Table of contents
- Why a breached site looks normal
- 1. Pages you never wrote appear on Google
- 2. Traffic changes shape for no reason
- 3. Business emails start landing in spam
- 4. The browser or Search Console shows a warning
- 5. The site slowed down with nothing changed
- 6. Files modified on dates that make no sense
- 7. Administrator accounts you never created
- 8. Different behaviour on desktop and phone
- What to do if a sign matches
- Prevention costs less than repair
Why a breached site looks normal
There is a widespread misunderstanding about what "hacked website" means. The image that comes to mind is defacement: the homepage replaced by a message, the site unreachable, the damage obvious. It happens, but it is the minority of cases.
Whoever attacks a business website usually does not want to destroy it: they want to use it. A working, seemingly normal site is more valuable than a dead one, because it can host spam pages, send fraudulent email trading on the domain's reputation, or redirect part of the traffic elsewhere. All activities that pay better the longer they stay invisible.
This changes how you should look for the signs. You do not need to check whether the site "opens": you need to look in places nobody ever looks.
1. Pages you never wrote appear on Google
This is the single most reliable signal, and it takes thirty seconds. Go to Google and search:
site:yourdomain.com
Google will list every page of your site it has indexed. Scroll through: if you see pages in languages you have never used, titles about pharmaceuticals, shoes, casinos or loans, or addresses you do not recognise, your site is hosting content you did not put there.
It is worth looking beyond the first page of results. Injected pages tend to sit at the bottom, precisely because nothing else on the site links to them.
2. Traffic changes shape for no reason
Open Google Analytics and look at the last three months. Not the total: the composition.
Signals worth attention: a sudden spike in visits from countries you do not work with; unfamiliar pages among the most viewed; a bounce rate jumping to 95% on certain pages; an unusual volume of visits lasting zero seconds.
A compromised site generates traffic that does not look like yours. If your visits used to come from your region and suddenly 40% arrive from elsewhere on pages you do not recognise, that is not a marketing success.
3. Business emails start landing in spam
This one surprises people, because it looks like a separate problem. It is not.
If your site is used to send unwanted messages, the domain ends up on the blocklists that providers consult. The result: your legitimate emails too — quotes, order confirmations, replies to customers — get treated as suspicious.
The warning sign is when several customers within a few weeks tell you they never received your email, and find it in their junk folder. If you have correctly configured SPF, DKIM and DMARC and the problem persists, it is worth looking at the site.
A check that costs nothing and that almost nobody enables: aggregate DMARC reports. If your DMARC record includes rua=mailto:, you periodically receive the list of IP addresses sending mail on behalf of your domain. When the website server — which normally sends nothing — shows up among them, you have a sign of compromise weeks before a customer tells you they found your email in their spam folder.
4. The browser or Search Console shows a warning
When Google detects harmful content, it does not send a polite email: it puts a red warning in front of the site, visible to anyone trying to open it. By then the damage is done and traffic collapses within hours.
Search Console, however, flags the problem earlier, under "Security and manual actions". It is one of the reasons it is worth having it set up and checking it occasionally, even when everything looks fine.
If you have never activated it, it is free and takes a few minutes: it is the tool through which Google tells you what it sees of your site.
5. The site slowed down with nothing changed
A sudden slowdown, with no new content or recent changes, can mean the server is doing something beyond serving your pages: sending bulk messages, running operations for third parties, answering automated requests.
Slowness alone proves nothing — the ordinary causes are many, and we listed them in the article on why websites get slow. But a sudden and unexplained slowdown, especially alongside another sign from this list, deserves a check.
6. Files modified on dates that make no sense
If you have FTP or hosting panel access, sort files by modification date. It takes a minute.
What you are looking for: system files modified on dates when nobody touched the site, especially at night or over weekends. Files with seemingly random names. New folders you do not recognise, often in places where nothing should be, such as the uploads directory.
On WordPress the classic spots are the plugins folder, the themes folder and the configuration files in the site root.
7. Administrator accounts you never created
In the admin panel, check the user list. Any account with administrator rights you do not recognise should be removed — but note first when it was created, because that date tells you when the problem started.
Watch out for plausible-sounding names too: "admin", "backup", "support", "wpuser". Whoever wants to stay does not use conspicuous names.
8. Different behaviour on desktop and phone
Some breaches are selective: they show the normal site to visitors from the office computer and redirect anyone arriving from a smartphone or a search result. It is a way to delay discovery, because the owner always checks from their own machine.
The test: open the site from your phone, on mobile data rather than office wi-fi, arriving from a Google search instead of typing the address. If the behaviour differs, you have found something.
What to do if a sign matches
A single sign is not a verdict: slowness can have mundane causes, a traffic spike can be genuine. But two or more signs together make a compromise likely.
The first step is not deleting files at random, and this matters: without knowing how the attacker got in, cleaning up achieves little, because they come back through the same door. First you find the entry point, then you clean.
If you are already past the warning signs and the problem is confirmed, the article on what to do when your site has been hacked sets out the steps in the right order, including the mistakes that make things worse.
For a quick check of the general state — certificate, security headers, speed — you can use our free analysis tool: it does not replace a file inspection, but it gives you a picture in thirty seconds.
Prevention costs less than repair
Almost every breach we see exploits three things: a plugin not updated in months, a weak password on an administrator account, an installation left without maintenance after handover.
No sophisticated measures are needed. Regular updates, different passwords for each account, two-factor authentication on admin accounts, automated backups kept off the server and a periodic check cover the vast majority of real cases.
That is the content of our website security guide, if you want to go deeper without becoming technical.