Tell If Your Website Has Been Hacked

Before You Start

This guide shows you how to tell if your website has been hacked by checking the signs that visitors, search engines and your hosting account can reveal. It is for site owners and administrators who notice something unusual, such as a strange redirect or a warning from a search engine. You need access to the live site, a search for your own domain and, if possible, the admin area and file access on your hosting account.

Check What Visitors and Search Engines See

1. Visit the site from different devices. Open the homepage and several inner pages on a phone and a computer, and try arriving from a search result. Redirects that appear only on some devices are a common sign of compromise.
2. Search for your own domain. Search for your site name and for the site: operator. Pages about unrelated products or topics often indicate an SEO spam hack.
3. Check Search Console. Look for security issues or manual actions reported for your site. A notice from a search engine is a serious signal and should be investigated promptly.
4. View the page source. Look for hidden text, unfamiliar links or scripts you did not write. Some malicious code shows only to search engines or to certain visitors, so check more than one view.

Check the Admin Area, Files and Server

1. Review administrator accounts. List every user with administrator rights and remove any you do not recognise. Look for changed passwords or email addresses you did not set.
2. Look for new or modified files. Compare recent file changes with what you expect, paying attention to script files in upload folders where no scripts belong.
3. Check scheduled tasks. Unfamiliar scheduled tasks can recreate removed files, so review them in your control panel or site software.
4. Watch resource use and outgoing mail. Sudden spikes in processor or traffic use, and emails sent from your account that you did not write, can both indicate an infection.

What to Do With the Results

A single symptom is not proof of a compromise, but several symptoms together, or one with no innocent explanation, deserve a careful check. Write down what you found, when you found it and what you changed, so you can share the details with your host.

• Assuming a normal-looking homepage means the site is clean, when the admin area or files may still show changes.
• Ignoring a host notice about suspicious activity or a temporary suspension.
• Making changes before saving evidence, which makes the investigation harder.

Contact your host promptly if you find unknown accounts, injected files or a notice from a search engine. If you confirm an infection, follow a full removal process rather than deleting only what you noticed. Its effect on search visibility is explained in how a hacked website affects SEO.

Can a hacked website still look normal?

Yes. Many compromises are designed to stay invisible to owners, and malicious code may show content only to search engines or to certain visitors. A normal-looking front page does not rule out a compromise, so check the admin area, file changes and search results too.

What does it mean when Google says my site may be hacked?

It means Google has detected signs of compromise, such as injected pages or redirects, that affect how the site appears to users. Treat the notice as a serious signal and investigate it promptly. Check the affected URLs and the admin area first, then clean the site before asking for a review.

Who should I contact if I think my site is hacked?

Start with your hosting provider, which can check server logs, isolate the account and advise on next steps. If you cannot confirm the cause, or the site keeps being compromised, ask a security specialist to investigate. Keep a written record of what you saw to help them.