Is my website hacked? How to tell, in plain English

You open your own website and something is off. A page you never wrote is in Google. A customer says your link sent them to a betting site. Your login stopped working. The first question is always the same: is my website hacked, or is it just broken?

Here is how to tell, using checks anyone can do in about ten minutes, without touching any code.

Why it is worth checking

Small businesses are not too small to be attacked. The UK National Cyber Security Centre says that one in two small businesses suffers a cyber incident every year, and that small businesses are as likely to meet online crime as larger ones. Most attacks are not aimed at you personally. Software looks for out-of-date websites all day, and your site is picked up when it matches.

The other reason is that a hack is not always visible. Attackers can use a site to send spam, redirect visitors, or host pages that sell things you have never heard of, and your own view of the site may look fine while it happens.

Nine signs your website may be hacked

None of these proves a hack alone. Two or three together should worry you.

1. Visitors get sent somewhere else. Your site opens, then jumps to another website. The trick often only happens to people who arrive from Google or on a phone, so you may never see it yourself. Ask a friend to try it from their phone.
2. Google shows pages you did not write. Search for your own domain in Google, in the form site:yourdomain.com. Google’s own guidance says that if you see unknown pages on your site, or topics you did not write, you may have been hacked. Look for strange product names, other languages, or odd titles.
3. A browser or Google warning. A red “dangerous site” screen, or a warning label next to your site in search results, means Google believes something harmful is on it.
4. Your login stopped working, or an administrator account you do not recognise has appeared in your user list.
5. The site looks different. A changed home page, a message from someone else, or new links in your footer that you never added.
6. Your site is suddenly slow, or your host contacted you about unusual traffic or a spike in resource use.
7. Your emails land in spam or customers receive messages you did not send. A hacked site can be used to send junk in your name.
8. Files you did not create or change. Your developer or host can compare your site’s files against a clean copy, or against the history kept by the tools your developer uses. The WordPress project lists new or changed files among the signs of an attack.
9. Strange entries in your logs. Your web server keeps a record of every request. Spikes in redirects or unfamiliar addresses in those records are a warning, and Google lists them in its own checklist for site owners. This one is for your host or developer to read, not you.

The ten-minute check

You do not need technical skill for these four steps.

1. Search your own domain on Google in the form site:yourdomain.com, and scroll through the results for anything you did not publish.
2. Open your site on your phone, using mobile data rather than your office wifi, after arriving from a Google search. Redirects often hide from the people who own the site.
3. Open Google Search Console, the free tool Google gives site owners. Its Security Issues report lists hacked pages and harmful content that Google has found, with instructions to fix them. If you have never set it up, do that today, because Google also sends its warnings there.
4. Look at your user list in your site’s admin area. Every administrator should be someone you know and still employ.

If all four look clean, that is a good sign, but not a guarantee. A careful attacker hides from exactly these checks. Which brings us to what a scanner can and cannot tell you.

What a free scan can and cannot tell you

An outside scan sees your website the way a stranger does. That is useful, because it shows the doors an attacker would try first: an out-of-date WordPress version, a list of staff usernames that anyone can read, an old WordPress side door left open, add-on code with known holes, or a missing secure connection.

Our free website security checker looks at those things from the outside. Be clear about what it is not. It reads only what a visitor’s browser receives, so it does not look inside your server’s files, and it cannot tell you for certain that you have already been hacked. It tells you how easy you would be to hack. Finding hidden files or malware inside a site takes someone with access to the server.

If you think you have been hacked

Act in this order:

1. Do not delete everything in a panic. Note what you saw, take screenshots, and keep any backups. The WordPress project advises keeping backups taken after a compromise, because they help work out how the attacker got in.
2. Phone or message your host straight away. Ask them whether they can see malware, what changed and when, and whether other sites on the same server are affected.
3. Change passwords from a clean device. Start with your website admin, hosting account and the email address used to reset them. Use a password manager so each one is different. If your computer is also infected, new passwords typed on it go straight to the attacker.
4. Ask for a clean restore, not just any restore. Restoring a backup from before the hack removes the damage you can see. It does not close the hole the attacker used, so they can come back. Ask your developer how the attacker got in, and whether that has been fixed.
5. Ask Google to look again. Once the site is clean, the Security Issues report in Search Console lets you request a review so the warnings can be removed.

What to ask your host or developer

Send these questions in writing, so the answers are on record:

• Is my site running a supported version of PHP, and has it been updated since the recent PHP flaws? (We explain that one in PHP2Shell: what the PHP flaw means for your website.)
• Which plugins and themes do I use, and are they all current, and still supported by their authors?
• Who has administrator access, and when did each person last log in?
• How do you know my backups work, and how old is the most recent clean one?
• If something is found, will you tell me how it got in, not only that it is gone?

If the answers are vague, that is information too.

If you want to see how a hacker finds sites in the first place, Black October: the hacks explained covers the recent wave.

Want us to check yours?

Start with the free website security checker. It takes about a minute and tells you what a stranger can see.

If it finds problems, or you suspect your site is already compromised, our website security service looks at your site the way an attacker would, fixes what is wrong in a safe order, and tests it again with you.

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

Sources and further reading

• Small organisations guide to cyber security, UK National Cyber Security Centre, reviewed 21 July 2026. Source for the one in two figure and for small businesses being as likely to face online crime as large ones.
• How to prevent malware infection, Google Search Central. Source for unknown pages meaning you may have been hacked, the Security Issues report, and checking logs.
• Malware and unwanted software overview, Google Search Central. Source for how Google lists harmful files and the review request.
• Hardening WordPress, WordPress Advanced Administration Handbook. Source for changed files, log checks, and keeping post-compromise backups.
• Manual actions report and Security Issues, Google Search Console Help. Source for the warning labels shown in search results and browsers.