Knowing how to tell if your website is hacked can be the difference between a quick recovery and a catastrophic loss of traffic, data, and customer trust. Hackers rarely announce themselves — instead, they leave subtle (and sometimes not-so-subtle) clues scattered across your site, your hosting account, and your search results. If anything on this list looks familiar, treat it as urgent.

What Are the Most Common Signs Your Website Has Been Hacked?

Not every hack looks like a dramatic defacement. Many compromises are deliberately quiet, designed to steal data or hijack traffic without alerting you. Below are the 12 warning signs every website owner should know.

1. Your Browser Flags the Site as "Dangerous" or "Deceptive"

When Chrome, Firefox, or Safari displays a full-screen red warning — "Deceptive site ahead" or "This site may harm your computer" — Google's Safe Browsing service or a similar blocklist has already flagged your site as malicious. According to Google Search Central, these warnings are triggered after automated scanners detect malware, phishing pages, or harmful downloads hosted on your domain. Do not dismiss this warning or ask visitors to click through it. Check your status immediately at Google Safe Browsing Transparency Report.

2. Google Search Console Has Sent You a Security Alert

Google Search Console (formerly Google Webmaster Tools) sends direct email notifications when it detects hacked content or malware on your site. Log in to Search Console and check the Security & Manual Actions → Security Issues report. If issues are listed there, Google has evidence of a compromise. This is one of the most reliable early-warning systems available to website owners, and it is free.

3. Your Website Redirects Visitors to a Different Site

If users — or you — are being redirected to spammy pages, pharmaceutical sites, gambling portals, or adult content, your site almost certainly contains a malicious redirect. These are commonly injected into:

  • Your site's index.php or index.html file
  • The .htaccess file (Apache servers) or web.config (IIS servers)
  • JavaScript files loaded site-wide
  • Your WordPress functions.php or active theme files

Redirects are sometimes conditional — they may only fire for visitors arriving from Google, or only on mobile devices — so always test from an incognito browser window and try clicking a Google search result for your site rather than typing the URL directly.

4. You Notice New Admin Accounts or Users You Did Not Create

Log in to your CMS (WordPress, Joomla, Drupal, etc.) and review all user accounts. Attackers who have gained access commonly create backdoor administrator accounts so they can return even after you change your password. In WordPress, navigate to Users → All Users and look for any accounts you do not recognise, particularly those with the Administrator role. Unknown admin accounts are a near-certain sign of compromise.

5. Your Site's Files or Code Have Been Secretly Modified

Check the last-modified timestamps on your core files. In many hosting control panels you can sort files by date modified. Look for changes to files like:

  • wp-config.php
  • wp-login.php
  • /wp-includes/ or /wp-admin/ directory files
  • Theme files such as header.php, footer.php, functions.php

A quick way to verify WordPress core file integrity is to run wp core verify-checksums using WP-CLI, which compares your files against the official checksums published by WordPress.org. Any mismatch is a red flag.

6. Your Site Is Sending Spam Email

If you receive bounce notifications for emails you never sent, or customers are telling you they are receiving spam that appears to come from your domain, your hosting account's mail server has likely been compromised. Attackers frequently exploit contact forms, PHP mailer scripts, or stolen FTP credentials to use your server as a spam relay. Check your hosting control panel's mail logs and look at your domain's reputation using tools like MXToolbox to see if your IP or domain is listed on email blocklists.

7. Search Results Show Strange Titles, Descriptions, or Pages

Search for your site in Google using the operator site:yourdomain.com. If you see pages indexed that you never created — especially pages with pharmaceutical keywords ("buy cheap Viagra"), casino terms, or foreign-language content — you are almost certainly a victim of SEO spam injection, sometimes called a "Japanese keyword hack" or a "pharma hack." These injected pages exist only to siphon search traffic and can take months to clean up if left untreated. OWASP lists injection attacks among the most critical web application security risks.

8. Your Website Has Slowed Down Dramatically or Goes Offline

A sudden, unexplained drop in performance or repeated outages can indicate that your server is being used to run cryptocurrency mining scripts, launch attacks on other servers (part of a botnet), or serve large volumes of spam. Check your hosting control panel's resource usage graphs for CPU and RAM spikes. While slowdowns have many innocent causes, unexplained resource consumption combined with any other sign on this list warrants an immediate security audit.

9. Legitimate Antivirus Tools Flag Your Site's Downloads or Scripts

If users report that their antivirus software is warning them about content downloaded from your site, or if a tool like Sucuri SiteCheck (free at sitecheck.sucuri.net) detects malicious code in your pages, take it seriously. Online scanners typically check the front-end output of your pages against known malware signatures. Be aware that server-side infections are not always visible to these tools, so a clean result does not guarantee a clean server.

10. Your Hosting Provider Has Suspended Your Account

If your site is displaying a suspension notice from your hosting company rather than your normal content, the host has likely detected malware, abusive resource usage, or spam originating from your account. Contact your hosting provider's support team immediately. Most reputable hosts will tell you the specific reason for suspension and point you to the offending files. Do not simply restore from a backup and reactivate without removing the malware, as you will be suspended again.

11. Visitors or Customers Report Seeing Unusual Pop-ups or Warnings

Your own browser may not show signs of compromise if an attacker has configured the malware to hide from logged-in users or from certain IP addresses. Visitors — especially those arriving from search engines on mobile devices — may see pop-ups, fake virus alerts, unwanted ad overlays, or phishing forms. Take every report from a visitor seriously and investigate using an incognito browser window or a tool like Google's Mobile-Friendly Test, which renders your page in a clean environment.

12. Your SSL Certificate Is Missing, Expired, or Invalid

Attackers who have deep access to a server sometimes tamper with SSL configuration to intercept encrypted traffic. More commonly, a compromised site may have its certificate revoked by the Certificate Authority after malicious content is detected. Check that your padlock is intact in all major browsers. You can also verify your certificate's validity and check whether it has been revoked using SSL Labs' SSL Test (ssllabs.com/ssltest). An unexpected "Not Secure" warning that appeared suddenly — rather than after a predictable renewal lapse — should be investigated as a potential security incident.

What Should You Do If You Spot These Warning Signs?

If you recognise one or more of the signs above, take these immediate steps:

  1. Do not panic, but act quickly. Every hour a compromised site remains live, the damage deepens.
  2. Put your site into maintenance mode if your platform allows it, to protect visitors while you investigate.
  3. Change all passwords immediately — hosting control panel, FTP/SFTP, CMS admin, database, and any connected third-party services.
  4. Enable two-factor authentication (2FA) on every account that supports it.
  5. Take a full backup of the current (infected) state before making changes — your hosting provider or a security professional may need it to trace the attack vector.
  6. Run a full server-side scan using a trusted security plugin (such as Wordfence for WordPress) or engage a professional malware removal service.
  7. Review and submit for review in Google Search Console once you have cleaned the site, to have any Google Safe Browsing warnings lifted.
  8. Report the incident if customer data was involved. In the United States, CISA (Cybersecurity and Infrastructure Security Agency) provides breach guidance at cisa.gov. In the UK, you are legally required to report data breaches to the ICO within 72 hours under UK GDPR.

Frequently Asked Questions

Can a website be hacked without the owner noticing?

Yes — and this is extremely common. Attackers often deliberately avoid visible changes to stay on your server as long as possible. Hidden malware, SEO spam injections, and backdoor accounts can exist on a site for months before detection. Regularly scheduled security scans and monitoring through Google Search Console are the best defences against silent compromises.

How do I check if my website has malware for free?

Start with Google Search Console's Security Issues report, which is free and authoritative. You can also run a free front-end scan at Sucuri SiteCheck (sitecheck.sucuri.net) or check your domain's Safe Browsing status at Google's Transparency Report. For WordPress sites, the free version of Wordfence can scan server-side files as well.

Will Google penalise my site if it gets hacked?

Yes, Google can and does apply manual actions or algorithmic penalties to hacked sites, particularly those containing spammy injected content or serving malware. These penalties suppress your rankings and can be difficult to recover from. Once you have cleaned the site, you must submit a reconsideration request through Google Search Console to have manual actions reviewed and lifted.

How long does it take to recover from a website hack?

Recovery time depends on the severity and type of attack. A straightforward malware removal on a small WordPress site can take a few hours to a day. Cleaning up large-scale SEO spam injections that have been indexed by Google can take several weeks for rankings to fully recover, even after the site is technically clean. Acting quickly the moment you spot warning signs significantly shortens recovery time.

How can I prevent my website from being hacked in the future?

The most effective preventive measures are: keeping all software, themes, and plugins fully updated; using strong, unique passwords with 2FA on all accounts; installing a web application firewall (WAF); taking daily automated backups stored off-server; removing unused plugins and themes; and running regular security scans. OWASP's Top Ten project and CISA's cybersecurity resources both provide free, authoritative guidance on hardening web applications.