosting panel with the previous months and look at access logs for unusual volumes of requests to unfamiliar URLs.

8. Warnings from your host or other services

Hosting companies scan accounts for malware and may send warnings, disable specific files or suspend the account. Payment providers, advertising platforms and e-mail services may also flag your domain. These messages are easy to dismiss as generic; read them carefully.

How to check: search your inbox – including spam folders and old addresses – for messages from your host, registrar and service providers in recent weeks.

9. Security tools and scanners report malware

A malware scanner plugin, a server-side scanner provided by your host or an external scan may report infected files or malicious code in pages. Treat any such report as worth investigating, even if the site looks normal to you.

How to check: run a scan from more than one source, because each tool detects different patterns. External checks are useful because some malware disables or hides from plugins running on the same site.

Signs at a glance

Build a ten-minute monthly hack check

Most of the checks above take a minute each. Doing them on a fixed day each month catches problems early without special tools: search site:yourdomain.com and skim the results, open the site on a phone using mobile data, review the list of administrator accounts, glance at recently modified files or the security plugin’s change log, look at the hosting resource graphs, and read any messages from your host or search console. Write the date and what you saw in a simple log. When something does change, that log tells you roughly when it started, which makes choosing the right backup much easier.

What to do if you find a sign

1. Do not panic, and do not delete things at random. You may destroy evidence of how the attacker got in.
2. Change passwords for the hosting account, CMS administrators, database and FTP/SSH – from a device you trust.
3. Put the site into maintenance mode if visitors are being harmed, for example redirected to scams.
4. Restore from a clean backup taken before the compromise, or have the site cleaned by someone experienced.
5. Find and close the entry point – usually an outdated plugin, theme or stolen password – before bringing the site back.
6. Request reviews from search engines and browsers once the site is clean, so warnings are removed.

How Site AI Audit helps

Site AI Audit is not a malware scanner, but it checks the site from outside the way visitors and search engines see it: SSL certificate, HTTPS redirect, security headers, exposed software versions, broken links and redirects on the crawled pages, and SEO signals such as titles and indexing rules. Unexpected changes in these areas are often the first visible trace of a problem. Paid plans monitor the site weekly or daily and alert you when something breaks. If you need help cleaning up, the report’s “Fix it for me” option lets Internet Solutions send you an estimate. Start with a free check.

Related reading

• WordPress Security Checklist: 20 Steps That Actually Matter
• Website Security for Small Businesses: Where to Start
• Exposed Software Versions: How to Hide Server and CMS Details

The bottom line

Most hacks are designed to stay hidden from the site owner, so waiting for an obvious defacement is not a strategy. Check your site the way outsiders see it: private windows, phones on mobile data, search results and external scans. Review users and files regularly, read your host’s warnings, and act quickly and methodically when you find a sign.

FAQ

Why does my site look normal to me but customers say it redirects?

Malicious redirects are often conditional. They may skip logged-in administrators, only trigger on mobile devices or only affect visitors arriving from search engines, so test from a private window on another device and network.

Can a website be hacked without any visible change?

Yes, and that is common. Hidden spam pages, backdoors, mail-sending scripts and data-stealing code are designed to stay invisible to the owner for as long as possible.

How do hackers usually get into small business websites?

Most often through outdated plugins or themes with known vulnerabilities, and through stolen or weak passwords for the CMS, hosting or FTP accounts. Abandoned test copies of a site are another frequent entry point.

Will restoring a backup fix a hacked website?

A clean backup removes the malicious changes, but the attacker can return through the same hole. Change all passwords and update or remove the vulnerable software before or immediately after restoring.

How can I be warned about a hack sooner?

Use external monitoring that checks your site regularly, register the site in search engine webmaster tools so you receive security notifications, and review users and plugins on a fixed schedule.