How to Tell If Your Website Has Been Hacked: 9 Signs

Here's the uncomfortable truth about hacked websites: most are built to hide. An attacker who injects spam or malware wants to keep quietly using your site, so the damage often isn't visible on your homepage. That's why you look for specific signs rather than waiting for something obvious to break. Below are nine of them, from the unmistakable to the easy-to-miss.

The signs you can't argue with

Some signs are effectively confirmation on their own. If Google shows "This site may be hacked" beside your listing, if a browser throws up a red "Deceptive site ahead" screen, or if your host suspends your account for malware, you're not guessing anymore. These come from systems that actively scan for compromise, and they don't flag sites lightly.

If you're seeing the Google search label specifically, our walkthrough on removing the "this site may be hacked" warning covers the cleanup and review process in detail.

Signs you'll notice as a visitor

Open your own site in a private browsing window, not just your logged-in admin view, because some hacks only trigger for logged-out visitors or people arriving from Google. Watch for a redirect that sends you somewhere you don't recognize, often a pharmacy, gambling, or scam page. That's one of the most common payloads.

Then search Google for your domain with a site search to see every page Google has indexed. If pages appear that you never created, frequently in another language and stuffed with spammy links, someone is publishing content through your site.

Signs hiding in your own accounts

Log into your CMS and check the user list. An unfamiliar administrator account is a serious red flag, because it means someone gave themselves a way back in. While you're there, note whether core files, your theme, or plugins were modified recently without you touching them.

Bounce-back emails for messages you never sent point to a mailer script, which is its own headache. We break that down in why a website sends spam emails. And a sudden, unexplained traffic collapse can mean Google detected the compromise and started removing your pages.

How to confirm it for sure

If a couple of these signs line up, confirm before you spend hours digging. A malware scan checks your site against known threats, and a blacklist check tells you whether Google, your host, or the major security services have already flagged your domain. Together they turn a hunch into a clear yes or no.

What to do once you've confirmed it

Cleanup follows a consistent path: get the site into a safe state, find and remove every piece of injected code and any backdoors, patch the vulnerability that let the attacker in, change all passwords, and then request removal from any blacklists or Google warnings. Missing a single backdoor is how a "cleaned" site gets reinfected within days, so thoroughness beats speed on the removal itself.

Would you rather not find out the hard way?

When a client suspects a hack, we confirm it, clean it completely, close the entry point, and handle the delisting so their rankings and email recover. More to the point, our maintenance plans, starting at $99 a month, keep software patched and scan continuously, which is how most of these compromises get prevented in the first place instead of cleaned up after.

We're a Seattle-area studio in Mill Creek, Washington, working with businesses across the Puget Sound and remotely nationwide. If you think your site's been hacked, call us at (425) 314-1415 and we'll help you find out and fix it.