How to tell whether your website has been hacked

Most of what feels like "my site might be hacked" turns out to be something else — a botched update, a caching problem, a plugin conflict. The signs below are specific enough to actually tell the two apart, rather than the vague unease a strange-looking page can produce on its own.

Unfamiliar files or code you did not add

The single most reliable sign. Compromise almost always leaves files behind: a script with a random or generic-looking name in a folder that should only contain your own content, an extra file sitting alongside your normal files with a very recent modification date you cannot account for, or code appended to the top or bottom of a legitimate file that was not there before.

Content you did not create

Pages advertising products you do not sell, pharmaceutical or gambling content mixed into unrelated pages, or entire new pages you never wrote, are a classic sign of a site being used to host spam content for search engines rather than being defaced outright — this kind of compromise is often invisible to the site owner because it only shows to search engine crawlers or specific referrers, not to a normal visitor browsing directly.

Unexpected redirects

Visitors reporting that your site sends them somewhere else entirely — often triggered only on mobile devices, or only when arriving from a search result rather than typing the address directly — is a common symptom precisely because it is designed to be missed by the site owner testing their own site normally.

Accounts or users you did not create

Check the administrator or user list in your CMS or control panel for any account you do not recognise, particularly one with administrative privileges. This is worth checking even if nothing else looks wrong, since a newly created admin account is sometimes the only trace left behind before it is used later.

A warning from a browser or search engine

If Chrome, Safari or another browser is showing a "deceptive site" or "dangerous site" warning before your page even loads, or Google Search Console has flagged the site, take that at face value — these warnings are triggered by automated scans that found something specific, not a false alarm to dismiss. Clearing a Google "deceptive site" warning covers what happens after you confirm this.

Outgoing spam from your server

If your hosting provider contacts you about unusual outgoing mail volume, or your domain suddenly appears on an email blacklist despite normal usage, a compromised script sending spam through your account is a common cause, distinct from a genuine mail configuration problem.

Resource usage that spiked without a matching cause

A sudden, sustained jump in CPU or bandwidth usage that does not correspond to any real increase in legitimate traffic or activity on your side is worth investigating specifically, rather than dismissing as "just a busy day" — malicious scripts running in the background consume resources the same way legitimate traffic does, and a spike with no visible cause is the tell.

Ruling out an ordinary fault first

Before treating any single symptom as confirmed compromise, check whether a more mundane explanation fits just as well. A plugin or theme update that ran partway and failed can leave broken pages or unexpected behaviour that looks alarming but has nothing to do with an attacker. A shared caching layer serving an old version of a page can make it look like content changed on its own. And a single slow day, a single odd-looking page, or one visitor report on its own is rarely enough on its own to call it — it is the combination of several specific signs together, not any one in isolation, that turns suspicion into confirmation.

Scanning to confirm

Once you have a specific reason to suspect a compromise, a proper scan is the next step rather than more manual checking. How to scan your site for malware covers running that scan and what the results actually mean.

If you are already certain

If the signs above have already confirmed it for you, do not spend more time verifying — move straight to what to do first if your website is hacked, which covers containing the damage and starting the cleanup in the right order.