If you're asking "has my website been hacked?", check three things first: whether Google shows a security warning for your site, whether there are admin accounts you didn't create, and whether your pages redirect somewhere you didn't send them. Any one of those means act now. The signs below cover the rest.
This guide covers the eight most common signs of a hacked website, how to check your own site, what to do in the first hour, how a hack affects your Google rankings, and how to stop it happening again.
Signs Your Website Has Been Hacked
Most hacks are built to stay hidden, so the signs are often small. Watch for any of these.
1. Google or Your Browser Shows a Security Warning
Security warnings such as "This site may be hacked" under your Google listing, or a red "Deceptive site ahead" page in the browser, mean Google has already found a problem. Visitors rarely click past them.
2. Visitors Are Redirected to Other Sites
Website redirects to spam, gambling or fake shop pages are a common hack. They are often set up to fire only for some visitors, such as people arriving from Google or on a phone, so the site can look normal when you check it yourself.
3. Admin Accounts You Don't Recognise
Unknown users with administrator rights are one of the clearest signs of unauthorised access. Attackers often add an account so they can get back in after you change your password.
4. Pages or Keywords You Didn't Add
Search Google for your own domain. If the results show compromised pages full of strange keywords, such as pharmacy or loan terms, someone is using your site to rank their spam.
5. Your Host or Email Provider Warns You
Hosting companies scan for malware distribution and spam. A suspension notice, or a warning that your server is sending spam emails, is often the first sign an owner sees.
6. Unusual Traffic Spikes
A sudden jump in traffic from unfamiliar countries, or to pages you don't recognise, can mean your site is hosting something it shouldn't. Check your website statistics against a normal week.
7. Unexpected Files or Changes
Unexpected files in your website files, or code you didn't write, are a strong sign. Malicious scripts are often obfuscated code: long strings of characters that don't read like normal code.
8. The Site Is Suddenly Slow or Shows Pop-Ups
A site that becomes slow for no clear reason, or starts showing pop-up windows or ads you didn't add, may be running someone else's code in the background.
How to Check If Your Website Is Hacked
If you have seen one of the signs above, these checks will usually confirm it:
Search Google for site:yourdomain.co.uk and look for pages you didn't create
Open the Security Issues report in Google Search Console, which lists any problems Google has found
Review every admin account and remove anyone you don't recognise
Ask your host to run a malware scan, or use the scanning tools your hosting provides
Check recent changes to your website files, if your hosting shows them
Google's web.dev team has a fuller guide to telling if your site was hacked, including the less obvious signs.
What to Do If Your Website Has Been Hacked
Move quickly, but don't start deleting things at random. Work through these steps in order:
Change every password: hosting, website admin, database, FTP and email. Turn on two-factor authentication wherever it is offered.
Tell your hosting provider. They may be able to see how the attacker got in, and may need to take the site offline.
Take a copy of the hacked site before you change anything, so the cause can be investigated.
Restore clean files from a backup taken before the hack, or have the malicious code and files removed by hand.
Update your CMS, plugins and themes, and remove any you don't use, so the same hole can't be used again.
Once the site is clean, request a review in Google Search Console so any warning can be removed.
If you'd rather not do this yourself, our hacked website recovery service removes the hack and fixes the vulnerability that let the attacker in. It covers sites and web apps built on PHP, Node.js or JavaScript, including WordPress and AI-built apps, and generally costs around £300, depending on whether usable backups are available.
How a Hack Affects Your Google Rankings
A hack can hurt your search visibility in several ways at once. Security warnings in search results stop people clicking. Spam pages and redirects can lead Google to drop affected pages, and in serious cases the whole site can be flagged until it is cleaned.
Search engines usually restore a site once it is clean and a review has been accepted, but the warning costs you visitors every day it stays up. That is why speed matters more than anything else in the steps above. If your rankings haven't recovered after a clean-up, our guide to why a website ranks poorly covers the other common causes.
How Websites Get Hacked
Most small business websites aren't targeted personally. Automated tools scan huge numbers of sites for known vulnerabilities and break into whichever ones are open. The usual ways in are:
Vulnerable plugins and themes that haven't been updated
An out-of-date CMS
Weak or reused passwords, and logins shared between several people
Old admin accounts for people who no longer work with you
Hosting with a poor security setup
How to Stop It Happening Again
Cyber security for a small website is mostly routine. Keep the CMS, plugins and themes updated, take regular backups and check they can be restored, turn on two-factor authentication, and tighten access controls by removing users who no longer need access. A website firewall and automated monitoring add a further layer.
On our platform, we handle hosting, security patches and updates, and every plan includes backups. Restoring from a backup is included at no extra cost, and if a site on our platform is hacked, putting it right is included in the plan. Our managed websites page sets out what the plans cover.
Hacked Website FAQs
Think your site has been hacked? Get in touch and we'll help you work out what has happened.
Can a hacked website be fully recovered?
Usually, yes, especially if the hack is caught early and there is a clean backup. Recovery means removing the malicious code, closing the hole the attacker used, and asking Google to review the site. Without a backup it takes longer, because every file has to be checked.
How much does it cost to fix a hacked website?
It depends on the damage and whether usable backups exist. Our hacked website recovery generally costs around £300.
Will my site be removed from Google if it's hacked?
Google may show a warning in search results, drop affected pages, or flag the whole site in serious cases. Once the site is clean, you can request a review in Search Console to have warnings removed.
Callum Robley
Founder & Lead Developer, Tea Powered Projects
Callum is a full-stack developer and the founder of Tea Powered Projects, a web design, development, and hosting company based in Nottingham, UK. With over 15 years of industry experience, he specialises in building reliable, scalable digital solutions for businesses of all sizes.
