The clearest signs of a hacked website are a Google or browser warning, pages or redirects you didn't create, unknown admin accounts and a host suspension notice. To confirm it, check the Security Issues report in Google Search Console. Then search Google for site:yourdomain.com to spot pages you never published, and compare your server files against a clean copy.
Knowing how to tell if your website has been hacked matters because many hacks are built to stay hidden from the owner. Spam pages show only to Google, card skimmers load only on checkout, and redirects fire only for visitors arriving from search. This guide is general information, not legal advice; if customer data may be involved, talk to an attorney about your notification duties.
On this page
- 10 signs of a hacked website
- Why you may not see the hack yourself
- How to check if your website has been hacked in 15 minutes
- Where hacks hide on WordPress, Shopify and custom PHP sites
- What Google does when it finds a hacked site
- How websites get hacked
- What to do in the first 24 hours after a hack
- How to clean a hacked site and get Google to trust it again
- When a website hack becomes a data breach
- Online stores: checkout skimming and PCI DSS 4.0
- Worked example: a hacked site at a 12-person HVAC company
- How to stop it happening again
10 signs of a hacked website
Sign | What it looks like | Where to check |
|---|---|---|
Search label or browser warning | Chrome shows a red "Deceptive site ahead" page, or Google flags the site as hacked | Search Console, Security Issues report |
Pages you never wrote | Thousands of spam pages in Japanese, pharma or casino keywords | A site:yourdomain.com search in Google |
Redirects | Visitors from Google or mobile land on another domain | Open your site from a phone on cellular data |
New admin users | Accounts you did not create, usually with admin rights | CMS user list and hosting control panel |
New Search Console owners | Someone you do not know has verified the property | Search Console, Settings, Users and permissions |
Changed files | Recently modified PHP files, new files in upload folders, an edited .htaccess | Hosting file manager, sorted by date |
Host suspension or warning | An email about malware, high CPU or outbound spam | Hosting account notices |
Traffic drop or odd spike | Organic traffic falls while unknown URLs gain impressions | Search Console Performance report |
Outbound spam | Bounces for mail you never sent, or a blocklisted server IP | Mail logs and blocklist checks |
Customer reports | Card fraud after checkout, pop-ups, or a fake login form | Support tickets and the checkout page source |
One sign is enough to start checking. Two or more, such as new admin users plus spam pages in search, means the site is compromised until you prove otherwise.
Why you may not see the hack yourself
Attackers hide their work from the people most likely to remove it. Google's guide on how to tell if a site was hacked warns that a flagged URL may show you nothing. Hacked pages can show different content to different visitors. A spam page can return a 404 to you and a page of keywords to Googlebot.
Google's guidance on deceptive pages adds a practical step. Open the sample URLs from a computer outside your hosting network, since attackers may turn the attack off when they think the visitor is the site owner. A phone on cellular data, logged out of your site, works for a first look.
Skimmers follow the same logic. A malicious script on an online store may load only on the payment step or only for first-time visitors. A quick look at the home page proves nothing.
How to check if your website has been hacked in 15 minutes
- Search Google for
site:yourdomain.comand scroll the results for pages, titles or languages you never published. - Open Google Search Console and read the Security Issues report and the Manual Actions report.
- In Search Console, open Settings, then Users and permissions, and remove any owner you don't recognize.
- Run the URL Inspection tool on a suspicious URL to see the version Google sees.
- List every admin user in your CMS and hosting panel, and note any account created recently.
- Sort the files in your hosting file manager by modified date and look for recent changes to core files, .htaccess and the uploads folder.
- Load the site, including checkout, over a mobile connection and from a search result click.
- Ask your host whether its malware scanner or mail logs show anything for your account.
If every check comes back clean, keep monitoring for a week. If any check fails, move straight to the first 24 hours plan below.
Where hacks hide on WordPress, Shopify and custom PHP sites
The platform decides where to look first. A hosted platform patches its own servers, so the risk moves to accounts and add-ons. A self-hosted CMS or custom PHP site puts the server, the code and every extension in your hands.
Platform | Common entry points | Where to look first |
|---|---|---|
WordPress and WooCommerce | Outdated plugins and themes, reused admin passwords, nulled premium plugins | Plugin list and versions, admin users, wp-content/uploads, .htaccess, wp_options table |
Shopify and other hosted stores | Staff accounts without two-factor authentication, third-party apps, hand-edited theme code | Staff accounts and permissions, installed apps, recent theme code edits, checkout scripts |
Custom PHP or Laravel | SQL injection, file upload forms, end-of-life PHP versions, exposed .env or backup files | Server and access logs, upload folders, database users, PHP version |
Any platform | Phishing of the owner, a compromised hosting or domain registrar account | Registrar and DNS settings, hosting users, email forwarding rules |
Check the domain registrar too. An attacker with access to DNS can point the whole domain, including email, at a server they control, and no file scan on your host will show it.
What Google does when it finds a hacked site
Google flags compromised sites in two places. Chrome and other browsers that use Google Safe Browsing show full-page warnings such as "Deceptive site ahead" before a visitor reaches the page. Google Search can label results as possibly hacked and lists the affected URLs in the Search Console Security Issues report.
The warning stays until you clean the site and ask for a review. Google's request a review guide gives the timelines:
Problem Google found | Typical review time |
|---|---|
Site hacked with spam | Up to several weeks |
Malware infection | A few days |
Phishing | About a day |
Before you request a review, Google expects four things. Verify ownership in Search Console, remove the hacker's changes, fix the hole that let them in and bring the cleaned site back online. Asking early wastes days, because a failed review starts the wait again.
How websites get hacked
Google's list of the top ways sites get hacked names six causes. They are compromised passwords, missed security updates, insecure themes and plugins, social engineering such as phishing, weak security policies and data leaks from misconfigured files. The first three are the ones a small business can prevent with routine maintenance.
Missed updates are the hardest to see. With the PHP2Shell vulnerability, Amazon saw exploit attempts four days before PHP shipped the patches on October 21, 2026, so even same-day patching came after attackers started probing. A site that waits a month for its next maintenance window gives them 30 more days.
Custom code adds its own risks. Forms and search boxes that build database queries from user input are the classic entry point described in the guide to SQL injection in PHP. A server on an end-of-life PHP version gets no security fixes at all until you update the PHP version.
What to do in the first 24 hours after a hack
- Do not delete anything yet. Copy the hacked site files, the database and the server logs to a safe place. You need them to find the entry point and to answer any insurance or legal question.
- Take the site offline in a way that does not depend on the hacked server, such as a maintenance page served by your host or CDN.
- Delete unknown admin accounts, then change every password: hosting, SFTP or FTP, database, CMS users, Search Console and the email accounts tied to them. Turn on two-factor authentication where offered.
- Tell your host. Many hosts can show which file changed first and which IP address made the change.
- Find the entry point before you clean. Check the logs around the earliest changed file for logins, uploads or requests to a vulnerable plugin.
- Decide whether customer data was exposed. Payment pages, contact form entries and customer accounts decide whether breach notification laws apply.
- Write down when and how the problem was discovered, and by whom. Breach notice deadlines in states such as California and Florida count from discovery, so this note fixes the start date.
How to clean a hacked site and get Google to trust it again
Restoring a clean backup is the fastest path, but only if the backup predates the hack and you patch the hole before it goes live. A backup taken after the attacker planted a backdoor brings the backdoor back.
When no clean backup exists, clean in this order:
- Reinstall the CMS core, themes and plugins from official sources instead of editing infected copies.
- Remove plugins and themes you no longer use.
- Replace .htaccess with a default version and check for rules that redirect search or mobile visitors.
- Search the database for injected scripts, spam posts and unknown users.
- Check scheduled tasks, sitemaps and the uploads folder for files that should not be there.
- Update PHP, the CMS and every extension, then scan again.
Once the site is clean and patched, bring it back online, confirm the pages with URL Inspection and request the review in Search Console. Remove spam URLs with 404 or 410 responses so they drop out of the index.
When a website hack becomes a data breach
A defaced brochure site with no stored customer data is a cleanup job. A hack that exposed names with payment card, Social Security or account login details can be a data breach under state law. The FTC's data breach response guide for business notes that all states, the District of Columbia, Puerto Rico and the Virgin Islands have breach notification laws.
The deadline follows where your affected customers live, not where your business is. Several states now set fixed outer limits:
State | Notice to affected residents | Notice to the state |
|---|---|---|
California (Civil Code 1798.82, as amended by SB 446) | Within 30 calendar days of discovery, effective January 1, 2026 | Sample notice to the Attorney General within 15 days of resident notice if more than 500 residents |
Within 30 days after discovery | Attorney General, Department of State and State Police | |
No later than 30 days, with 15 more days for good cause | Department of Legal Affairs within 30 days if 500 or more individuals | |
No more than 30 calendar days after discovery | Attorney General within 30 days if more than 500 residents | |
Required; check section 521.053 for timing | Attorney General within 30 days of discovery if 250 or more Texans |
Counting starts at discovery, so the first-day evidence copy matters twice: it shows when you found the breach and which records were reachable.
Online stores: checkout skimming and PCI DSS 4.0
Card skimmers are hacks built for stores. A few lines of JavaScript on the payment page copy card numbers as customers type them, and the store keeps working normally. PCI DSS v4 now targets this attack directly, according to RSM's summary of the payment page script rules.
- Requirement 6.4.3 asks merchants to confirm each payment page script is authorized, ensure its integrity and keep an inventory with a justification for each one.
- Requirement 11.6.1 asks for a change and tamper detection mechanism that alerts on unauthorized changes to a payment page. It must run once every seven days, or at a frequency set by a targeted risk analysis.
- Both became mandatory on March 31, 2025, after a period as best practice.
For a store owner, the practical sign of a skimmer is a pattern of customers reporting card fraud after buying from you. Treat two such reports in a month as a reason to inspect every script on checkout.
Worked example: a hacked site at a 12-person HVAC company
Say a 12-person HVAC company in Arizona runs a 60-page WordPress site. Organic leads fall from 40 a month to 15. A site: search shows 3,400 indexed pages in Japanese, and Search Console lists an owner nobody on staff added.
The response takes three days. Day one: the developer copies files, database and logs, puts the site behind a maintenance page and removes the unknown owner and two admin accounts. Day two: logs show the entry point was a slider plugin last updated 26 months earlier. The plugin goes, and WordPress core, the theme and PHP are reinstalled and updated. Day three: the spam pages return 410, the site goes live and the review request goes in.
Because the hack was spam, Google's review can take several weeks, and leads recover only as the 3,400 spam URLs drop from the index. The site held no customer card data, so no breach notice was needed, but the contact form database was checked before anyone made that call.
How to stop it happening again
- Patch on a schedule measured in days. Apply CMS, plugin and PHP security releases within 72 hours.
- Remove every plugin and theme you don't use.
- Turn on two-factor authentication for hosting, CMS admins and Search Console, and give admin rights only to people who need them.
- Keep daily off-server backups for at least 30 days, so a clean copy exists from before any hack you find late.
- Monitor files and uptime, and get alerts for new admin users and changed core files.
- Protect your domain's email as well. A hacked server can send spam that damages your sending reputation, which is one more reason to learn what DMARC is and how to set it up.
A maintenance plan covers most of this list, and the guide to website maintenance cost shows what that work runs per year.
Start now with the 15-minute check above, beginning with the site: search and the Search Console Security Issues report. The website development team at Techno Mantra cleans hacked WordPress, WooCommerce and custom PHP sites and finds the entry point. The team patches PHP and plugins and handles the Google review request. Send your URL and what you have seen through the contact page or to info@technomantraa.com. Every inquiry gets a reply within one business day.
Frequently asked questions
Yes, and many are. Attackers show spam only to Google, redirect only visitors who arrive from search, or load card skimmers only on checkout. Google warns that a flagged page may look normal or even return a 404 to the owner, so check from outside your network and in Search Console.
Yes. Spam pages compete with your real pages, browsers may show a full-page warning, and Google can label results as possibly hacked. After cleanup, a review for a spam hack can take up to several weeks, and rankings recover as the spam URLs drop out of the index.
Restore a backup only if it was taken before the hack and you patch the entry point before going live. A backup made after the attacker planted a backdoor reinstalls the backdoor. Without a clean backup, reinstall the CMS, themes and plugins from official sources and clean the database.
It depends on what was exposed and where customers live. If personal information such as card numbers, Social Security numbers or account logins was acquired, state breach laws apply, and states such as California, New York, Florida and Washington set 30-day outer limits. Talk to an attorney.
Sometimes. Some hosts include malware scanning or cleanup in their plans, while others suspend the account until the owner cleans it. Check your plan terms, and ask the host for file change and access logs either way, because those logs show how the attacker got in.