How to Tell If Your Website Has Been Hacked

The mental image of a hacked website — skull graphics, ransom notes, a defaced homepage — is mostly obsolete. Modern compromises are businesses, and businesses don't vandalize their assets. An attacker who controls your site earns more by keeping it looking normal: quietly hosting phishing pages in a subdirectory, injecting pharmaceutical spam links only search engines see, or skimming payment details from your checkout. The most dangerous hacks are the ones designed to be invisible to exactly one person: you.

This post covers the signals — from blunt to subtle — how to confirm what you're seeing, and what the first hour of response should look like. The goal is a calibrated owner: neither oblivious nor jumping at shadows.

Why attackers hide instead of deface

Understanding the attacker's economics tells you what to look for. A compromised small-business site is valuable as:

SEO parasite real estate — your domain's reputation gets borrowed to rank spam pages for gambling, pharma, or counterfeit goods.
Phishing hosting — a fake bank login page at yoursite.com/wp-content/uploads/secure/ rides on your clean reputation until blocklists catch up.
Malware distribution — drive-by downloads served to your visitors, often only to specific browsers or regions to dodge detection.
Spam relay — your server sends ten thousand emails a night, and your legitimate email starts landing in spam folders as your IP reputation burns.
A stepping stone — a foothold for attacking other sites on the same server, or your own customers.

Every one of these earns more the longer it stays hidden. So the absence of visible damage means nothing. You need better detectors than your own eyes on your own homepage.

The obvious signs (rare, but unambiguous)

Start with the blunt ones, for completeness:

Your homepage is defaced or replaced.
Your browser shows a red interstitial — "Deceptive site ahead" or "This site may harm your computer" — meaning Google Safe Browsing has already flagged you.
Visitors get redirected to casino, adult, or fake-antivirus sites (sometimes only on mobile, or only from search results — try both).
Ransom demands, or your host suspends the account citing malicious activity.
You're locked out of your own admin account and password reset emails never arrive.

If any of these is happening, skip to the response section. You're not wondering anymore.

The subtle signs (common, and the ones that matter)

Search results that aren't yours

The single highest-yield check for a small-site owner costs thirty seconds: search Google for site:yourdomain.com and read the results. You know what pages your site should have. If you see Japanese product listings, essay-writing services, luxury handbags, or pharmaceutical keywords under your domain, you're hosting SEO spam — the most common visible symptom of compromise in the wild. This works because much injected content is cloaked: shown to search engine crawlers but hidden from normal visitors, which is precisely why browsing your own site reveals nothing.

Traffic and behavior anomalies

A sudden traffic spike to pages you never created, or from countries irrelevant to your business.
A sudden traffic drop — search engines may have flagged or demoted you.
Your site is suddenly, persistently slow: crypto-mining scripts, spam-sending, and bot traffic all consume resources.
Bounced email complaints, or your newsletters landing in spam: check whether your domain or server IP has landed on blocklists.

Anomalies inside WordPress

Administrator accounts you didn't create. The classic persistence mechanism. Check Users → Administrators and treat any unknown name as a confirmed incident.
Plugins or themes you didn't install, or a plugin with a slightly-off name ("wp-security-tools") sitting in the list.
Files changing when nobody changed them. Security plugins can compare core files against known-good checksums; unexplained modifications to core files are close to definitive.
Settings that revert or change themselves — the site URL, the default role for new users, unfamiliar code in the theme's header/footer boxes.
Scheduled posts or pages appearing in the sitemap that you never wrote.

Signals from third parties

Sometimes the internet tells you before your own tooling does: a customer emails about a weird redirect, your host sends an abuse notice, a security researcher contacts you, or Google Search Console (if you've connected it — do this today if you haven't, it's free) sends a "Security issues detected" message. Take every one of these seriously on first receipt. The polite stranger reporting a phishing page on your domain is doing you a favor with a short shelf life.

Confirming it: from suspicion to evidence

A suspicion needs verification before you burn an afternoon on incident response. Work through these, cheapest first:

Remote scanners. Free web-based scanners (Sucuri SiteCheck and similar, plus Google's Safe Browsing status page) fetch your site as an outsider and check for known malware signatures, spam injection, and blocklist status. Five minutes, no installation. A clean result does not prove you're clean — remote scanners only see what's served to them — but a dirty result is confirmation.
Search engine's-eye view. The site: search above, plus Search Console's Security Issues and Coverage reports. Cloaked spam shows up here and nowhere else.
Server-side malware scan. A security plugin (Wordfence and peers) or your host's built-in scanner reads the actual files and database — this catches backdoors remote scanners can't see. Look especially at reports of modified core files, PHP files inside wp-content/uploads (uploads should contain media, not code), and files with recent modification dates you can't account for.
Access log review, if you're comfortable. Repeated POST requests to xmlrpc.php or wp-login.php, requests to PHP files with random names, or spikes from one IP tell the story of how they got in — useful later, skippable now.

Calibration note: not every anomaly is a hack. A traffic spike might be a post doing well. Slowness might be a bloated plugin. One weird referrer is noise. The pattern to escalate on is two or more independent signals — say, a scanner hit plus an unknown admin account — or any single definitive one (defacement, Safe Browsing flag, unknown administrator).

The first hour: a calm response plan

Confirmed compromise triggers a sequence. The order matters; the mood should be methodical, not panicked. Nothing here requires deep technical skill except the cleanup itself — which, notably, you should probably not do alone.

Don't delete anything yet. Your instinct will be to remove the weird files immediately. Resist it for one hour: you may destroy the evidence that shows how they got in, which is the only thing standing between you and re-infection next month.
Change every password from a clean device — WordPress admins, hosting control panel, SFTP, database, and the email account that receives password resets. Assume the attacker has whatever passwords the site knew. Enable two-factor authentication while you're in there.
Take a backup of the compromised state. Counterintuitive but standard practice: snapshot the infected site (files + database) as evidence and as a safety net, clearly labeled so nobody restores it by accident.
Reduce harm to visitors. If the site is actively serving malware or phishing, put it into maintenance mode or ask your host to temporarily suspend public access. Ten minutes of downtime beats another day of infecting customers.
Identify your last known-clean backup. Check file modification dates and the timeline of symptoms to estimate the compromise date; a backup from before that date is your cleanest path back. This is the moment your backup retention policy either saves you or doesn't — a 7-day retention window is useless against a hack discovered on day 30.
Get help for the cleanup. Restoring a clean backup, updating everything, removing unknown admins, and rotating secrets is a fine DIY path if the entry point was a known plugin vulnerability that's since been patched. If you can't identify how they got in, hire a professional or use your host's malware removal — a cleanup that misses one backdoor file is a countdown timer. Reinfection within days is the signature of an incomplete cleanup.
After cleanup: request review. If Google flagged the site, use Search Console to request a review once you're verifiably clean; blocklist delisting typically follows within days.

Making the next one visible sooner

Detection latency is the real variable you control. The difference between finding a hack in day one versus month three is mostly whether anything was watching. The short list, in value order:

Connect Google Search Console. Free, and it emails you about security issues and strange indexing. This is the single best detector-per-minute-of-setup available to a non-technical owner.
Run file integrity monitoring via a security plugin or your host — unexplained core file changes become an email instead of a mystery.
Keep backups with real retention — at least 30 days, stored off the server, restore-tested quarterly.
Do the monthly pulse: the site: search, a glance at the user list, a scanner run. Three minutes, once a month, as part of your maintenance routine.
Shrink the attack surface so there's less to detect: prompt updates (most compromises exploit long-patched vulnerabilities), fewer plugins, no abandoned ones, 2FA on every admin, and a host that takes patching off your plate entirely.

Conclusion

A hacked site rarely announces itself, because silence is the attacker's business model. Your defense is a handful of cheap habits: know what your site should look like in search results, know who should be in the admin list, let a scanner and Search Console watch while you sleep, and keep backups old enough to predate trouble. And when the signals do line up — verify, secure the accounts, preserve the evidence, restore clean, and close the actual entry hole. Panic is optional; the checklist isn't.

Photo: Meet Patel on Pexels