7 Warning Signs Your Website Has Been Hacked

Most hacks are designed to stay hidden. Attackers want your traffic, your search rankings or your server, and they get more of all three the longer you do not notice. These are the signs we see most often when a site owner asks for help.

The signs

• Visitors from Google land on a different website. Spam redirects often only fire for mobile visitors coming from search, so you never see them yourself.
• Google shows “This site may be hacked” under your listing, or Chrome shows a red warning page.
• Strange pages in search results, such as pharmacy or casino pages under your domain. Search site:yourdomain.com to check.
• New admin users you did not create.
• Unknown scripts in your page source, often from look-alike domains.
• A sudden traffic drop or a sudden spike from countries you do not serve.
• Your host suspends the account for sending spam or using too many resources.

What to do first

Do not delete things at random. Take a full backup of the infected site first (it is evidence and a fallback), change every password (hosting, WordPress, database, FTP), then clean or restore from a known-good backup. Finally, request a review in Google Search Console so the warning comes off.

A change monitor that fingerprints your pages every day spots new scripts and hidden links within hours, long before Google does.