8 Signs Your Website Has Been Hacked (and What to Do Next)

Most website owners discover a hack weeks after it happens — usually when a customer complains or Google flags the site. The longer malware sits on your server, the more damage it does to your rankings, reputation and customer data.

Here are the warning signs to watch for, and what to do the moment you spot one.

8 signs your website has been hacked

1. Unexpected redirects — visitors (often only mobile users or visitors from Google) are sent to spam, gambling or pharmacy sites.
2. Google warnings — “This site may be hacked” in search results or a red “Deceptive site ahead” screen in Chrome.
3. Spam pages in search — search site:yourdomain.com and you see pages in Japanese or about products you don’t sell.
4. New admin users you didn’t create.
5. Sudden slowdowns or high server CPU caused by crypto-mining or spam scripts.
6. Hosting suspension or emails from your host about malicious activity.
7. Modified files — unfamiliar PHP files in uploads folders or obfuscated code in theme files.
8. Email problems — your domain is blacklisted because the server is sending spam.

What to do immediately

1. Don’t panic, and don’t delete everything. You may destroy evidence needed to find the entry point.
2. Take a full backup of the current (infected) state for analysis.
3. Change all passwords — hosting, FTP/SFTP, database, CMS admins and email.
4. Put the site in maintenance mode if it is harming visitors.
5. Contact your host — they may have logs showing how the attacker got in.

How a proper cleanup works

• Scan files and database for malware, backdoors and injected code.
• Replace core files, themes and plugins with clean copies.
• Remove unauthorised users and scheduled tasks.
• Identify and patch the vulnerability that allowed the attack — usually an outdated plugin, weak password or vulnerable theme.
• Request a Google review to remove warnings, and delist from spam blacklists.

Cleaning without finding the entry point is why many sites get reinfected within days.

Prevent the next attack

• Keep core, themes and plugins updated.
• Use two-factor authentication and strong passwords.
• Install a web application firewall.
• Run daily off-site backups.
• Remove unused plugins, themes and old staging sites.

Hacked right now?

Webyant’s website security and malware removal team cleans hacked WordPress, WooCommerce and custom PHP sites, removes Google warnings and hardens your site against repeat attacks. Contact us for urgent help.