Has My Website Been Hacked? 12 Warning Signs to Check Right Now

Your website has probably been hacked if Google or a browser shows a warning, visitors land on sites you don’t own, or Google lists pages you never wrote. Other signs are quieter: new admin users, a suspension notice from your host, or emails bouncing. Work through the 12 checks below. One tick is enough reason to act today.

How common is it for small business websites to be hacked?

More common than most owners think. Wordfence found just under 1 million infected WordPress sites in 2024, with roughly 325,000 to 350,000 infected on any given day (Wordfence 2024 report). Most of these attacks are automated. Bots look for any site with a known weakness, so being small doesn’t keep you off the list.

What are the warning signs that a website has been hacked?

Signs from Google, browsers and antivirus apps

1. A warning under your site in Google. “This site may be hacked” means someone added content without permission. “This site may harm your computer” points to malware or dangerous downloads (Google Search Console Help). Check: search for your business name and read the line under your link.
2. A red warning page in the browser. Messages such as “Deceptive site ahead” or “The site ahead contains malware” come from Google Safe Browsing (Google Search Central). Check: open your site in Chrome in a private window.
3. Customers say their antivirus blocked your site. WordPress.org lists this as a clear indicator of compromise (WordPress.org). Check: run a free website blacklist check on Google, Norton and McAfee.
4. A security alert in Google Search Console. Google emails verified owners when it finds hacked content. Check: open the Security Issues report, and your inbox, including spam.

Signs your visitors see

5. Visitors get sent to another site. Redirects to scam shops, fake prizes or adult sites are a classic hack. Google notes that they can hit mobile visitors only, so compare your site on a phone and a computer.
6. Spam pages show up in Google. Pages selling pills, replica goods or written in Japanese are a sign of injected spam. Sucuri found SEO spam on 42.22% of the infected sites it cleaned in 2023 (Sucuri). Check: search site:yourdomain.com.au and scroll through the results. If they’re in Japanese, read our guide to the Japanese keyword hack.
7. Pop-ups, ads or content you didn’t add. Strange banners, links in your footer or a changed home page all mean someone else has write access to your site.
8. Customers report problems after buying. Card fraud soon after checkout, or a payment page that looks different, needs urgent attention. Stop taking payments until the site is checked.

Signs behind the scenes

9. Admin users you don’t recognise. WordPress.org lists “creation of new users” as a sign of a hack. Check: in WordPress, go to Users and filter by Administrator.
10. You can’t log in. A password that suddenly stops working, or a changed admin email address, can mean your account has been taken over.
11. Your host has suspended the site or warned you. Hosts often detect malware or spam sending before owners do. Read any email from them carefully.
12. Your emails bounce or land in spam. WordPress.org warns that hacked sites are often used to send spam, which can get your server blocked for email.

Why does my site look fine to me when customers see something else?

Many hacks are built to hide from you. Google describes a common trick called cloaking: showing different content to the site owner, visitors and search engines. The owner might see a normal page or a “page not found” error, while people arriving from Google are redirected to spam (Google Search Central).

Hacks can also skip anyone logged in to WordPress, or only show up now and then. That’s why “it looks fine on my computer” isn’t proof of anything. Check from a private window, on mobile data, and by clicking through from a Google search.

What should I check first?

Here’s a 15-minute routine that needs no technical skills:

1. Search your business name and site:yourdomain.com.au in Google. Look for warnings and pages you didn’t create.
2. Enter your address into Google’s Transparency Report Site Status tool.
3. Run a remote scan such as Sucuri SiteCheck, which WordPress.org lists as a useful scanner.
4. Log in to WordPress and check the list of administrators.
5. Open your site on your phone using mobile data, from a Google search result.

A clean result is reassuring but not final. Remote scanners can’t see inside your files or database, and backdoors are designed to stay hidden. If something still feels wrong, ask for a professional check.

What should I do if my website has been hacked?

Don’t delete files or restore an old backup in a hurry. That can destroy the clues needed to find how the attacker got in, and the hack often comes straight back. Note what you saw and when, then get help. Our step-by-step guide for when your website is hacked covers the full recovery.

If you’d like someone to take it from here, our hacked website repair service finds the cause, cleans the site and requests removal from any blocklists. Afterwards, secure web hosting and ongoing website maintenance plans make a repeat far less likely.

Frequently asked questions

Can a website be hacked without me noticing?

Yes, and it’s common. Many hacks hide from logged-in owners or only target visitors arriving from Google or on mobile. The site can look normal to you while customers see spam or are redirected. Google warnings, customer complaints and odd search results are often the first clues.

Is a free online scan enough to tell if my site is hacked?

It’s a good start, not a final answer. Remote scanners only see what your site shows to the outside world. They can’t see backdoor files, rogue database entries or hidden admin users. A clean scan plus other warning signs still calls for a proper check inside the site.

Why would anyone hack a small business website?

It’s rarely personal. Automated bots scan millions of sites for weak passwords and outdated plugins. A hacked site is useful for sending spam, hosting phishing pages, boosting other sites in Google or stealing card details. Small sites are attractive because they’re often less closely watched.

Should I take my website offline if I think it’s hacked?

If visitors are being redirected, warned or asked for payment details, yes. Ask your host or developer to put the site into maintenance mode rather than deleting anything. That protects customers while keeping the evidence needed to find how the attacker got in.

Will restoring a backup fix a hacked website?

Sometimes, but not on its own. If you restore without fixing the weakness, the attacker can come straight back. The backup might also already contain the infection. Find the cause first, then decide whether a restore or a clean-up is the better way forward.

Sources

1. 2024 Annual WordPress Security Report, Wordfence, April 2025
2. 2023 Hacked Website & Malware Threat Report, Sucuri, June 2024
3. Why is my site labeled as dangerous in Google Search?, Google Search Console Help, accessed 13 November 2026
4. #NoHacked 3.0: How do I know if my site is hacked?, Google Search Central Blog, December 2017
5. #NoHacked: Identifying and diagnosing injected gibberish URL hacking, Google Search Central Blog, August 2015
6. FAQ My site was hacked, WordPress.org, last updated 26 July 2026