Something feels off about your website. Maybe a customer mentioned seeing a strange redirect. Maybe your site loaded slowly out of nowhere, or you spotted a page you definitely didn’t create. You’re wondering whether your site has been compromised, and the uncertainty is almost worse than knowing for sure.
You’re right to trust that instinct. Website hacks don’t always announce themselves with flashing warning signs. In fact, the most dangerous compromises are the quiet ones — the kind that run for weeks or months while your site silently works against you, harvesting visitor data or funneling your traffic somewhere else entirely.
According to research from Patchstack, nearly 8,000 new security vulnerabilities were discovered in the WordPress ecosystem in 2024 alone, a 34% increase over the prior year. The overwhelming majority of those, 97%, came from plugins, and almost 59% of them could be exploited without any login credentials at all. These aren’t theoretical risks. They’re active threats that affect real small business websites every single day.
So how do you actually know if your website has been hacked? And if it has, what should you do about it? Let’s walk through the warning signs you can spot yourself, the ones that require a closer look under the hood, and the steps that matter most in those critical first hours after you suspect something is wrong.
The Warning Signs You’ll Notice First
Most small business owners discover a hack the same way: something looks wrong, and they can’t explain it. The good news is that your gut feeling is usually reliable. The bad news is that by the time you notice something visible, the compromise may have been active for a while.
The most obvious sign is a browser warning. If Google Chrome, Safari, or Firefox throws up a red screen telling visitors that your site “contains malware” or is “deceptive,” that means Google has already detected the problem and flagged your domain. This is as clear-cut as it gets, and it’s also one of the most damaging outcomes because potential customers will see that warning before they ever see your homepage. Google’s own security documentation confirms that hacked sites can record keystrokes and steal login credentials from anyone who visits, which is exactly why browsers take these warnings so seriously.
But plenty of hacks never trigger a browser warning. Here’s what else to watch for.
Strange redirects are a classic symptom. You type in your URL and end up on a pharmacy site, a gambling page, or some other domain you’ve never heard of. Sometimes the redirect only happens on mobile devices, or only when visitors arrive through a Google search result rather than typing your address directly. That selective behavior is deliberate — it’s designed to make the hack harder for you to spot while maximizing exposure to incoming search traffic.
Unfamiliar content is another red flag. New pages, blog posts, or links that you didn’t create. Spammy text stuffed with keywords that have nothing to do with your business. Foreign-language content mixed into your footer or sidebar. Hackers inject this content to exploit your site’s search engine authority, essentially hijacking the trust Google has placed in your domain to rank their own garbage.
Then there are the performance symptoms. A sudden, unexplained slowdown. Pages that used to load in two seconds now taking eight or ten. Your hosting provider sending you warnings about excessive resource usage. These can signal that your server is running malicious scripts in the background, mining cryptocurrency, sending spam emails, or serving as a launchpad for attacks on other websites.
And sometimes the sign is more personal. You can’t log into your own dashboard. Your admin password doesn’t work anymore. You find new user accounts with administrator privileges that you never created. If someone else has gained control of your backend, that’s about as definitive as it gets.
The Deeper Signs That Require Investigation
Not every hack leaves visible footprints on the front end of your site. Some compromises are designed to stay hidden, operating behind the scenes where only someone examining the code or server logs would ever find them. If you have access to your hosting control panel or know someone who does, these are the things worth checking.
File modification dates can tell a story. If core WordPress files, the ones that should only change when you run an update, show recent modification timestamps, that’s suspicious. The same goes for unfamiliar PHP files tucked into directories where they don’t belong, especially files with randomized names like wp-tmp-cache.php or strings of nonsensical characters.
Your site’s database can harbor injected content too. Malicious JavaScript that runs every time a page loads, hidden iframes that pull content from external servers, encoded strings that obscure their true purpose; all of these live in the database and won’t be visible just by scanning your file system. This is one of the reasons why hacked sites can be so difficult to clean thoroughly. You can delete every infected file and still have the problem come back if the database injection goes unaddressed.
Google Search Console, if you have it connected, is one of the best early-warning systems available. Google will send you notifications if it detects malware, phishing content, or hacked pages on your domain. It will also show you if your site’s search results have been hijacked to display unrelated content. If you don’t have Search Console set up, this is one of the single most valuable free tools you can configure for your website, and it takes about five minutes.
Email deliverability is another subtle indicator. If your domain has been used to send spam, which is common after a server-level compromise, your IP address or domain may end up on email blacklists. You’ll notice this when your legitimate business emails start bouncing or landing in customers’ spam folders. By the time that happens, the damage to your sender reputation can take weeks to repair.
What to Do in the First 24 Hours
Discovering a hack is stressful. The impulse is to start deleting things, changing passwords, or even taking the whole site down. Some of those instincts are right. Others can make things worse. Here’s what actually matters in those first critical hours, in roughly the order you should approach it.
First, don’t panic and don’t start deleting files at random. If you remove something important, you might break your site further and lose evidence of how the attacker got in, which makes it harder to prevent a repeat compromise. Take a breath. You have time to do this right.
Change your passwords immediately, and change all of them. Your WordPress admin password, your hosting control panel password, your FTP or SFTP credentials, your database password. If you reuse any of those passwords on other services (which is common, even though everyone knows they shouldn’t), change those too. Use strong, unique passwords for each one. A password manager makes this manageable.
Contact your hosting provider. Most reputable hosts have security teams or at least documented procedures for dealing with compromised accounts. They can often tell you when the compromise started, which files were modified, and whether other sites on your server were affected. Some hosting providers will even perform a basic malware scan at no extra charge.
If you have a recent, clean backup, that’s your best friend right now. Restoring from a backup taken before the compromise is often the fastest and most reliable way to get back to a known good state. The key word is “clean” — if your backups have been running on autopilot and the hack has been active for weeks, your most recent backup might already be infected. This is where having a solid backup rotation, ideally with copies stored offsite, pays for itself many times over.
Once your site is restored or cleaned, update everything. WordPress core, every plugin, every theme. Outdated software is the single most common entry point for attackers. Remember that Patchstack statistic: 97% of vulnerabilities come from plugins. If you’ve been putting off updates because you’re worried something will break, that hesitation has a cost, and it’s measured in exactly the kind of situation you’re dealing with right now.
Finally, request a review from Google. If your site was flagged with a malware or deceptive site warning, you’ll need to submit a review request through Google Search Console after you’ve cleaned things up. Google typically processes these reviews within a few days, but during that time, the warning will continue to appear for visitors. The sooner you clean up and submit, the sooner that warning comes down.
Why Small Business Websites Are Targeted in the First Place
There’s a common misconception that hackers only go after large companies and high-profile targets. The reality is almost exactly the opposite. Small business websites are targeted specifically because they tend to be less protected, less monitored, and less likely to detect a compromise quickly.
Attackers aren’t sitting at a keyboard manually breaking into your plumbing company’s homepage. They’re running automated scripts that scan thousands of sites per hour, looking for known vulnerabilities in popular plugins and outdated software versions. When they find one, the exploit happens automatically. Your site wasn’t singled out. It was swept up in a net.
That’s actually important to understand, because it changes the calculus of prevention. You don’t need to build a fortress. You need to stay current with updates, use strong passwords, remove plugins you’re not actively using, and have someone keeping an eye on things. The automated attacks move on quickly when they encounter a site that’s reasonably well-maintained, because there are plenty of easier targets available.
This is also why the “set it and forget it” approach to websites carries real risk. A site that was perfectly secure when it launched can become vulnerable in a matter of weeks as new plugin vulnerabilities are discovered and disclosed. Without regular updates and monitoring, even a professionally built website becomes an increasingly easy target over time.
Keeping This from Happening Again
Cleaning up after a hack is miserable, and it’s expensive, whether you’re paying a security professional or spending your own time on it. The good news is that prevention is far less costly and far less stressful than recovery.
Keep your software updated. This is the single most impactful thing you can do. WordPress core updates, plugin updates, theme updates; all of them, and promptly. If a plugin hasn’t been updated by its developer in over a year, consider replacing it with one that’s actively maintained. Abandoned plugins are ticking time bombs.
Use a security plugin that provides a firewall and malware scanning. Wordfence and Sucuri are both well-regarded in the WordPress community, and both offer free tiers that provide meaningful protection. A web application firewall can block many common attacks before they ever reach your site’s code.
Limit login attempts and use two-factor authentication on your admin accounts. Brute-force attacks, where automated tools try thousands of username and password combinations, are one of the most common entry points for WordPress sites. Two-factor authentication stops them cold, even if the attacker guesses the right password.
Set up automated, offsite backups and test them periodically. A backup you can’t restore is the same as no backup at all. Make sure you know where your backups are stored, how to access them, and that they actually work when you need them.
And honestly, the most reliable prevention strategy is having a professional keep watch. Security monitoring, regular updates, proactive scanning, and fast response when something does go wrong; these aren’t things most small business owners have the time or expertise to manage alongside running their actual business. That’s part of why we built our managed website service the way we did. When we manage a site, security monitoring and updates are baked into what we do every month, so our clients don’t have to wonder whether their site is vulnerable or waste a weekend cleaning up after an attack.
If you’re dealing with a compromised site right now, or if the warning signs in this article sounded uncomfortably familiar, we’re happy to take a look. Reach out to us and we’ll help you figure out where things stand and what it’ll take to get back on solid ground.
