How to tell if your website has been hacked

If something about your website feels off, you're right to look into it. Most hacks on small business sites are automated and fixable, and the earlier you catch one, the easier the cleanup.

What are the warning signs your website was hacked?

No single sign proves a hack, but any of these is worth investigating today.

Visitors are redirected to spam or scam sites

Customers tell you your site sent them to a gambling, pharmacy or "you've won a prize" page. Attackers often redirect only some visitors, such as people arriving from Google or on phones, so it may look normal when you visit directly.

Admin users you didn't create

In your website dashboard, you find administrator accounts you don't recognize. Attackers add these so they can get back in even after you change your own password.

Google or browser warnings

Visitors see a red "Deceptive site ahead" or "This site may harm your computer" warning, or Google Search shows "This site may be hacked" under your listing. Google may also email you through Search Console.

Your domain is on a blocklist

Security companies keep lists of sites seen hosting phishing or malware. Google's Safe Browsing site status page notes that many unsafe sites it finds are "legitimate websites that have been compromised." Being listed can also send your emails to spam.

Spam is being sent from your domain

Customers or bounce messages reveal emails you never sent. This can mean your website or email account was compromised. It can also mean someone is faking your address without any access at all, which is called spoofing. The fix is different, so see how to stop email spoofing if your site seems fine.

Strange pages, files or content

You find pages you didn't create, foreign-language text, hidden links, or unfamiliar files on your server. Plugins or themes you don't remember installing are another red flag.

A sudden drop in search traffic

Visits from Google fall sharply for no obvious reason, or your search results show odd titles and descriptions. Google may have spotted hacked content and pulled back your pages.

If you recognize any of these, don't panic. The checks below help you confirm what's going on.

How can I check for hidden hacked pages?

Hacked content is often designed to hide from you. Google's guide on how to know if your site was hacked explains a technique called cloaking, which shows spam to search engines but a normal page to you.

These free checks help you see what others see:

1. Type site:yourbusiness.com into Google. Scroll through the results and look for pages, titles or languages you don't recognize.
2. Add and verify your site in Google Search Console, then open the Security issues report. If Google has detected a hack, it lists example pages here.
3. Enter your address on Google's Safe Browsing site status page.
4. Run an outside-in scan. A free CyberVigil scan checks whether your domain appears on the phishing and malware blocklists we use, and flags related warning signs.

Check your domain against phishing and malware blocklists

Run a free outside-in scan to see blocklist status, HTTPS, certificate and other settings in one report.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

What should I do first if my website was hacked?

Take a breath and work through these steps in order. If any step feels beyond your comfort zone, bring in your host or a professional.

1. Contact your host and tell them you think your site was hacked. Many hosts can scan for malware, isolate the site, and tell you when files changed. Ask whether they have a recent backup from before the problem started.
2. Change your passwords, starting with your hosting account, then your website admin, the email account that receives password resets, and any FTP or database passwords. The FTC's breach response guide explains why: "If a hacker stole credentials, your system will remain vulnerable until you change those credentials, even if you've removed the hacker's tools."
3. Turn on two-step login, also called multi-factor authentication (MFA), for your hosting account, website admin and business email so a stolen password alone isn't enough.
4. Delete admin users you don't recognize, and remove plugins, themes or files you didn't add. Keep notes on what you found.
5. Restore a clean backup or clean up the site. A backup from before the hack is often the fastest route. Update everything right after, because the old weakness will still be there.
6. Scan again. Ask your host to re-scan, run your security plugin's scanner, and re-run an outside-in check to confirm warnings and blocklist listings clear.
7. If Google flagged your site, request a review using the steps in the next section.

Don't delete your whole site in frustration. It removes the evidence of how the attacker got in, and the FTC advises businesses: "Do not destroy evidence."

How do I get Google warnings removed?

Google removes its warnings after it confirms the problem is fixed. You start that process yourself in Search Console.

1. Open the Security issues report in Google Search Console.
2. Make sure every issue listed is fixed on every page, not just the example pages.
3. Select Request Review and describe what you fixed and how you prevented it from happening again.
4. Wait for Google's email. Google says a review "can take from a few days to a few weeks to complete." Don't resubmit while one is pending.

Other blocklists have their own removal forms. Once your site is clean, look up each list that flagged you and submit a review request.

Do I need to tell my customers about a hack?

It depends on what was affected. If the hack only added spam pages, you may not need to notify anyone, though it's kind to let regular customers know that warnings are being fixed.

If customer information may have been exposed, such as names, emails, payment details or form submissions, the rules change. The FTC notes that every state has laws "requiring notification of security breaches involving personal information." Its Data Breach Response guide walks through who to contact and when.

If you think personal information was involved, talk to a lawyer or your cyber insurance provider before sending notices. Write down what you know, including dates and what you found, so you're ready for that conversation.

How do I stop my website getting hacked again?

Most repeat hacks happen because the original weakness was never fixed. Once you're cleaned up, close the doors.

If your site runs on WordPress, our WordPress security checklist goes through each of these in detail. The FTC's small business cybersecurity guidance covers the same habits across your whole business.

What should you do next?

1. Run a free website security scan to check blocklists, HTTPS, your certificate and exposed software versions.
2. Do a site:yourbusiness.com search and check Google Search Console's Security issues report.
3. If spam seems to come from your domain but your site looks fine, read how to stop email spoofing.
4. Work through the WordPress security checklist or the broader small business cybersecurity checklist to prevent a repeat.