How to tell if your website has been hacked

Most hacked websites do not look hacked to their owners. Attackers usually want the site to keep working, because a working site keeps sending them traffic, search rankings, or stolen data. The damage is often shown only to some visitors: people arriving from Google, people on phones, or search engine crawlers. This guide covers the signs you can check yourself and what to do if you find one.

Signs visitors and search engines notice

• Unexpected redirects. Visitors land on a gambling, pharmacy, dating, or fake prize page. A common trick is to redirect only people who arrive from a search engine or on a mobile device, so the owner typing the address directly never sees it.
• Spam in Google results. Searching site:yourdomain.com shows pages you never created, or titles and descriptions in another language or full of product keywords.
• Browser warnings. Chrome, Firefox or Safari show a full-page warning such as “Deceptive site ahead”. These come from Google Safe Browsing and similar lists.
• Hidden links. The page source contains blocks of links to unrelated sites, hidden with CSS so visitors do not see them but crawlers do.
• Scripts you did not add. New <script> tags loading from unfamiliar domains, or long scrambled (obfuscated) code at the top or bottom of pages. Card-skimming scripts on checkout pages and crypto-miners work this way.
• Strange frames or pop-ups. Invisible iframes, or pop-ups that are not part of your site.

Signs only the owner can see

• Admin or FTP accounts you do not recognise, or password reset emails you did not request.
• Files changed recently that nobody on your team touched, or new PHP or JavaScript files in upload folders.
• A Security Issues or Manual Actions message in Google Search Console.
• A warning from your hosting company, or a sudden jump in outgoing email, CPU, or bandwidth.
• Your domain’s email landing in spam folders because it was used to send spam.

How to check from the outside

1. Visit like a stranger. Open a private window on your phone, search for your business on Google, and click the result. Conditional redirects often only trigger this way.
2. Search your own domain. Try site:yourdomain.com together with words like casino, viagra, or loan, and look for pages you do not recognise.
3. Compare what Google sees. In Google Search Console, the URL Inspection tool shows the page as Googlebot fetched it. If it differs from what you see, read our guide on cloaking.
4. Read the page source. Look for scripts from domains you do not use and for links you did not add.
5. Use an outside checker. Gmork’s free hacked check loads your homepage as a visitor, as Googlebot, and as someone coming from Google, and looks for these signs automatically.

What an outside check cannot tell you

Any check that only looks at public pages, including Gmork’s, can find visible warning signs but cannot prove a site is clean. Some malware waits, targets only certain pages or countries, or lives in the server and database without changing any page yet. If you have reason to worry, have your host or a security professional scan the server files and database too.

If you find something

1. Stay calm and take notes: what you saw, where, and when. Screenshots help your host and any cleanup service.
2. Make a backup of the current site before changing anything, even though it is infected. It is evidence and a fallback.
3. Change the passwords for hosting, the CMS admin, FTP or SFTP, the database, and your domain registrar. Turn on two-factor sign-in where offered.
4. Remove accounts you do not recognise.
5. Restore from a clean backup if you have one from before the problem, or ask your host or a cleanup service to remove the malware.
6. Update the CMS, themes, and plugins, and remove ones you do not use. Outdated plugins are a common way in.
7. If Google flagged the site, fix it first and then request a review in Search Console. Warnings usually clear after the review succeeds.

Keep watching

Reinfection is common when the original way in was not closed. Watching the site from the outside after a cleanup tells you quickly if the redirect or spam comes back. That is what Gmork does for verified sites on a paid plan: it repeats the hacked check about every hour and alerts you when the result gets worse.