How to check if your website has been hacked

Attackers rarely deface a homepage any more. A compromised site is far more useful to them when it keeps working normally: it can host spam pages for search engines, redirect mobile visitors from Google to scam sites, skim card details at checkout, or send email. That is why "the site looks fine to me" is not evidence that it is clean.

Work through the checks below in order. The first group needs no access to the server; the later ones do.

Common signs a website has been hacked

• Visitors (often only on phones) are redirected to another site, but you never see it when you type the address yourself.
• Google search results for your site show titles or descriptions in another language, or pages about pharmacy, casinos or replica goods.
• Browsers or Google show a "Deceptive site ahead" or "This site may harm your computer" warning.
• Your host suspends the account or reports malware or outgoing spam.
• New administrator accounts, plugins or files appear that nobody on your team added.
• The site suddenly becomes slow, or the server shows high CPU use with normal traffic (a common side effect of cryptominers and spam scripts).
• Customers report card fraud after buying from your store.

None of these proves a hack on its own, and a hacked site can show none of them. Treat them as reasons to investigate.

1. Check what search engines see

Search for site:yourdomain.com on Google and scroll through several pages of results. Look for pages you did not create, foreign-language titles and spam keywords. Spam pages are often numerous and have random-looking URLs.

If you use Google Search Console, open Security & Manual Actions > Security issues. Google lists hacked content, malware and social engineering it has found, often with example URLs. You can also look up your domain in the Google Safe Browsing site status tool.

2. Visit the site the way a victim would

Many infections are "cloaked": they show spam or redirects only to search engine crawlers, only to visitors arriving from a search result, only on mobile, or only once per visitor. Open a private browser window on your phone, search for your business on Google and click your own result. Then try again from a different network.

A Webforta scan does this for you on a verified site: besides its normal requests, it loads the homepage as a regular browser, as Googlebot and as a phone visitor arriving from Google search, and flags differences such as spam or redirects shown only to search engines.

3. Read the page source

Right-click the page and choose View page source (not Inspect, which shows the page after scripts have changed it). Look for:

• Script tags loading from domains you do not recognise, or from raw IP addresses.
• Long blocks of obfuscated JavaScript (strings of hex or base64, eval(, String.fromCharCode).
• Hidden iframes (width or height 0, or positioned off-screen).
• Blocks of links hidden with display:none or tiny font sizes.
• Payment or login forms that submit to a domain other than yours.

Check your checkout and login pages too, not only the homepage. Card skimmers usually load only where payment details are entered.

4. Look for exposed files and leaked secrets

Not every problem is an active infection. Exposed .env files, .git folders, database dumps and configuration backups such as wp-config.php.bak hand attackers passwords and keys, and are a common route to a later compromise. They are easy to miss because nothing links to them. A Webforta scan checks 77 such locations and confirms each one by its content, not just by a 200 response.

5. Check users, files and scheduled tasks on the server

This is where most compromises are confirmed. With access to your hosting account or the server:

• List administrator accounts in your CMS and hosting panel. Remove anything unknown, but note its name and creation date first.
• Sort files by modification date and look at what changed recently, especially PHP files in upload folders, which should only contain media.
• Check .htaccess, .user.ini and web server configuration for redirects or auto_prepend_file lines you did not add.
• Review cron jobs and scheduled tasks in the hosting panel.
• Look at access logs for POST requests to unusual files, and at the mail log if your host reports outgoing spam.

On WordPress

Compare core files and wordpress.org plugins with their official checksums. With WP-CLI, run wp core verify-checksums and wp plugin verify-checksums --all. Any modified or unknown file in wp-admin or wp-includes is a strong sign of compromise. The free Webforta WordPress Security plugin runs the same comparison from inside the site, looks for PHP files hidden in uploads and known malicious code, and reports the file and line. See the WordPress security checklist for prevention.

6. Check your domain and DNS

If an attacker gets into your registrar or DNS account, they do not need to touch your server at all. Check that your nameservers, A records and MX records are what you expect, and that the domain is not about to expire. Webforta Monitor snapshots DNS records hourly and alerts on changes, and tracks domain expiry.

What a clean result really means

If every check above comes back clean, the most you can say is that you found no evidence of compromise. Malware can sit in the database, in a file that is never requested, or activate only under conditions you did not test. No scanner, including Webforta, can prove a site is malware-free, and Webforta never claims a site is.

If you did find something, go straight to what to do when your website is hacked. Act quickly but do not start deleting files before you have taken a copy: you will need it to find how the attacker got in.