Is your website hacked? 8 warning signs and what to do in the first 24 hours
Strange redirects, pages you never published, a red Google warning… here are the most common signs of a compromised site and a practical plan to contain damage without destroying evidence.
Most site owners don't discover a compromise themselves; a customer, Google or the hosting company tells them. The faster you find it, the less damage to your reputation, rankings and customer data.
8 signs that need checking now
- Visitors redirected to other sites, especially on mobile or from Google results
- A 'This site may be hacked' warning or a red browser screen
- Pages or links you never published appearing in search
- New administrator accounts you don't recognize
- Changes on the checkout page or unexplained fake orders
- Sudden slowness or abnormal server usage
- Spam email sent from your domain
- Your hosting account suspended for malware
Hour one: contain without destroying evidence
Take a full copy of files, database and logs before any cleanup — it's your evidence of what happened. If the site is redirecting customers or skimming payments, put it into maintenance mode temporarily.
Rotate every credential
Admin panel, hosting, FTP/SSH, database and the email tied to the domain. Turn on two-factor authentication and remove any admin account you don't recognize.
Find the entry point
The usual causes: an outdated plugin or theme with a known vulnerability, a leaked password, or an unprotected file upload form. Cleaning without closing the hole means a new compromise within days.
Clean and restore
Restore from a clean backup that predates the compromise if you have one, then update every component. Scan for backdoors — attackers usually leave more than one way back in.
After cleanup
Request a review in Search Console if Google flagged the site, and notify customers if their data was affected. Then put prevention in place: regular updates, off-server backups and a security assessment or penetration test.
When to call an expert
If payment or personal data was affected, the compromise keeps recurring, or you need a report explaining what happened for an authority or your customers. WebShield combines incident response, digital forensics and website hardening.
Suspect a compromise or want a security review of your site?
Describe your case to our AI service advisor for an instant suggestion and a summary of your requirements, or contact our team directly.