Website Hacked: Signs and How to Fix It

01How Do I Know If My Site Was Hacked?

Some attacks announce themselves right away: the attacker's message appears on the home page, or the site will not open at all. But most attacks are silent. Instead of breaking the site, the attacker wants to use it without being noticed; planting spam links, redirecting visitors to other sites or using the server to send email.

That is why knowing the signs matters. Even one of the following is serious cause for suspicion; if several appear together, a breach has most likely occurred.

• A security warning appears in the browser or in search results
• Visitors are redirected to other sites, especially from mobile or when arriving from Google
• Unrelated product, gambling or pharmacy pages show up in search results under your site's name
• Unknown users or changed passwords in the admin panel
• New files on the server whose names you do not recognize, and old files with new modification dates
• A spam email or resource usage warning from your hosting company
• The site becomes noticeably slow or throws errors often

02What to Do in the First Hour

The moment you realize you have been hacked, the goal is to limit the damage and preserve the traces needed for investigation. Deleting files in a hurry makes it harder to understand how the attack happened and leaves the same vulnerability open.

1. Put the site in maintenance mode or temporarily close it to visitors
2. Take a file and database copy of the site's current state and keep it somewhere separate
3. Inform your hosting company; ask for server logs
4. From a clean device, change the passwords of the admin panel, FTP/SFTP, database, hosting and domain accounts
5. Disable admin accounts you do not recognize
6. If customer or card data may have been affected, assess notification obligations with your legal counsel

03Where Did the Attack Come From?

Before cleaning, you need to find the entry point; otherwise the attacker returns through the same door within days. Server access logs, the admin panel login history and file modification dates answer this question.

The most common entry points are: known vulnerabilities in unpatched software and components, weak or leaked-elsewhere admin passwords, insecure file upload areas, old and forgotten test pages, and FTP credentials stolen from a compromised computer.

find /var/www/site -type f -name '*.php' -mtime -7 -ls

grep -rnE 'eval\(|base64_decode|gzinflate' /var/www/site --include='*.php'

04Malware Cleanup

There are two paths for malware removal: picking out infected files one by one, or rebuilding the site from a clean source. The second is almost always safer, because attackers usually leave more than one backdoor and finding all of them by hand is hard.

Rolling Back to a Clean Backup

If you have a backup from before the date of the attack that you are sure is clean, this is the fastest solution. But if the entry point is not closed after the backup is restored, the site will be hacked again; so the rollback must be done together with updates and a password change. We explained how to take regular, tested backups in our how to back up guide.

What If There Is No Backup?

Without a clean backup, the site's code is obtained again from a trusted source, and content and images are transferred after checking them one by one. The database must also be searched for users added by the attacker, hidden links and scripts embedded in page content. This process is laborious but far cheaper than a half-done cleanup.

05Removing the Google Security Warning

Google can show sites where it detects harmful content with a warning in search results and in the browser. This warning turns away most visitors before they enter the site, so it must be removed quickly once cleanup is complete.

You can check your site's status on Google's Safe Browsing status page. Having your site verified in Search Console makes this process easier.

1. Open the Security issues report in Search Console and review the detected problems
2. Verify that the sample addresses shown in the report have been cleaned
3. Submit a review request, briefly explaining the fixes you made
4. Wait for the result; the review time varies with the type of problem
5. If spam pages were created, make sure those addresses return 404 or 410

06Repairing SEO Damage

Attackers often add thousands of spam pages to your site or plant hidden links in existing pages. After cleanup, these traces may keep appearing in search results for a while. Monitoring the index reports in Search Console lets you track unwanted addresses dropping out of the index.

Resubmit the sitemap, check that important pages display correctly and monitor the change in organic traffic over a few weeks. If you see a lasting drop, having a specialist review the technical structure helps; SEO & analytics work focuses on regaining the visibility lost in this process.

07How to Prevent a Repeat

A cleaned site becomes a target again if habits do not change. The measures below make the attacker's job noticeably harder.

• Regular updates of the site software, server and all components
• Unique passwords and two-step verification on the admin panel
• Each user gets their own account and only the permissions they need
• SFTP instead of FTP, and closing unused access
• Type and size checks on file upload areas
• Daily backups stored off the site and tested
• A simple alert system that monitors file changes and uptime

Do You Need to Change the Infrastructure?

If the attack stemmed from a weakness in the hosting environment itself, or if the provider does not offer current security measures, moving the site to a sturdier infrastructure can be considered. For a seamless move, see our hosting migration guide. We explained that similar measures also work against attacks that encrypt files in our ransomware article.

08When Should You Get Expert Help?

Removing a simple spam link may be something a site owner can do. But for a site that handles customer or payment data, a system hacked more than once, or cases where you cannot find the entry point, getting expert help reduces lost time and reputation.

A security incident on an e-commerce platform that takes orders in particular means direct loss of sales and trust. In company-specific software solutions, because the entire code is known, investigation and a lasting fix can be done faster. For live sites, updates, backup monitoring and performance tracking can be tied into a regular maintenance routine under speed and performance management.