Can a website be hacked without the owner noticing?

Yes, and it is common. Many hacks only show spam to search engines, or only redirect visitors on mobile or those arriving from Google, so the owner sees a normal site. Others run silently, sending spam email or hosting hidden pages. Regular site: searches, Search Console alerts and security monitoring are how most owners find out early.

Why does my website redirect to another site only on my phone?

This is a classic sign of a hack. The malicious code checks the device or where the visitor came from and only redirects mobile users or people clicking from Google, to avoid being noticed by the owner. Test with mobile data rather than office Wi-Fi, search for your business and tap your own result. Also rule out a browser extension or ad on the visitor's device.

How do I check if Google has flagged my website?

Open the Security issues report in Google Search Console if your site is verified, and look up your domain in Google's Safe Browsing site status in the Transparency Report. Also search site:yourdomain.com for pages you never created. If Search Console shows an issue, it usually lists example URLs that help you find the infected files.

Will deleting my website and restoring a backup fix a hack?

Only partly. A backup from before the infection removes the malicious code, but if you do not fix the weakness that let the attacker in, and change all passwords, the site is often reinfected quickly. You also need to know when the hack started, because recent backups may already contain the backdoor. Back up the infected state first so nothing is lost.

How long does it take to remove a Google hacked warning?

After you clean the site and request a review in Search Console, Google's review often takes from a day to a few days, though it can be longer for some issue types. The warning is removed once Google confirms the site is clean. Requesting a review before the cleanup is complete usually leads to a rejection and a longer wait.

Can a hacked website affect my business email?

Yes. If attackers use your server to send spam, your server IP or domain can end up on blacklists, and your normal emails start landing in spam folders. Check your domain and mail server against blacklists, confirm SPF, DKIM and DMARC are set up, and ask your host whether outgoing mail has been limited.

Speed & Security

Signs Your Website Has Been Hacked: 14 Warning Signs and How to Check Each One

By ITCM Team · Updated November 2026

The clearest signs your website has been hacked are spam pages or foreign-language titles under your domain in Google, redirects to unrelated sites, a "Deceptive site ahead" warning, a Security Issues email from Google Search Console, admin users you did not create, and a host warning or suspension. Many hacks are built to hide from the owner, so a site that looks normal when you open it can still be infected. Below are 14 signs, how to check each one, how serious it is, and what to do first if you find one.

Key takeaways

Many hacks hide from the owner: redirects may only fire for mobile visitors or people arriving from Google.
A site: search on Google is the fastest free check for injected spam pages.
Search Console's Security Issues report and Google's Safe Browsing site status show what Google has flagged.
Unknown admin users, unknown files and changed passwords mean an attacker has, or had, real access.
If you find a sign, back up the current state before changing anything; do not panic-delete.
Cleaning is only half the job: close the way in, then request a review.

How do I know if my website was hacked?

Most small business sites are not hacked by someone targeting them personally. Automated bots scan millions of sites for outdated plugins, weak passwords and leaked logins, then use any site they get into for spam, redirects or sending email. Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins, which is why an outdated WordPress site is the most common case we see.

The attacker usually wants your site to keep working, because a working site with a good reputation is worth more to them. That is why the signs are often subtle. A quick first pass with the free website health check helps, but the checks below go further.

14 signs your website has been hacked

Some of these signs are certain, others are only suspicious. Treat any two together as a likely compromise.

Redirects to spam, gambling or scam sites, often only on mobile or only when someone clicks your result in Google.
Japanese, Chinese or pharma ("cheap pills") pages appearing under your domain in Google results.
Google search results show your pages with titles or descriptions you never wrote.
New admin users or accounts you do not recognise in WordPress or your hosting panel.
Unknown files on the server, such as odd PHP files in uploads folders or recently modified core files.
Defacement: the home page replaced with a message, image or political slogan.
Browsers show "Deceptive site ahead" or "Dangerous site" (Google Safe Browsing) warnings.
An email from Google Search Console about security issues or hacked content.
Your host suspends the account, or warns about malware or outgoing spam.
The site becomes very slow, with CPU or bandwidth spikes you cannot explain.
Your passwords stop working, or the admin email address has been changed.
Strange popups, fake update prompts or ads that you did not add.
Your business emails start landing in spam, or your domain or server IP appears on blacklists.
Antivirus software or security plugins warn visitors or you about your site.

Sign, how to check, and how serious it is

Use this table as a checklist. "Critical" means stop and act today.

Sign	How to check	Severity
Spam or Japanese pages in Google	Search site:yourdomain.com, add words like viagra, casino or a Japanese keyword	Critical
Redirects for some visitors	On a phone using mobile data, search Google for your business and tap your result	Critical
Safe Browsing warning	Google Transparency Report, Safe Browsing site status	Critical
Search Console security email	Search Console, Security & Manual Actions, Security issues	Critical
Unknown admin users	WordPress Users list filtered by Administrator; hosting and FTP accounts	Critical
Unknown or modified files	File manager sorted by modification date; compare with a clean copy	High
Host suspension or spam notice	Hosting email and support tickets; outgoing mail logs	High
Emails going to spam / blacklisted	Blacklist lookup for your domain and mail server IP; check SPF, DKIM, DMARC	High
Changed passwords or admin email	Login history, password reset emails you did not request	High
Strange popups or ads	Visit in a private window on a different device	Medium to high
Slow site and CPU spikes	Hosting resource graphs and access logs	Medium

How to check Google for hacked pages (site: search)

Type site:yourdomain.com into Google and scroll through the results. You are looking for pages you never created, titles in Japanese or other languages you do not use, and words like casino, replica, loans or pills. Adding a keyword helps: site:yourdomain.com casino.

The Japanese keyword hack is a well-known example: it creates thousands of auto-generated Japanese pages on your domain that link to fake shops. Google's own guidance notes that attackers sometimes add themselves as owners in Search Console, so check the list of verified users there too. Also check Google on a phone: some hacks only redirect mobile visitors who arrive from search, so typing your address directly on your laptop shows nothing.

How to check Search Console and Safe Browsing

If your site is verified in Google Search Console, open the Security issues report. It lists problems Google detected, such as code injection, content injection, URL injection or social engineering, with sample URLs. Google also emails verified owners when it finds an issue, so check that the email has not gone to an old address.

For a second opinion, look up your domain in Google's Safe Browsing site status, part of the Google Transparency Report. If it reports unsafe content, Chrome and other browsers using Safe Browsing may show visitors a red warning page instead of your site.

How to check users, files and modification dates

A security scanner plugin or a server-side malware scan can speed this up, but scanners miss things, so a negative result does not prove the site is clean.

WordPress: go to Users, filter by Administrator, and look for names or emails you do not know.
Hosting panel: check FTP/SFTP accounts, database users, cron jobs and SSH keys for anything you did not add.
Files: in the file manager, sort by last modified. Core files changing on a date when you did no updates is a red flag, as are PHP files inside uploads folders.
Compare with a known clean copy or your latest backup from before the problem started.
Check .htaccess and the main config file for redirect rules or long encoded strings.

What to do first if your website has been hacked

The instinct is to delete suspicious files or restore an old backup straight away. Slow down: deleting the wrong file can break the site and destroy the evidence of how they got in, and restoring a backup without closing the hole usually means being hacked again within days. Our step-by-step guide on how to recover a hacked website covers the full process.

Don't panic-delete. Take a full backup of the current files and database, even though they are infected.
Change every password: hosting, WordPress admins, database, FTP/SFTP, email and the domain registrar.
Remove unknown admin users and turn on two-factor login for every admin.
Scan and clean: remove malicious code, replace core files, plugins and themes with fresh copies, and update everything.
Find and close the way in, usually an outdated plugin, a weak or reused password, or a leaked login.
Request a review in Search Console once the site is clean, and ask your host to lift any suspension.

Why hacked sites get reinfected

Reinfection is common because cleaning removes the symptoms but not the cause. Attackers often leave backdoors, small hidden files or code that let them back in after the visible spam is removed. If the vulnerable plugin is still there, or the stolen password is still valid, bots return quickly.

Prevention comes down to a few habits: keep WordPress, plugins and themes updated, delete what you do not use, use unique passwords, and protect every admin login with two-factor authentication, which WordPress core does not include on its own. Our website security guide covers backups, monitoring and hosting choices in more detail.

What we have learned recovering hacked WordPress sites

ITCM has recovered hacked WordPress sites for small businesses: removing malware and spam injections, getting sites off blacklists and making them fast and secure again. You can read one example in our WordPress recovery case study.

The pattern is consistent. The owner usually learns about the hack late, from a customer, a Google warning or a host email, because the site looked fine from their own computer. The entry point is almost always something ordinary: an abandoned plugin, an old admin account or a reused password. And the cleanup is only finished when Google's warnings are gone, the way in is closed and someone is watching for it to return.

How ITCM handles this

If you think your site is hacked, our website security service can check it, clean it and harden it, with a fixed quote before any work begins. If the old site is not worth saving, we can rebuild instead: we build your new website and installable app first, you review it on a demo link, and you pay $150 one-time only if you are happy. That includes the website, the app, 24/7 online booking, lead management, a customer-owned admin panel and three designs to choose from.

An optional care plan from $100 a month covers ongoing updates and monitoring, so the next problem is caught early rather than by a customer.

Frequently asked questions

Can a website be hacked without the owner noticing?: Yes, and it is common. Many hacks only show spam to search engines, or only redirect visitors on mobile or those arriving from Google, so the owner sees a normal site. Others run silently, sending spam email or hosting hidden pages. Regular site: searches, Search Console alerts and security monitoring are how most owners find out early.
Why does my website redirect to another site only on my phone?: This is a classic sign of a hack. The malicious code checks the device or where the visitor came from and only redirects mobile users or people clicking from Google, to avoid being noticed by the owner. Test with mobile data rather than office Wi-Fi, search for your business and tap your own result. Also rule out a browser extension or ad on the visitor's device.
How do I check if Google has flagged my website?: Open the Security issues report in Google Search Console if your site is verified, and look up your domain in Google's Safe Browsing site status in the Transparency Report. Also search site:yourdomain.com for pages you never created. If Search Console shows an issue, it usually lists example URLs that help you find the infected files.
Will deleting my website and restoring a backup fix a hack?: Only partly. A backup from before the infection removes the malicious code, but if you do not fix the weakness that let the attacker in, and change all passwords, the site is often reinfected quickly. You also need to know when the hack started, because recent backups may already contain the backdoor. Back up the infected state first so nothing is lost.
How long does it take to remove a Google hacked warning?: After you clean the site and request a review in Search Console, Google's review often takes from a day to a few days, though it can be longer for some issue types. The warning is removed once Google confirms the site is clean. Requesting a review before the cleanup is complete usually leads to a rejection and a longer wait.
Can a hacked website affect my business email?: Yes. If attackers use your server to send spam, your server IP or domain can end up on blacklists, and your normal emails start landing in spam folders. Check your domain and mail server against blacklists, confirm SPF, DKIM and DMARC are set up, and ask your host whether outgoing mail has been limited.

Get a website + app built for free

We build your website and mobile app first, and you see it finished. If you’re happy, you pay $150 one-time. If you’re not, you pay nothing.

See the $150 offer Free website audit

← All articles