Common hacked-site indicators include browser warnings, strange redirects, unknown admin users, spam pages in Google, changed files, hosting suspension notices and antivirus alerts from visitors.
Visible signs
- Visitors are redirected to another site.
- Search results show spam titles or pages you did not create.
- Browsers or antivirus tools warn about malware.
- The homepage or admin area has changed unexpectedly.
- Forms or pages stop working after suspicious activity.
Admin signs
- Unknown administrator users appear.
- Plugins or themes have been installed without approval.
- Passwords stop working.
- New files appear in uploads, themes or plugin folders.
- The `.htaccess`, `index.php`, `header.php` or `footer.php` files change unexpectedly.
External signs
Your host may disable the site, Search Console may show security warnings, or customers may report strange behaviour. These reports should be taken seriously even if the site looks normal to you, because some malware only appears to certain visitors or search crawlers.
What not to do immediately
Do not randomly delete files, reinstall plugins over the top, or keep changing passwords from a compromised computer. Take a backup of the current state first, even if infected, so there is evidence and a recovery point.
How TechThisOut can help
Our hack cleanup and security audit services help identify symptoms, clean affected files where scoped, and reduce repeat risk.
Worried your site is compromised?
Share the symptoms and we will help scope the safest next step.
