Is My Website Hacked? 12 Signs and How to Check for Free

Something feels off. Maybe traffic dropped, a customer mentioned a weird redirect, or you just have a bad feeling. Here is the fast answer: you can check whether your website is hacked in about ten minutes, for free, using the checks below. No security background needed. We will start with the three fastest checks, then the full list of 12 warning signs and what each one means.

The 3 fastest checks (do these first)

1. Run a remote malware scan. Put your address into our free website vulnerability scanner. It checks your site from the outside for malware signatures, spam injections, blocklist status, and the misconfigurations attackers exploit. Takes about a minute.
2. Check Google's verdict. Look your domain up in the Safe Browsing site status tool. This is the same system that makes browsers show red warning screens, so if you are flagged here, every Chrome and Firefox visitor is already being warned away.
3. Search your own site. Google site:yourdomain.com and read the results. Pages you never wrote, titles in languages you do not publish in, or pharmacy and casino text under your domain mean SEO spam is living on your server. This matters because spam is the most common payload: Sucuri's threat report found SEO spam on 42 percent of infected websites.

The 12 warning signs, explained

Signs Google shows you

• 1. A red browser warning ("Deceptive site ahead" or "This site contains malware") on your own site. This is Safe Browsing flagging you. It is removable, but only after cleanup: we cover the process in our Deceptive Site Ahead guide.
• 2. Security Issues in Search Console. The Security Issues report lists what Google's crawler found, with sample URLs. If you only set up one monitoring tool, make it this one: it emails you when something appears.
• 3. Search results you do not recognize under your domain in a site: search: foreign-language pages, product spam, hundreds of URLs you never created.
• 4. Google Ads disapprovals for "Compromised site". Often the first symptom advertisers see. Full fix guide here.

Signs your visitors see (often before you do)

• 5. Redirects to spam sites. Visitors land on your site and bounce to pharma, casino, or "you won a prize" pages. Sneaky versions only redirect mobile users or first-time visitors, so test in a private window, on your phone, from a link in social media or search, not by typing the address directly.
• 6. Pop-ups and fake alerts you never installed: fake virus warnings, push notification spam, or "update your browser" prompts.
• 7. Customers reporting problems you cannot reproduce. Take these seriously. Malware that hides from the site owner is standard practice, not an exotic trick.
• 8. Defacement. The obvious one: your homepage replaced or altered. Rare compared with silent infections, because most attackers profit from staying hidden.

Signs inside your site and hosting

• 9. Admin users you did not create. Check your user list right now; it takes thirty seconds. In Sucuri's cleanup data, 55 percent of infected databases contained a malicious admin user.
• 10. Files changed when you were not working. Most hosting file managers can sort by modification date. PHP files in your uploads folder are a red flag on their own: that folder should hold images and documents, never code.
• 11. Hosting resource spikes or a suspension email. Infected sites often send spam or attack other sites, which shows up as unexplained CPU and bandwidth usage, sometimes ending in your host suspending the account.
• 12. Your emails start bouncing. When a hacked site sends spam, the server's IP lands on email blocklists, and suddenly your legitimate mail goes to junk folders or bounces outright.

Why healthy-looking sites still get hacked

Two realities worth internalizing. First, small sites are not too small to hack: almost all website compromise is automated scanning, not humans choosing victims. Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 91 percent of them in plugins, and observed heavily targeted flaws being mass-exploited within a median of 5 hours of disclosure. The bots find every site running the vulnerable plugin, whether it gets ten visitors a day or ten thousand.

Second, the padlock in the address bar proves nothing about hacking. HTTPS encrypts traffic between the visitor and your server. A hacked site serves its malware over a perfectly valid HTTPS connection.

You found something. Now what?

Do not just delete the weird files and move on: that is the mistake that leads to reinfection. The short version of a proper response:

1. Confirm the scope: run the scans above, check Search Console, and note every symptom.
2. Clean everything at once: malware, spam pages, unknown admin users, and, critically, the backdoors. Sucuri found a backdoor on 49 percent of infected sites, which is why quick cleanups so often fail.
3. Close the entry point: update the CMS and every plugin and theme, then rotate all passwords (WordPress, hosting, FTP, database).
4. If Google flagged you, request reviews in Search Console and appeal any Ads disapprovals after the cleanup.

If you would rather have specialists do this while you run your business, Sucuri's malware removal service handles the cleanup, backdoor hunt, and blocklist review requests, typically within hours. If the site keeps getting reinfected after cleanups, read why sites keep getting rehacked before spending on another cleanup round.

All clear? Make the next check boring too

• Set up Search Console with email alerts if you have not: it is free, and it is Google telling you directly when something is wrong.
• Turn on auto-updates for your CMS, plugins, and themes.
• Use two-factor authentication on your CMS admin and hosting accounts.
• Rescan monthly. Two minutes with the free scanner beats finding out from a customer.
• Consider a web application firewall if the site matters to your income: Sucuri's firewall blocks exploit attempts before they reach your site and monitors blocklists for you.

Frequently asked questions

Can my website be hacked without any visible signs?

Yes, and it is common. SEO spam (on 42 percent of infected sites in Sucuri's data) is usually cloaked so only search engines see it, and card skimmers are designed to be invisible to everyone. That is why the external checks (remote scan, Safe Browsing status, site: search) matter more than eyeballing your homepage.

Is the green padlock proof my site is safe?

No. The padlock means traffic is encrypted, nothing more. Hacked sites serve malware over HTTPS every day.

How often should I check my website?

A monthly manual scan is a reasonable floor for a small site, with Search Console alerts covering the gaps. Sites that take payments or generate leads should have continuous monitoring rather than manual checks.

My computer has antivirus. Does that protect my website?

No, they are different machines. Your website lives on a hosting server; your antivirus protects your laptop. The overlap is passwords: a keylogger on your laptop can steal your hosting password, which is one more reason for two-factor authentication.

My site is tiny. Would anyone really bother hacking it?

Bots do not check your traffic stats before attacking. Automated scanners try known plugin exploits against every reachable site, and a hacked small site is still valuable to attackers as a spam host, phishing platform, or link farm. The 5-hour mass-exploitation median from Patchstack's data is the speed of automation, not of humans picking targets.

The short version

Ten minutes, three free checks: a remote malware scan, the Safe Browsing status lookup, and a site: search. Then a pass through the 12 signs, especially unknown admin users and PHP files in your uploads folder. If everything is clean, set up alerts and rescan monthly. If not, clean thoroughly (backdoors included) or have professionals do it, and close the door the attacker used.