1. Google or your browser shows a red warning
"Deceptive site ahead", "The site ahead contains malware" or "This site may harm your computer" in search results. These come from Google Safe Browsing, which Chrome, Firefox and Safari all use. Once you're flagged, most visitors won't get past the warning, and your traffic drops sharply within a day or two.
How to check: go to Google's Safe Browsing site status page and enter your domain. If you have Google Search Console set up, look under Security & Manual Actions > Security issues.
2. Visitors get redirected, but you don't
This one confuses a lot of site owners. A customer tells you your site sent them to a casino or a fake "you've won an iPhone" page. You check, and everything looks normal.
That's deliberate. Redirect malware often checks who's visiting before it does anything. It may skip logged-in WordPress users, only fire on mobile, only fire once per visitor, or only target people who arrive from a Google search. The site owner is the person least likely to see it.
How to check: log out of WordPress, open a private window on your phone using mobile data rather than your office Wi-Fi, search Google for your business, and click through to your site from the results.
3. Spam pages show up in Google under your domain
Type site:yourdomain.co.uk into Google. If you see pages in Japanese, or titles about replica handbags, pharmacy products or gambling, you've probably got an SEO spam infection. Hackers create thousands of pages on your domain to borrow its reputation in Google. They can be invisible from your own menus and dashboard.
You might also notice it in Search Console first, as a sudden jump in indexed pages or keywords that have nothing to do with your business.
4. Administrator accounts you didn't create
Go to Users in your dashboard and filter by Administrator. Any account you don't recognise is a serious red flag. Hackers often give them dull names like wpadmin, support or adminbackup so they blend in.
Some malware also hides the account from the users list entirely, so a clean-looking list isn't a guarantee. Checking the database directly is the only way to be certain.
5. Your hosting company suspended the account
Hosts scan their servers, and if they find malware or see your account sending spam, they'll often suspend it to protect everyone else on the server. The suspension email usually lists the files they flagged. Keep it. It's useful to whoever cleans the site.
6. Strange files on the server
If you're comfortable using your host's file manager, look in wp-content/uploads. That folder should only hold images, PDFs and other media. Files ending in .php in there are almost always malicious. Other giveaways are files with random names like xbqm.php in your root folder, or a recent modified date on index.php or .htaccess when you haven't changed anything.
Please don't start deleting things on a live site. Take a backup first, and if you're not sure what something is, ask.
7. Your site has suddenly become slow or keeps crashing
Not every slow site is hacked. But malware that mines cryptocurrency, sends spam or serves thousands of spam pages to search engines can eat your server's resources. If performance drops sharply and nothing on your side has changed, it's worth ruling out.
8. Customers are getting spam emails from you
Compromised sites are often used to send phishing and spam emails, either through a script uploaded to the server or through a hijacked contact form. The first sign might be customers forwarding you strange emails, or your own legitimate emails suddenly landing in junk folders because your domain has been blocklisted.
9. Unfamiliar code or popups on your pages
Popups you didn't add, ads you don't run, links in your footer to sites you've never heard of, or a fake "update your browser" message. On a WooCommerce shop, also watch for changes on the checkout page. Card-skimming scripts are injected there to copy payment details as customers type them, and they usually leave no visible trace at all.
What to do if you think you've been hacked
Don't panic, and don't delete the site. In order:
- Take a full backup of files and database, even though it's infected. It's evidence, and a safety net.
- Change your WordPress, hosting, FTP and database passwords, using a different device if you can.
- Don't restore an old backup without checking it. If the hole that let them in is still there, they'll be back.
- If customer data may have been exposed, note when you found out. Under UK GDPR you may need to report it to the ICO within 72 hours.
- Get the site properly cleaned. That means finding the backdoors as well as the symptoms you can see.
If you'd like us to take a look, send us the address. We'll check it from the outside and tell you what we see before asking for any logins or money. Every clean-up includes 15 days of free monitoring afterwards.