Most website owners do not find out their site is hacked from their own tools. They find out from Google, from a customer, or from a hosting suspension notice. By then the damage to rankings, leads and trust is already done.
The good news is that most hacks leave clear traces. This guide shows the warning signs, a simple way to check any website in about fifteen minutes, and what to do if you find something. It applies to every kind of site: WordPress, Shopify, Wix, Joomla, Magento and custom-built websites.
10 warning signs your website may be hacked
- Google shows a warning. Search results say "This site may be hacked" or your browser shows a red "Deceptive site ahead" page.
- Strange titles in search results. Your pages appear with text about pills, gambling, loans or counterfeit goods.
- Traffic or rankings drop suddenly with no change on your side.
- Visitors are redirected. People who arrive from Google land on another site, while typing your address directly works normally.
- New pages you did not create, or a jump in the number of indexed pages in Google Search Console.
- Unknown admin accounts in your dashboard, or you are locked out of your own account.
- Your site is slow or keeps going down, often because malware is using your server.
- Your host contacts you about malware, spam email sent from your account or unusual resource use.
- Files or settings changed that nobody on your team touched.
- Customers report problems: spam emails that look like they came from you, odd pop-ups or failed checkouts.
One sign alone is not proof. Two or more together mean you should check right away.
How to check your website, step by step
1. Look at how Google sees your site
Search Google for site:yourdomain.com and scan the results for titles or pages you do not recognise. Then add words such as site:yourdomain.com casino, site:yourdomain.com pharmacy and site:yourdomain.com loan. Open Google Search Console and look at Security issues and Manual actions. Google tells you here when it has detected hacking or malware.
2. Test from a search result, not from your bookmarks
Some hacks redirect only visitors who arrive from Google, so the site looks fine when you type the address. Search for your brand name, click your own result from a phone on mobile data, and note anywhere you land that is not your site.
3. View the page source
Open your home page, right-click, choose View page source and search for display:none, iframe, eval( and base64. Look for links or scripts that point to domains you do not know, especially near the bottom of the page.
4. Check who can log in
Review the list of admin and staff users in your website's dashboard. Delete accounts you do not recognise, and check the last login time on the ones you keep. A new admin account is one of the most reliable signs of a break-in, because attackers use it to get back in after you clean up.
5. Check your files for recent changes
In your hosting file manager or over SFTP, sort files by last modified date. Look for changed files you did not edit, unfamiliar files in the main folder and script files inside upload or image folders. Executable code should not live where visitors upload pictures.
6. Check the basics outside your site
- SSL certificate: make sure it is valid and not about to expire.
- DNS records: confirm your nameservers and mail records have not been changed.
- Exposed files: try
yourdomain.com/.env,yourdomain.com/.git/configand old backup files such asbackup.zip. If any of these download or load, they are leaking secrets. - Security headers: missing headers such as HSTS and Content-Security-Policy make attacks easier.
7. Run an outside scan
An outside-in scanner does most of the steps above automatically. It fetches your public pages as a visitor and as Googlebot, then looks for hidden links, spam keywords, malicious scripts, cloaking, conditional redirects and exposed files. UrKavach does this free from the form below and can repeat it on a schedule, with alerts when something changes.
What to do if your website is hacked
- Stay calm and take a backup of the infected site and database, so you can investigate later and compare with a clean copy.
- Put the site in maintenance mode if it is spreading malware or sending spam, to protect your visitors.
- Change every password: website admins, hosting account, FTP/SFTP, database and the email linked to them. Turn on two-factor login wherever possible.
- Remove the malicious code and unknown users. Replace core software, plugins and themes with fresh copies from official sources, rather than patching them by hand.
- Find how they got in. The usual causes are outdated plugins or themes, weak or reused passwords and leftover test files. If you skip this step, the hack comes back.
- Ask Google to review the site if you received a warning, and resubmit your sitemap. Only do this once the site is genuinely clean.
If you are not comfortable doing this yourself, ask your hosting provider or a website security professional. A half-finished clean-up is the main reason hacks return a week later.
How to catch the next attack early
- Keep your website software, plugins and themes updated, and delete the ones you do not use.
- Use strong, unique passwords and two-factor login for everyone with access.
- Keep tested backups stored away from your main server.
- Monitor uptime, SSL expiry, file changes, new admin accounts and hidden links continuously, with alerts to your email or Slack.
The earlier you hear about a problem, the less time Google and your customers have to see it.
Frequently asked questions
How do I know if my website has been hacked?
Look for a Google warning, strange search results, redirects for visitors from Google, unknown admin users or changed files. A free outside scan can confirm many of these in under a minute.
Can a website be hacked without me noticing?
Yes. Many hacks are built to stay hidden from the owner. Spam may appear only to Googlebot, and redirects may fire only for visitors from search, so the site looks normal when you open it yourself.
Will a hack hurt my SEO?
Yes. Spam pages, hidden links and warnings can lower rankings and reduce clicks. Rankings usually recover after a full clean-up and a successful review in Google Search Console.
How often should I check my website for hacks?
Continuous monitoring is best. If you check by hand, do it at least weekly, and every time you install or update a plugin, theme or extension.