Most website owners do not discover a hack until the damage is done. Attackers work quietly, using your site to send spam, steal data, or attack visitors. Knowing the warning signs of a hacked website lets you act before it costs you traffic, reputation, and customers.

1. Google warns visitors or drops your rankings

A red “This site may be hacked” warning in search results, or a sudden ranking drop, is a classic sign of malware or a blacklist.

2. Strange redirects or pop-ups

If your site suddenly redirects visitors to spammy pages or shows pop-ups you did not add, malicious code has almost certainly been injected.

3. Unknown files, users, or admin accounts

New admin accounts you did not create, or unfamiliar files on the server, are strong evidence of a backdoor left by an attacker.

4. Your host suspends the site or flags spam

Hosts often detect outbound spam or malicious activity before you do, and will warn or suspend a compromised account.

5. Slow performance and unexplained traffic spikes

Malware and unauthorized scripts consume resources, causing slowdowns and odd spikes in server load or bandwidth.

What to do next

Speed matters. The longer malware sits, the more it spreads and the harder Google is to recover from. Our Emergency Malware Removal & Security Hardening service cleans the infection, closes the entry point, removes backdoors, and hardens the site so it cannot be reinfected the same way.

How to confirm a compromised website

Warning signs tell you something is wrong; these website security checks confirm it:

  • Google Search Console: the Security Issues report lists detected malware, phishing or hacked content, with sample URLs.
  • Google Safe Browsing site status: the Transparency Report shows whether Google currently flags your domain as unsafe.
  • A site: search: searching site:yourdomain.com can reveal spam pages about pills, replicas or casinos you never created.
  • The server: recently modified files, unfamiliar PHP files in upload folders, new scheduled tasks, altered .htaccess rules and scripts injected into database content.
  • Online stores: unknown scripts on the checkout page. Card skimmers often hide there, which is why PCI DSS 4.0 requirements 6.4.3 and 11.6.1, mandatory since March 31, 2025, call for an inventory of payment page scripts and monitoring for unauthorized changes.

Hacked website repair: the right order

  1. Copy files, database and logs before changing anything; they are your evidence.
  2. Change every password and key: hosting, admin users, database, SFTP and API tokens.
  3. Find the entry point in the logs, such as an outdated plugin or a stolen login, or the site will be reinfected.
  4. Replace files with known-good copies, remove backdoors and rogue admin accounts, and update everything.
  5. Apply security hardening: two-factor authentication, strict file permissions, a web application firewall and file change monitoring.

Getting off the Google blacklist

Once the site is clean, request a review in the Security Issues report and describe what was fixed. According to Google's documentation, malware reviews take a few days, phishing reviews about a day, and reviews for a website hacked with spam can take several weeks.

Frequently asked questions: website hacked

Can I just restore a backup after a hack?

A backup helps, but on its own it leaves the entry point open, and it may already contain the backdoor. Restore from before the infection, then patch and harden.

How do small business websites get hacked?

The usual routes are outdated plugins, themes or extensions, reused or stolen passwords and forgotten admin accounts. Automated scanners find these weaknesses without anyone targeting you personally.

Will a hack hurt my search rankings?

It can. Warnings in results reduce clicks, and injected spam pages may be indexed under your domain. Quick cleanup and a review request limit the damage.

Need help with this? Our malware removal and security hardening service handles the cleanup and review request, website maintenance care plans keep software patched afterwards, and a technical SEO audit clears leftover spam URLs from search. Request a quote.