A hacked site does not always look like a black screen saying “hacked”. More often it starts quietly: a strange redirect, new user accounts, a sudden drop in traffic, an e-mail from the host, or a warning from Google.
The sooner the problem is spotted, the lower the risk of losing enquiries, data and customer trust. The main rule: do not panic, and do not start clicking on everything at once.
What the numbers show
7 signs a website has been hacked
- A redirect to unfamiliar pages. The site sometimes leads to a casino, a fake shop, or an unknown page, not always consistently: only from a phone, only from Google, or only for new visitors.
- A Google warning. Messages such as “this site may harm your computer” or security issues flagged in Search Console cause a sharp drop in trust and traffic.
- Unfamiliar pages have appeared. A hack can add thousands of junk pages (casinos, crypto, fake brands) that never show up in the menu. Check with a site:yourdomain.fr search on Google.
- New administrators. Check the WordPress users list: an unfamiliar administrator, a strange e-mail address, or a changed role are all warning signs.
- Files have changed for no reason. Suspicious PHP files inside wp-content/uploads, in the theme, or in plugins, especially ones dated when you were not doing any work on the site.
- The site has suddenly slowed down. That does not always mean a hack, but malicious code, spam pages and login attacks all put extra load on the server too.
- An e-mail from the host. “Infected files detected”, “account restricted” or “malware found” should not be ignored, but that does not mean deleting everything in sight straight away either.
What not to do right away
Rushed actions can wipe out evidence of the attack, break the site, or make recovery harder. Avoid deleting random files without a backup, updating everything at once with no copy in place, disabling every plugin with no plan, installing several security plugins at the same time, switching themes at random, or cleaning up the database by hand without understanding what you are doing.
What to do first
Safe first steps: make a copy of the files and database if the site is still accessible, check the WordPress users list and Search Console, keep any e-mails from the host, and note down when the symptoms first appeared. Do not hand over access to anyone who reached out through an advert.
A proper clean-up usually goes well beyond deleting a single file: it means finding the malicious code, checking the theme, plugins, uploads folder and database, updating anything vulnerable, changing passwords, and setting up basic protection. If you simply remove the visible virus, the underlying cause can remain and the hack can come back.
When to ask for help
A hack usually becomes expensive not because of the clean-up itself, but because of what follows: adverts pointing to a dangerous page, enquiries stopping, Google lowering the site’s trust, and the owner losing several stressful evenings with no proper backup to fall back on.
If you suspect the site has already been hacked, take a look at malware cleanup, and for the future, backups and website recovery.
If there are redirects, a Google warning, e-mails from the host, or unfamiliar administrators, it is better not to experiment for too long. Zen Webmaster can examine the site, take a backup, trace the malicious activity, clean up the files and database, and set up ongoing monitoring. If you would rather work it out yourself, you can start with the safe checks above. If you would rather save your time and your nerves, it is better to hand it to a specialist and get back to running the business.
Latest posts
