Signs Your Website Has Been Hacked and What to Do Next

Hacked websites do not always show an obvious warning. Many compromises run quietly for weeks, sending spam or redirecting visitors. Here are the signs to watch for and what to do.

Warning signs

• Visitors are redirected to unfamiliar or suspicious sites
• Your site or host shows a malware or phishing warning
• New admin users appear that you did not create
• Pages or posts you did not write, often about pills, loans or gambling
• Search results show strange titles or Japanese or Chinese text for your pages
• The site suddenly slows down or goes offline
• Your host suspends the account or sends unusual traffic alerts
• You cannot log in even though your password is right

What to do first

1. Stay calm and do not delete everything. You may need evidence of how the attack happened.
2. Contact your host. They can tell you what they see and may help isolate the site.
3. Change passwords for your website, hosting, database, email and FTP, from a clean device.
4. Turn on two-factor authentication for all important accounts.
5. Restore a clean backup if you have one from before the infection. See our backups guide.
6. Remove unknown users and plugins and update everything.

Find the cause

Cleaning a site without fixing how the attacker got in leads to reinfection. Common causes are outdated plugins, weak or reused passwords and compromised accounts.

Beware of strangers offering help

After a hack, scammers sometimes contact owners offering a quick fix for money or login details. Do not give your passwords to anyone who contacts you out of the blue. Read about common scams.

Prevent it happening again

Keep software updated, use strong unique passwords, limit user roles and monitor your site. See our WordPress security checklist.

Need urgent help?

Our security service includes malware scans and cleanup, using limited access only.