How to recognise that your website has been hacked

Signals visitors see

The clearest are changes your customers notice directly. They must be taken seriously, because they cost trust and revenue immediately.

• The browser shows a red warning page before opening the site.
• Visitors end up on spam, gambling or phishing sites, often only from their phones.
• Third-party ads, pop-ups or banners appear on your pages.
• The contact form sends messages you never wrote.

Signals in Google

Search engines often see more than you do, because some malicious code only shows its content to the Google crawler.

• Japanese or Chinese characters appear under your company name in the search results.
• Google displays the notice that the site may have been hacked.
• The number of indexed pages suddenly rises sharply.
• An entry appears under “Security issues” in Search Console.

Signals in the background

Some signs are only visible to you or your host. They often appear before a hack becomes publicly visible.

• There are administrators in the backend whom nobody on your team created.
• The host reports malware or suspicious mail sending, or suspends the package.
• Your outgoing emails suddenly land in the recipient's spam folder.
• The site becomes significantly slower for no apparent reason, or the server load rises.

How to check yourself

• Open the site in a private browser window and additionally from a phone via the mobile network.
• Check the domain name in Google Safe Browsing's Transparency Report.
• Go through the list of user accounts in the backend for unknown entries.
• Look for recently changed files in the hosting file manager.
• Check whether your installed version is affected by known vulnerabilities.