How to Tell If Your Website Has Been Hacked (and What to Do Next)

Most hacked websites are not defaced with a dramatic message. Attackers usually stay quiet and use your site to send spam, host phishing pages or redirect your visitors. Here is how to spot it early.

8 warning signs

1. Visitors are redirected to gambling, pharmacy or other unrelated sites, often only on mobile or when coming from Google.
2. Google shows a warning ("This site may be hacked" or "Deceptive site ahead") or your search results show strange titles in another language.
3. Unknown admin users or plugins appear in your CMS.
4. Your site is suddenly slow, or your host warns about high resource use.
5. Files you did not change have new modification dates, especially index.php, .htaccess and files in uploads folders.
6. Your email is blocked or lands in spam, because your server was used to send spam.
7. Customers report fake emails or messages that mention your brand.
8. You cannot log in, or your password no longer works.

Confirm it

• Run our free Website Security Scanner and URL Vulnerability Scanner to check headers, cookies and exposed version information.
• Check Google Search Console under Security & Manual Actions.
• Compare your files with a clean backup or a fresh copy of your CMS.

What to do next

1. Don't panic and don't delete everything. Take a full backup of the current state first, as evidence.
2. Put the site in maintenance mode so visitors are not harmed.
3. Change every password: hosting, cPanel, FTP, database, CMS admin and email. Do it from a clean computer.
4. Remove the malware: restore a known-clean backup, update the CMS, themes and plugins, and delete anything you do not use.
5. Find the way in. Outdated plugins, weak passwords and leaked credentials are the usual causes. If you skip this, you will be hacked again.
6. Harden and monitor: enable multi-factor authentication, add security headers and set up uptime monitoring.
7. Request a review in Google Search Console if you were flagged.

Need help?

Cleaning a compromised site correctly takes experience. Contact Quepath and we will investigate, clean and harden it.