7 signs your website was hacked and what to do first

A customer messages you to say that when they searched for your business on Google, they got a “dangerous site” warning. Or you simply notice your site is slower than usual and you don’t know why. Either one can be the first sign that someone got into your site without permission.

A hacked site doesn’t always look broken. Often it keeps working fine for you while, behind the scenes, it serves different content to search engines or to certain visitors. Here are the most common signs and the first steps to take, without losing the information you’ll need to understand what happened.

1. Google or your browser show a warning

If you open your site and see a warning like “Deceptive site ahead” or “This site may harm your computer,” that’s Google’s Safe Browsing system flagging it. You can check your domain’s status without waiting to see the warning yourself, using the Safe Browsing site status checker in Google’s Transparency Report.

2. Search Console flags a security issue

If your site is verified in Google Search Console, that’s where Google usually flags problems first. The Security Issues report sorts what it finds into categories such as “hacked content” — code, links or pages someone added without your permission by exploiting a security flaw — and “malware.” If you’ve never checked this report, do it now, even if you haven’t noticed anything else wrong.

3. Pages show up that you didn’t create

Search Google for site:yourdomain.com (with your real domain) and look through the full list of indexed pages. If you see titles about things that have nothing to do with your business — medications, gambling, counterfeit brands — that’s one of the most common forms of hacking: content injection, which borrows your domain’s search reputation. As Google’s own guide on how to know if your site was hacked explains, those pages are sometimes shown only to Google and not to you as a regular visitor (a technique called cloaking), which is why checking site: is more reliable than just looking at your site yourself.

4. Visitors report redirects or unexpected pop-ups

If someone tells you that opening your site sent them somewhere else, or that ads or pop-ups appeared that you never added, don’t dismiss it just because it hasn’t happened to you. These redirects sometimes only trigger for people arriving from a search result, or only on mobile.

5. There are users or accounts you don’t recognize

Check the list of administrators or anyone with access to your site, your hosting panel and your domain. An admin account nobody on your team created, or content changes nobody on your team made, are among the most reliable signs that someone else has access.

6. There are files you don’t recognize, or ones that changed without you touching them

If you manage your own hosting (a WordPress site, for example), sort your site’s files by modification date. A .php file sitting inside an image-upload folder, or core platform files modified on a date when you didn’t run any update, point to someone having uploaded code.

7. Your host alerts you, or the site turns slow or stops responding

Many hosting providers detect abnormal activity (unusual resource use, mass outgoing email, suspicious outbound traffic) before you do, and suspend the site or notify you. A site that suddenly turns slow, crashes often, or starts sending email you never scheduled can have the same root cause.

What to do first

If you recognize one or more of these signs, order matters: acting fast without preserving anything can leave you without the information you need to close the door the attacker used.

1. Don’t delete anything yet. Before cleaning up or restoring, note what you’re seeing — which files, pages or accounts are new, and since when. That information helps your hosting provider, or whoever helps you clean up, find how the attacker got in.
2. Contact your hosting provider right away. Many have tools to isolate the site, check access logs, and in some cases have already spotted the problem before you did.
3. Change the passwords for your hosting panel, your CMS, your domain and the associated email account, from a device you know is clean. If you have two-factor authentication turned on, check it hasn’t been disabled; if you don’t have it yet, this is the moment to turn it on (we cover how in our cybersecurity article).
4. Restore from a clean backup, from before you noticed the problem, if you have one. If you don’t, or you’re not sure how long the site has been compromised, your hosting provider or a service that specializes in cleaning hacked sites can go through it file by file.
5. Check the Security Issues report in Search Console for example affected URLs; it helps confirm the cleanup covered everything.
6. Only request a review from Google once the site is fully cleaned. The same Search Console report explains how to request one. Asking before the problem is actually fixed can draw out the review.

A hacked site isn’t just a technical problem: while it stays flagged, you lose visitors, your customers’ trust, and, if your business depends on online sales, revenue. If you’d like to check your site’s security before this happens, or need help cleaning it up and closing the door the attacker used, our cybersecurity service covers both.