7 signs your website has been hacked, and what to do next

Most hacked small-business sites are not targeted personally. Bots scan thousands of sites for old plugins and weak passwords. If your website has been hacked, the sooner you act, the less damage to your customers and your Google rankings.

7 signs your website has been hacked

• Visitors are sent to other sites, often only on mobile or only from Google.
• Google shows pages you never made, often in another language.
• New admin users you did not create.
• Your host suspends the account or warns of high resource use.
• Browsers or Google show a “deceptive site” warning.
• Customers receive spam emails from your domain.
• Files or plugins change that you did not touch.

How to check

• Search Google for site:yourdomain.com and look for pages you did not create.
• Open Google Search Console and check the Security issues report.
• Visit your site from a phone on mobile data, not only from your office.
• List your WordPress users and remove any you do not recognise.

Your first hour

• Change every admin, hosting and database password.
• Take a copy of the site as it is, for investigation.
• Restore a backup from before the attack.
• Update WordPress, themes and plugins, and remove what you don’t use.
• Find the entry point, or it will happen again.

After the clean-up

Ask Google to review the site in Search Console once it is clean, so warnings are removed. Then put prevention in place: automatic backups stored off the server, two-step sign-in for admins, and tested updates every month.