Signs your website has been hacked
Hacked websites rarely look hacked to their owners. These are the signs to look for, what to do first if you see them, and how to catch a break-in early.
A hacked website rarely announces itself. Attackers usually want your site to keep working, because they're using it quietly: to send spam, to redirect your visitors elsewhere, or to boost other sites on Google. That's why a hack can go unnoticed for weeks.
The warning signs
- Google shows a warning, such as "This site may be hacked" under your listing, or a red full-page warning in Chrome.
- Visitors get sent somewhere else, often only when they arrive from Google or on a phone, so you may never see it yourself.
- Strange pages appear in Google when you search for your own site: pages about pills, casinos, loans or text in another language.
- New admin users appear in your website's dashboard that nobody on your team created.
- Your host suspends the account or emails you about malware or unusual activity.
- Your emails start landing in spam, or bounce, because your domain has been used to send junk.
- Your Google traffic drops suddenly without any other explanation.
What to do first
- Don't delete things in a panic. You may remove evidence of how they got in.
- Change the passwords for your website admin, hosting account and email.
- Ask your host or developer to restore a clean backup from before the hack, then update everything.
- Find out how they got in, usually an outdated plugin or a weak password, and close that gap, or it will happen again.
- If Google shows a warning, request a review in Google Search Console once the site is clean.
How to catch a hack early
The earlier you know, the smaller the damage. A daily outside check can spot injected scripts, spam links and a listing on Google's unsafe-site list long before customers notice. Keeping software up to date closes the doors most attackers use in the first place.
Common questions
Why would anyone hack a small business website?
Most attacks are automated. Bots scan the whole internet for known weaknesses and break into whatever they find, whatever the size of the business.
Can I check myself whether my site is on Google's unsafe list?
Yes. Google offers a public Safe Browsing site status check, and our free website check includes it.
Will restoring a backup fix a hack?
It removes the damage, but not the way in. Unless the weakness is fixed, the site is often hacked again within days.