Website Hacked? Signs, Spam Links and What to Do First

Finding out your website was hacked is stressful, and it happens to careful owners too. Most small-business sites are not targeted personally. Automated tools scan the internet for old software and weak passwords, and break in wherever they find one. The steps below help you stay calm and fix things in the right order.

Signs your website was hacked

• Google results for your site show strange titles, foreign characters or pages you never made, often selling pills, replica goods or other junk.
• Google shows "This site may be hacked" under your listing, or browsers show a red "Dangerous site" warning.
• Visitors say they ended up on a different website, especially from a phone or after clicking a Google result.
• Hidden links appear in your footer or page source.
• Your host suspends the account, or your email starts bouncing because the server sent spam.
• You find admin users, files or plugins you did not add.

Many hacks use tricks to hide from the owner. They may show spam only to Google's crawler, or redirect only first-time visitors from search results. Not seeing a problem yourself does not prove the site is clean.

How to check

1. Search Google for your domain: type site:yourdomain.com. Look for pages and titles you do not recognise.
2. Open Google Search Console and check Security issues and Manual actions. Use URL Inspection on your homepage to see the page as Google sees it.
3. Check Google Safe Browsing: the Transparency Report's site status page tells you whether Google flags your site as unsafe.
4. Test like a visitor: on a phone using mobile data, search for your business name and click the result.

What to do first, in this order

1. Don't delete everything. Take a full backup of the hacked site (files and database) and keep it separate. It helps find how the attacker got in.
2. Contact your host. Ask whether they see malware, which files changed, and whether they can share access logs. Many hosts offer scanning and can help.
3. Change every password: hosting account, control panel, FTP or SFTP, database, every website admin account and the email accounts linked to them. Turn on two-factor login wherever possible, and remove any users you do not recognise.
4. Clean or restore. If you have a clean backup from before the hack, restoring it is often fastest. Otherwise, replace the core software files with fresh copies and remove unknown files, especially script files inside upload folders. Check .htaccess and similar server files for odd redirects, and search the database for injected links.
5. Update everything. Bring the CMS, theme and every plugin up to date. Delete plugins and themes you do not use, and never use "free" copies of paid plugins, which often carry hidden code.
6. Find the way in. An outdated plugin, a reused password or an old forgotten copy of the site in a subfolder are common culprits. If you do not close the hole, the hack usually returns within days.
7. Ask Google to review. Once the site is clean, open the Security issues report in Search Console and request a review. Make sure the spam pages now return "not found" and resubmit your sitemap.
8. Keep watching. Check Search Console and your Google results weekly for a month. Re-infection is common when one back door was missed.

How to lower the risk next time

• Turn on automatic updates for security releases, and check plugins monthly.
• Use a password manager, unique passwords and two-factor login for every admin.
• Keep daily backups stored away from the server, and test a restore now and then.
• Give each person their own login with only the access they need.
• Watch for alerts: Search Console messages, uptime checks and host warnings.

When to call a professional

Call for help if the site handles payments or personal data, if the hack returns after cleaning, or if you cannot tell which files are yours. A professional clean-up is usually quicker than a second or third attempt.