Is My Website Hacked? (How to Tell and What to Do)
Your website is likely hacked if it shows a browser malware warning, redirects visitors to spammy sites, sprawls with strange pages or pop-ups, got suspended by your host, or appears on a security blocklist. The fastest way to know for sure is to run a free scan — it checks for malware and blocklist flags in seconds. If it's infected, change every password and get it cleaned right away.
If you're worried your website has been hacked, take a breath — it's a common, fixable problem, and most small-business owners go through it at some point. A hack usually isn't personal: automated bots crawl the web looking for sites running outdated software, and when they find one, they slip in malicious code. This guide walks you through the warning signs, how to check for sure (for free), and exactly what to do next.
The warning signs your site is hacked
You don't need to be technical to spot a hacked website. Watch for any of these:
- A red "deceptive site" or malware warning. Google or the browser shows a full-screen red alert before your site even loads.
- Spammy redirects. Visitors land on your address but get bounced to a sketchy, foreign, or pharma/casino site instead.
- Strange pages or pop-ups. Unfamiliar pages, pop-ups, or pharma/casino spam show up that you never created.
- Your host suspended the site. Hosts often take an infected site offline to protect their network — and tell you it's been flagged.
- You're on a security blocklist. Services that track malware add infected sites to a blocklist, which browsers and search engines check.
- Sudden slowness or odd admin behavior. The site crawls, settings change on their own, or new admin users appear that you didn't add.
- Customers tell you it looks weird. Often the first warning comes from a visitor who saw something you haven't.
How to check for sure
The signs above are clues, but you shouldn't have to guess. The quickest way to confirm is to run our free scanner — paste in your address and it checks for known malware and whether your site has been flagged on a security blocklist, in plain English, with no signup.
You can also check Google Safe Browsing (the service that powers those red warnings) to see whether Google has flagged your site as dangerous. And if you spot any of the symptoms above — redirects, strange pages, a host suspension — treat them as real and act quickly.
Worried your site is hacked?
Free 30-second check — see your malware and blocklist status, in plain English.
Run the free scan →Why it happened
The vast majority of small-business hacks come down to a few simple causes:
1. Outdated software. An out-of-date WordPress core, plugin, or theme is the number-one way in. Updates often patch known security holes — skip them and you leave the door propped open.
2. Weak or reused passwords. Bots try common passwords against your login page thousands of times an hour. A guessable password is all they need.
3. No updates or monitoring at all. Many sites are set up once and never touched again. Without updates, backups, or scanning, a problem can sit unnoticed for months.
What to do if it's hacked
- Scan itRun the free scan above to confirm the infection and check whether you've been added to a security blocklist. Now you know what you're dealing with.
- Look for the symptomsCheck for browser malware warnings, spammy redirects, strange pages or pop-ups, and anything customers have reported. Note what you find — it helps whoever cleans it.
- Change all passwords immediatelyReset your website admin, hosting, FTP, and database passwords right now, so the attacker loses access while you work.
- Back up the current stateMake a full backup of the site as it is — even infected — before you clean anything, so nothing is lost if a fix goes sideways.
- Clean it or get helpRemove the malicious code carefully, or hand it to a professional. Don't delete files blindly — you can break the site or miss a hidden backdoor that lets the hacker straight back in.
Cleaning a hacked site properly — and making sure no backdoors are left behind — is exactly the kind of thing we handle, and the first fix is free.
Sources
- Google Safe Browsing — the service behind browser malware warnings (Google)
- Google Search Console — flagging hacked sites and requesting review (Google)
- Sucuri — website malware, blocklists, and cleanup guidance (Sucuri)