The quick answer

If your website suddenly redirects visitors to another site, shows pages you never created, triggers a red "deceptive site" warning in the browser, or Google emails you about "hacked content", it has very likely been compromised. The good news is that most small-business hacks follow a handful of common patterns, and most are recoverable if you act quickly and methodically.

This guide walks through the tell-tale signs, how to confirm a hack without making it worse, the exact order to clean things up, and the handful of changes that stop it happening again. Work top to bottom and do not skip the backup step.

Ten common signs of a hacked website

Watch for: unexpected redirects to gambling, pharma or adult sites; new pages or posts you did not publish; spammy Japanese or pharmaceutical keywords appearing in Google results for your domain; a browser or antivirus warning when visiting your own site; a sudden traffic spike or collapse in analytics; admin accounts you do not recognise; your host suspending the account for malware; outbound spam emails from your domain; modified core files with recent timestamps; and pop-ups or injected ads that you never added.

A single sign can have an innocent explanation, but two or more together is a strong indicator. The fastest external check is to search Google for "site:yourdomain.com" and look for pages and titles that are not yours.

Confirm it safely

Before changing anything, confirm from a position of safety. Check Google Search Console for a "Security issues" report — it often names the affected URLs and the type of problem. Run your site through a reputable free scanner (for example a URL/malware checker) and review your server access and error logs for suspicious POST requests or file changes.

On our own free tools you can quickly check response headers, TLS and DNS/email records, which frequently reveal tampering such as a missing security header set, an unexpected redirect, or a changed mail record used to send spam. Note what you find before you clean up, so you can verify the fix afterwards.

Clean up in the right order

First, take a full backup of the current (infected) site and database — you may need it as evidence and for comparison. Second, put the site into maintenance mode if you can, and change every password: hosting, CMS admin, database, FTP/SFTP and email. Third, update the CMS core, themes and plugins to the latest versions, and delete any theme or plugin you are not actively using — abandoned plugins are the most common entry point.

Fourth, remove unknown admin users and any files with suspicious recent timestamps, comparing against a known-good backup or a fresh copy of your CMS. Fifth, re-scan until clean. Finally, in Search Console, request a review once the malware is gone so Google removes the warning. If you are not confident doing this, restore a known-clean backup from before the infection and then apply the hardening steps below.

Stop it happening again

Most reinfections happen because the original weakness was never closed. Enable automatic updates for security patches, remove unused plugins and themes, and enforce strong, unique passwords with two-factor authentication on every admin account. Add the core security headers (HSTS, CSP, X-Content-Type-Options), keep TLS certificates from expiring, and set SPF and DMARC records so attackers cannot spoof your domain.

Finally, put monitoring in place so you find out first, not your customers. A weekly automated check of your headers, certificate and DNS records will email you the moment something regresses — which is exactly the window in which a small problem is still a cheap one.

Implementation Checklist

  • Search "site:yourdomain.com" on Google for pages that are not yours
  • Check Search Console → Security issues
  • Back up the current site and database before touching anything
  • Change every password and enable two-factor authentication
  • Update CMS core, themes and plugins; delete unused ones
  • Remove unknown admin users and recently modified files
  • Re-scan until clean, then request a review in Search Console
  • Add security headers, fix SPF/DMARC, and enable weekly monitoring

FAQs

Can a hacked website be fixed, or do I need to rebuild?

Most hacked sites can be cleaned without a rebuild if you act quickly, restore from a clean backup or remove the malicious files, and close the original weakness. A rebuild is only necessary when there is no clean backup and the infection is deeply embedded.

How did my website get hacked?

The most common causes are outdated plugins or themes, weak or reused passwords, and no two-factor authentication. Shared-hosting cross-contamination and leaked FTP credentials are also frequent.

How long does Google take to remove the "hacked" warning?

After you clean the site and request a review in Search Console, the warning is usually removed within a few days, sometimes faster.

How do I stop it from happening again?

Keep everything updated, use strong unique passwords with 2FA, remove unused plugins, add security headers, and set up monitoring that alerts you to changes.