Signs your website has been hacked, and what to do first
Google warnings, site: search spam, phone-only redirects and unknown admins are common signs; take the site offline, then save a copy and change passwords.
UB Web Developers team
The most common signs that a website has been hacked are a warning from Google, pages you never created showing up in Google, visitors on phones being sent to another site, admin accounts you didn't add, email you didn't send, and a notice from your host. If you see one, write down what you see, ask your host to help take the site offline so it stops harming visitors, and save a copy before you change anything. Then change every password, find out how the attacker got in and get help.
Many of these signs are easy to miss, because attackers hide their work from the person who owns the site. Google (opens in new tab) warns that hacked pages can be cloaked, so search engines see spam while the owner sees a normal page.
What are the signs that a website has been hacked?#
Is Google warning you or your visitors?#
Google flags hacked and dangerous pages in two ways: a warning label next to them in search results, and a full-page warning in the browser (Google (opens in new tab)). If you've verified your site in Search Console, Google says (opens in new tab) you'll get a notification when it suspects a hack. The Security issues report then lists what it found, such as hacked content, malware or deceptive pages, with sample addresses.
Do spam pages show up when you search your own site?#
Search Google for site:example.mn, with your own domain in place of example.mn, and look for pages you didn't create. Google lists (opens in new tab) this as a way to find pages a hacker has added, and suggests (opens in new tab) adding words that have no place on your site, such as drug names, luxury brands you don't sell, or "loans". Google has cleanup guides for two patterns: the Japanese keyword hack (opens in new tab), which adds pages of machine-written Japanese text, and the gibberish hack (opens in new tab), which adds pages of keyword-stuffed nonsense.
Are visitors on phones sent somewhere else?#
Some hacks redirect only mobile visitors, so the site looks normal on the office computer. Google's spam policies (opens in new tab) give the example of showing desktop users a normal page "while redirecting mobile users to a completely different spam domain", and say hacked redirects can depend on the device, the browser or where the visitor came from. To check, search for your business on a phone and tap your own result, as Google suggests (opens in new tab). The same post notes that an advertising script can cause this kind of redirect without any hack, so check third-party scripts too.
Are there users you didn't add?#
Open the list of users in your site's dashboard and look for accounts you don't recognise. New users that nobody authorised are one of the clear signs of a hack in the WordPress guide for hacked sites (opens in new tab). Check every role, not only administrators: in the UpdraftCentral attacks of October 2026, the attacker's hidden account showed up as an Editor.
Is your site or mailbox sending email you didn't write?#
Hacked sites are often used to send spam. The WordPress guide warns that mail blocklists then flag the server's address, which is often the same server that sends your business email. For mailboxes, Microsoft lists (opens in new tab) signs such as a mailbox blocked from sending, suspicious messages in Sent Items or Deleted Items, and rules that forward mail to addresses you don't know.
Bounces or complaints about mail you never sent don't always mean a hack. Email by design doesn't check the sender (Microsoft (opens in new tab)), so anyone can put your address in the From line. SPF, DKIM and DMARC let receiving servers check the sender, and DMARC tells them what to do with mail that fails, as our guide to those records explains.
Has your host suspended or limited your account?#
The WordPress guide counts a host disabling your website as a clear sign of a hack. So is being told your site is being used to attack other sites, and visitors saying their antivirus warns them about it. Ask the host what it found. Google notes (opens in new tab) that your host can check whether other customers were affected, and may be able to help you recover.
What should I do first?#
Why take the site offline? Google's quarantine guide (opens in new tab) starts there, so the site "no longer serves content to users" and visitors aren't exposed to malicious code.
Why save the evidence first? The WordPress guide (opens in new tab) calls documentation "the first actionable step" after a hack, and recommends one more snapshot of the site before cleaning it, even though it's infected. Google's quarantine guide asks you to "write down the unwanted account names for later investigation" before deleting them. Without that record, working out how the attacker got in is harder, and the WordPress guide notes that owners often lack the data for it. Unless that way in is closed, the attacker can come back after the cleanup.
Why every password? The WordPress guide warns that attacks often start on the owner's own computer, so scan it first. It also says to change the passwords again once the site is clean.
Why check the backup first? Attackers hide their work, so a break-in can start well before anyone notices, and a backup from before the first sign of trouble can still hold the attacker's code. CISA's #StopRansomware Guide (opens in new tab) says "care must be taken to identify such dropper malware before rebuilding from backups", and to identify the systems and accounts involved in the first breach. Our guide to website backups covers keeping copies that go back far enough.
Where can I get help? Your host, your developer, or a company that cleans up hacked sites. WordPress has free support forums (opens in new tab), and Google's support team guide (opens in new tab) points to its Search Central forum, which has a section for hacked sites. In Mongolia, the Public Center for Combating Cyber Attacks and Breaches asks anyone hit by fraud or a cyber attack to report it on its website, 113.mn (opens in new tab) (zalilan.113.mn (opens in new tab)).
Once the site is clean, request a review from the Security issues report. Google says reviews can take days or weeks (Google (opens in new tab)).
Can a free scan tell me if my site is hacked?#
Not on its own. Our security check looks at your site from the outside: HTTPS and the certificate, whether plain HTTP redirects to HTTPS, security headers, version numbers your site gives away, and the SPF and DMARC records for your email.
It loads only your home page, and it identifies itself as our checker, not as a phone or as Google. So it won't see spam hidden from owners, pages elsewhere on the site, or redirects aimed at phones. It doesn't look at Google's warning lists, and it can't log in, so it can't see your users, plugins, files or mail logs. A clean result doesn't mean the site hasn't been hacked.
Sources#
- Google, Security issues report (opens in new tab), Search Console Help
- Google, Why is my site labeled as dangerous in Google Search? (opens in new tab), Search Console Help
- Google, Safe Browsing site status (opens in new tab), Transparency Report
- Google, Spam policies for Google web search (opens in new tab), Google Search Central, last updated 28 August 2026
- Google, Detect and get rid of unwanted sneaky mobile redirects (opens in new tab), Google Search Central Blog, 29 October 2015
- Google, How do I know if my site was hacked? (opens in new tab), Quarantine your site (opens in new tab) and Build a support team (opens in new tab), web.dev
- Google, Fix the Japanese keyword hack (opens in new tab) and Fix the gibberish hack (opens in new tab), web.dev
- WordPress.org, FAQ My site was hacked (opens in new tab), last updated 26 July 2026
- Microsoft, How email authentication works in Microsoft 365 (opens in new tab), Microsoft Learn
- Microsoft, Respond to a compromised email account in Microsoft 365 (opens in new tab), Microsoft Learn
- CISA, MS-ISAC, NSA and FBI, #StopRansomware Guide (opens in new tab), September 2023
- Public Center for Combating Cyber Attacks and Breaches, zalilan.113.mn (opens in new tab) and 113.mn (opens in new tab)
Frequently asked questions#
How do I check if Google has flagged my website as dangerous?#
Open the site in Chrome and look for a full-page warning. If you've verified the site in Search Console, open its Security issues report (opens in new tab), which Google calls the source of truth. If you haven't, enter the address in Google's Safe Browsing site status (opens in new tab) tool.
Why can't I see the spam pages Google says are on my site?#
Attackers often hide them from the owner. Google says (opens in new tab) hackers may use cloaking "to avoid detection by site owners", so search engines get spam while you get a normal page. Search Console's URL Inspection tool shows a page the way Google sees it.
Should I delete the hacked files straight away?#
Not before you've saved a copy. The WordPress guide for hacked sites (opens in new tab) recommends taking a snapshot of the site before you clean it, even though it's infected. Without it, working out how the attacker got in can be much harder.
How long does it take Google to remove a hacked-site warning?#
After you fix the site and request a review, Google says malware reviews take a few days and reviews of spam hacks can take up to several weeks (Google (opens in new tab)). Don't send a second request before the first is decided, because that can slow it down (Google (opens in new tab)).
People got email from my address that I never sent. Was I hacked?#
Not necessarily. Email by design doesn't check that the sender is who they claim to be, so anyone can put your address in the From line (Microsoft (opens in new tab)). SPF, DKIM and DMARC let receiving servers check the sender, and DMARC tells them what to do with mail that fails. Check your Sent Items, Deleted Items and forwarding rules too (Microsoft (opens in new tab)), but clean folders don't prove the mailbox is safe. Our guide to SPF, DKIM and DMARC explains the records.