Signs Your Website Has Been Hacked (And What to Do First)
Sagar Sethi is the founder of Web Hosting People and Xugar, and the author of The Business Knight.
Published 19 October 2026 Last reviewed 19 October 2026 Website security and SSL
The signals worth acting on are unexpected redirects, pages in search results you did not create, a browser or search warning on your own domain, files or accounts you do not recognise, and a sudden change in how much mail your account is sending.
If any of them are present, do two things before anything else. Take the site offline, and keep a copy of it.
The copy is the step people skip. A site can be cleaned in an hour, and with the malware goes the only record of how the attacker got in. The site goes back up, and it is compromised again a few weeks later, because nothing about the entry point changed.
The five signs
1. Unexpected redirects. You search for your business or type the address and land somewhere else, particularly on a phone. Redirects are often conditional, which is why a site can look perfectly normal to its owner and redirect visitors on mobile.
2. Pages you did not create, appearing in search. Search for your own address and read the results. Casino, pharmaceutical and counterfeit goods pages hosted under your domain are a familiar pattern, and they are usually served only to search engine crawlers, so you will not find them by browsing the site.
3. A warning in the browser or in search. A red interstitial saying the site may be harmful, or a label on your listing in Google. Both mean a browser vendor or a search engine has already detected something, and both cost you visitors from that moment.
4. Files, users or settings you do not recognise. An administrator account in WordPress you did not create, a folder in the file manager you cannot account for, changed file permissions, a plugin that appeared in the list. Look at modification dates on core files: anything recent that you did not change is worth opening.
5. Traffic or email anomalies. A sudden drop in traffic can mean Google has already demoted the site. A sudden spike in outgoing mail, or a queue of bounce messages you did not send, means the account is being used to send spam.
Take it offline, then take a copy
Step 1: take the site offline. Put it into maintenance mode or remove the index, so visitors cannot enter credentials on a page you know is compromised. This comes before everything else.
Step 2: copy the files and the database. Store the copy outside the hosting account. This is how the entry point gets identified, and it is your evidence if customer data was involved.
Step 3: change every password, in this order. Hosting, cPanel, CMS administrators, database, FTP, then the mailboxes associated with the site. Work from a device you trust, and do not reuse a password anywhere.
Step 4: check Search Console for a security flag. For a verified property, Search Console reports the security issues Google has found and lets you request a review once the site is clean. If it is not set up, set it up now rather than after the next problem.
Step 5: choose the repair route. Clean the files or restore from a known good backup, then update everything and close the entry point that was used. A restore returns the site to the version whose vulnerability was just exploited, so the update is not optional.
Our guide to restoring a file or site from a backup covers both levels, the single file restore and the whole account, and it makes the same point from the other direction: where you can still reach the site, take a manual backup of the current state first, in case the restore turns out to be the wrong move.
How a site gets compromised
Four routes are worth checking, and none of them are bad luck:
- Stale software. An outdated CMS core, an abandoned plugin, a theme that has not been updated in years. This is the route to check first on any site.
- Reused or weak credentials. The same password on the site as on another service that was breached elsewhere. An administrator password that has appeared in a public breach will be tried automatically.
- A stolen or forgotten FTP account. Old accounts belonging to a former developer, still active, with credentials that have circulated.
- A plugin version with a published vulnerability. Hit in bulk across every site running it. Nothing personal about it, which is exactly why updating on time matters.
Behind all four is maintenance rather than malice, which is good news, because maintenance is something you control.
What your hosting already covers, and what it does not
Every Australian shared hosting plan we sell includes two protections before anything else is added. A Fortinet hardware firewall sits in front of the server at network level, applied to the account rather than inside the website. Acronis backups take a restore point every hour, which is the fastest way back to a clean site after a compromise.
Be clear about the boundary, because the gap is where a compromise hides. Those two do not scan your site for malware, do not tell you whether an application has a known vulnerability, and do not monitor whether your domain has been blacklisted. A firewall and a backup are recovery and defence, not detection.
One qualification on the backups: Acronis is included on the Australian plans. It is not part of international shared hosting, so if you are on an international plan, confirm what your service includes before you count on a restore point being there.
Scanning and monitoring, as a separate purchase
SiteLock is bought separately. It is not included with a hosting plan, and the distinction matters if you are assuming it is already running.
The features move up across three tiers, which the page names Find, Fix and Defend:
- Find runs daily malware scanning across up to 25 pages, daily blacklist monitoring, a SiteLock risk score, and one-time website application, SQL injection and cross site scripting scans. It includes the SiteLock Trust Seal.
- Fix covers up to 500 pages and moves those three scans to daily, then adds daily SMART scans, automatic malware removal, TrueShield protection, WordPress scanning and spam blacklist monitoring.
- Defend adds a web application firewall, a global CDN and content acceleration.
The page carries the current price for each tier, and none of it comes with your hosting, so the comparison worth making is against a compromise rather than against the plan you already pay for.
If the site has already been compromised, the same page carries an emergency response option: the provider states that recovery work starts within 30 minutes, with manual cleaning where automatic removal cannot clear something, seven days of aftercare, and a one-off fee rather than a subscription.
Prevention that earns its keep
- Apply CMS, theme and plugin updates promptly. Highest value, lowest effort.
- Remove what you do not use. A deactivated plugin still needs updating and still counts as an attack surface.
- Use a different password on every service, and keep them in a password manager rather than a spreadsheet.
- Remove unused administrator, FTP and mailbox accounts, particularly any created by a contractor who has moved on.
- Keep backups you have tested restoring. An untested backup is a hope, not a plan.
- Watch for changes, so that a customer or a search engine does not have to tell you first.
Frequently asked questions
How do I know if my site is blacklisted? Open the site in a browser and look for a warning before the page loads, and check Search Console for a verified property, which reports security issues directly. A SiteLock plan adds blacklist monitoring, so you are told rather than finding out from a customer.
Can cleaning the site alone fix it? Only if you also close the way the attacker got in and update whatever was out of date. Cleaning without updating is how a site gets compromised twice in the same month.
Will restoring a backup remove the malware? It removes what was added after the backup was taken, and anything that was already on the site when that backup was taken comes back with it. It does not fix the vulnerability if the backup predates the update that closed it, so restore and update.
Do I need to tell anyone? If customer data may have been involved, Australian privacy obligations can apply, and legal advice is worth taking promptly. We can tell you what happened technically. We are not your legal adviser.
Should I take the site offline or leave it up? Take it offline while the compromise is active. Leaving a compromised site serving visitors puts their credentials at risk and can get the domain flagged.
How long does a clean take? Restoring from a good backup is the quick part. Cleaning properly takes longer, because every component has to be checked and updated and the entry point has to be found and closed.
Get the basics in place
Two things protect a site before anything goes wrong: a firewall in front of it and a restore point from the last hour. Both come with every Australian shared hosting plan we sell. Detection is the third piece, it is bought separately, and it is the one that tells you a problem exists while it is still small.
If you want detection running before you need it, we will tell you which of the three tiers matches the site you actually run.
Phone 1300 565 610 between 9am and 5pm Monday to Friday, or email hello@webhostingpeople.com.au, which is answered 24/7.
Primary action: Scan and clean the site