Most website hacks are not dramatic. There is rarely a skull on the homepage or a ransom note. More often, someone quietly uses your site for their own ends and hopes you never notice.
That is why it helps to know what to look out for. Here are the most common warning signs, followed by what to do first if you spot one.
Warning signs to look out for
Strange redirects
You click a link to your own website and end up on a completely different site, often selling something dodgy. Sometimes it only happens on mobile, or only when people arrive from Google, so you might not see it yourself. If a customer mentions that your site "went somewhere weird", take it seriously.
Spam pages showing up in Google
Search Google for site:yourdomain.co.uk (using your own web address). This shows the pages Google knows about on your site. If you see pages about pills, loans, knock-off handbags or text in other languages that you never created, someone has added them. They are usually hidden from your menus.
Admin users you do not recognise
Log in to your website and look at the list of users. If there is an administrator account you did not create, or one with a strange name or email address, that is a strong sign someone has got in and given themselves a way back.
Google or browser warnings
Google and the main web browsers warn people away from sites they believe are harmful. You might see a red warning screen saying the site is deceptive or may harm your computer, or a note under your listing in Google saying the site may be hacked. If you have Google Search Console set up (a free tool that shows how Google sees your site), it will usually flag security issues there too.
Your host suspends your site
Hosting companies watch for unusual activity on their servers, such as a site suddenly sending thousands of emails or using far more resources than normal. If they think your site has been compromised, they may suspend it to protect everyone else. A suspension email is unwelcome, but it is often the first clear sign that something is wrong.
Spam emails sent from your domain
Customers or contacts tell you they have received odd emails from your business address. Or you start getting lots of bounce-back messages for emails you never sent. This can mean your website is being used to send spam, or that your email account itself has been accessed.
Other things that feel off
- The site is suddenly much slower than usual
- Files or pages have changed and nobody on your side changed them
- Your contact form stops working or sends enquiries somewhere else
- You cannot log in with a password that worked last week
- Unfamiliar pop-ups or adverts appear on your pages
On its own, any one of these could have an innocent explanation. Two or three together is worth acting on.
First steps if you think you have been hacked
Try not to panic. Most hacks can be cleaned up.
- Do not delete everything. It is tempting to wipe the site, but it can destroy clues about how they got in and make a clean restore harder.
- Contact your host or web developer. Tell them what you have seen. Good hosts deal with this regularly and can check server logs, restore backups and sometimes clean the site for you.
- Change your passwords. Start with your email account, then your hosting account, then your website login. Use new, unique passwords for each. If your email was accessed, whoever got in could reset everything else from there.
- Turn on two-factor authentication. This adds a second check, usually a code on your phone, so a stolen password alone is not enough to log in.
- Remove unknown users. Delete any admin accounts you did not create, but note down their names and email addresses first in case your host or developer needs them.
- Restore from a clean backup. If you have backups from before the problem started, restoring one is often the quickest fix. Then update everything straight away, or the same weakness will let them back in.
- Update all software. Install every available update for your website software, theme and plugins, and delete any you do not use.
- Ask Google to review your site. Once it is clean, use Google Search Console to request a review so any warnings are removed.
Finding out how they got in
Cleaning a site without fixing the cause is like changing the locks but leaving a window open. The usual culprits are out-of-date software, weak or reused passwords, old accounts nobody removed and free copies of paid themes or plugins. Ask whoever helps with the clean-up to tell you which one it was, so you can close that gap for good. There is more on each of these in our blog.
Making it less likely next time
Prevention is far less stressful than a clean-up. Keep software updated, take regular backups stored away from the website itself, use a password manager and check your user list every few months.
If you would rather not think about any of that, every We are Graft monthly plan includes hosting, security updates and backups, with a real person to talk to when you need something. You can see what is included on our pricing page.
A final word
Spotting a hack early makes a real difference. The sooner you notice, the less damage is done to your reputation, your Google listing and your customers' trust.
If something about your site does not look right and you are not sure what to do, send us a message or WhatsApp us on 07459415807. We reply within one working day.