Many business owners assume they’d know immediately if their website were hacked: the homepage would be replaced with a message, or the site would vanish. Sometimes that happens. More often, hacked sites keep looking normal to their owners while they quietly do something else: redirect some visitors to scams, send spam, host phishing pages or inject hidden links for someone else’s benefit.
Attackers have good reasons to stay hidden. A compromised site that nobody notices is useful to them for longer. This post covers the warning signs to watch for and what to do in the first hour if you spot one.
Warning signs visitors might notice
Unexpected redirects
Some hacks only redirect certain visitors, such as people arriving from Google on a phone, while showing the normal site to everyone else, including you when you visit directly. If a customer mentions they “ended up on a strange site” after clicking your link, take it seriously.
Browser warnings
Chrome and other browsers may show a red full-screen warning that a site is dangerous or deceptive. This usually comes from Google Safe Browsing detecting malware or phishing.
Odd pop-ups or ads
If visitors report pop-ups, ads or prompts to install something, and you didn’t add them, something is wrong.
Antivirus alerts
Some visitors’ security software may block your site or flag downloads from it.
Warning signs in search results
Strange pages appearing in Google
Search Google for site:yourdomain.ca (with your own domain). If you see pages you didn’t create, especially in other languages or about pharmaceuticals, loans, gambling or counterfeit goods, your site may be hosting spam content.
Your title and description have changed
If your search listing shows text you didn’t write, someone may have altered your pages or added hidden content.
Security warnings in Search Console
Google Search Console has a Security Issues report. If Google detects a problem, it will often show it there and may email the site’s verified owners. If you haven’t set up Search Console, it’s worth doing for this reason alone.
Warning signs behind the scenes
Unknown admin users
Check the list of WordPress users. An administrator account you don’t recognize is a serious red flag.
Files changed that nobody touched
Security monitoring tools can alert you when core files change unexpectedly or new files appear in places they shouldn’t.
Unexplained slowness or resource warnings
A sudden jump in server load, bandwidth or resource limit warnings from your host can indicate your site is being used to send spam or attack others.
Email problems
If your business emails start bouncing or landing in spam, your domain or server may have been added to a blocklist, sometimes because a hacked site sent spam.
Your host contacts you
Hosting companies sometimes detect malware or abuse and suspend accounts. Read any messages from your host carefully.
What to do in the first hour
If you see signs of a hack, stay calm and act methodically.
1. Don’t start deleting things
It’s tempting to delete suspicious files immediately. But evidence of how the attackers got in is important for making sure they can’t return. Hasty deletions can also break your site.
2. Change passwords from a clean device
Change passwords for WordPress administrators, hosting, the database, FTP or SFTP and any email accounts linked to the site. Use a device you’re confident isn’t compromised, and turn on two-factor authentication where you can.
3. Tell your host
Your host may be able to confirm what they’re seeing, isolate the site or provide logs that help the investigation.
4. Check your backups
Find out what backups exist and when they were taken. Don’t restore blindly: if the hack happened weeks ago, recent backups may also be infected, and restoring without closing the gap means you’ll be hacked again.
5. Get a proper clean-up
A thorough clean-up does more than remove visible symptoms. It identifies how the attacker got in, such as an outdated plugin or a stolen password, removes all malicious code and hidden back doors, updates everything and hardens the site. Then it’s monitored afterwards to make sure the problem doesn’t return.
6. Request reviews once clean
If Google has flagged your site, use Search Console to request a review once the site is completely clean. Warnings are removed after Google confirms the problem is fixed.
7. Consider your obligations
If customer information may have been accessed, get advice about your obligations. In Canada, private-sector organizations covered by PIPEDA must report breaches of security safeguards involving personal information where there’s a real risk of significant harm, and keep records of breaches.
Preventing the next one
Most compromises of small business sites come through a small number of doors:
- Outdated plugins, themes or WordPress core.
- Weak or reused passwords, without two-factor authentication.
- Abandoned plugins that no longer receive security updates.
- Old user accounts that should have been removed.
Regular updates, fewer plugins, strong authentication, security monitoring and tested backups close most of them.
The takeaway
A hacked website often looks normal to its owner. Watch for redirects, browser warnings, strange pages in Google, unknown admin users and email trouble. If you see signs of a hack, change passwords, involve your host, avoid hasty deletions and get a thorough clean-up that closes the way in.
If you think your site may be compromised, contact us now. Urgent requests are answered within one business hour, and we’ll help you clean up and stay protected afterwards.