Final lesson. Thank you for sticking with it.
Most website hacks are designed to stay hidden for as long as possible. A hacked site often looks perfectly normal to its owner. That's why the most common way owners find out is from a customer, their host or a red Google warning.
The signs to spot
- Odd results when you Google your business: pages you didn't write, in other languages or selling pills, bags or betting. This "search spam" hack made up 38% of infections one big clean-up firm handled.
- Customers say they landed somewhere strange. Redirects often only hit phones coming from Google, so you won't see it yourself.
- An admin user you don't recognise.
- Your emails start going to junk.
- A red "deceptive site" warning in Google or the browser.
- Enquiries dry up for no clear reason.
If it happens: the first hour
- Don't panic, and don't delete anything yet.
- From a different, clean device, change your email password first, then domain, hosting and website. Turn on two-step login.
- Call your host and ask them to put up a holding page if visitors are at risk.
- Get it cleaned properly, including hidden backdoors, or it will come back.
- Ask Google for a review in Search Console once it's clean.
Prevention beats cure
Australian small businesses lost an average of A$56,600 per reported cybercrime. Preventing one is mostly the free settings you've switched on in this course. Well done.
There's one more step, and it's the biggest. Every lesson so far has been about locking doors. The safest door is the one that isn't there.
That's what we do at Hedgehog. We move your existing website onto secure static hosting, with no plugins, no database and no login page to attack. You change it by sending a text, an email or a voice note, and approve a preview before it goes live. We won't ever promise a site can't be attacked. We take away the parts most attacks need.
If you'd like to see your own site moved across, we'll make you a free preview. No card, no obligation.