Signs your website has been hacked

Hackers want to keep using your site for as long as possible. So the best hacks are invisible to the person most likely to fix them: you. These are the ones we see most on small business sites, and what each looks like from your side of the screen.

1. Search spam (the “pharma” or “Japanese keyword” hack)

You might notice: odd results when you Google your name.

Hackers add hidden pages selling pills, fake designer goods or gambling, using your good name to rank in Google. Sucuri found this on 422,741 sites in one year; it made up 38.4% of the infections it cleaned up.¹

Check it: search Google for site:yourwebsite.com and scroll. Any page you didn’t write is a red flag.

2. Malicious redirects

You might notice: visitors say they landed somewhere else.

Some visitors, often only those on phones or coming from Google, get sent to scam sites. The owner, typing the address directly, sees nothing wrong.

3. Backdoors and hidden admin accounts

You might notice: an admin user you don’t recognise.

After breaking in, attackers leave a hidden way back. That’s why a site cleaned once is often hacked again within weeks.

4. Poisoned add-ons (supply chain attacks)

You might notice: nothing, until it’s too late.

In April 2026 a buyer of 31 WordPress plugins slipped a backdoor into all of them. It lay dormant for eight months before switching on.² Owners who did everything right, and kept updating, still got it.

5. Fake “update your browser” or “verify you’re human” traps

You might notice: customers report a strange pop-up.

Your site shows visitors a fake prompt that installs malware on their computer. In 2026 more than 6,000 sites were caught out by fake WordPress plugins doing exactly this.²

6. Spam and phishing sent from your server

You might notice: your emails going to junk, or a slow site.

Your hosting is used to send scam emails, host fake bank login pages or mine cryptocurrency. Your domain ends up on blocklists, and real emails to customers stop arriving.

7. Form and card skimming

You might notice: enquiries drying up.

Code added to your contact, booking or payment pages copies whatever people type and sends it to the attacker.

8. Account and domain takeover

You might notice: you can’t log in.

Someone gets into your hosting, domain or email account, then changes the passwords. Whoever controls your domain controls your website and your email.

9. Defacement and ransom

You might notice: a message on your home page.

The loud kind: your home page is replaced, or your files are locked and a payment demanded. It’s less common for small sites, but it happens.

A five-minute check you can do now

• Google site:yourwebsite.com and look for pages you didn’t write.
• Open your site on your phone using a Google search result, not by typing the address.
• Look at the list of admin users on your website and hosting. Remove anyone you don’t recognise.
• Add your site to Google Search Console, which emails you if Google finds a security problem.
• Ask a friend to send an email to your business address and check it doesn’t land in junk.

If something looks wrong, read what to do if your website has been hacked before you change or delete anything.

Sources

1. Sucuri, SiteCheck 2024 Threat Report (published 2025). ↩

2. TechRepublic, Malicious WordPress plugins with backdoors compromise thousands of websites (April 2026); The Cyber Express on fake plugins on 6,000+ sites. ↩ ↩²