Hacked, but looks fine from the outside? 8 telltale signs any business owner can spot
Most hacks are not given away by your home page. When you look at it from your own computer while logged in, everything is where it should be – which is exactly what the attacker wants. The real signs turn up elsewhere: an unknown admin account, a redirect that sends visitors somewhere else, Google’s “This site may be hacked” warning, a sudden drop in traffic, or an email from your hosting provider about resource abuse. You don’t need to be technical for this, and you don’t need to look at any code. You can spot any of the 8 signs below yourself – and if you see even one of them, it’s worth having the site checked.
Contents
- 1. An unknown admin account has appeared
- 2. It sends your visitors elsewhere, but not you – strange redirects
- 3. Google shows a “This site may be hacked” warning
- 4. A sudden drop in traffic or rankings
- 5. Your hosting provider writes about resource abuse
- 6. Unknown files and recent modification dates
- 7. Spam pages appear in search results
- 8. Outgoing spam and blacklisting
- Quick overview: where to check each sign
- What to do if you see even one sign
- Don't want to check every day? We'll keep watch for you
Why is this so common? Because WordPress powers almost half of the web, which makes it a huge target.
WordPress powers 43.5% of the world’s websites, and an estimated 13,000 or so WordPress sites are hacked every day. 81% of attacks can be traced back to weak or stolen passwords. (Source: Colorlib)
1. An unknown admin account has appeared
One of the first things an intruder often does is create a spare way back in: they add an administrator or editor account for themselves with a harmless-looking name (admin2, support, wpuser). That way they can get back in even after you remove the visible malware.
How to check: in the WordPress admin, open the Users menu and go through the list. If there is an administrator you didn’t add and nobody on your team recognises, that alone is a reason to suspect a hack.
2. It sends your visitors elsewhere, but not you – strange redirects
A redirect hack is deliberately invisible to you. When you type in the address yourself or browse while logged in, everything looks fine. But when a first-time visitor clicks through from Google’s search results on a mobile phone, they end up on a stranger’s site – a pharmacy, gambling or scam site.
How to check: open your site logged out, in an incognito window, on your phone, search for your own business on Google and click through from there. If you end up somewhere other than you expect, something is wrong.
3. Google shows a “This site may be hacked” warning
If Google finds malicious code, spam or suspicious redirects, it places a red warning under your search result, and the browser may stop the visitor with a full-screen alert. This sign hurts in particular because its mere appearance costs you traffic and trust.
How to check: enter your site’s address into Google’s official Safe Browsing site status checker, and look at Google Search Console → Security & Manual Actions → Security issues.
4. A sudden drop in traffic or rankings
If your visitor numbers plunge for no obvious reason, or pages that used to rank well disappear, a hack may be the cause: Google holds back or flags the infected site, and the redirect takes visitors away before they buy anything.
How to check: in the traffic charts in Google Analytics and Search Console, look for a steep, sudden drop that has no marketing or seasonal explanation.
5. Your hosting provider writes about resource abuse
A hacked site rarely sits idle – it works. In the background it sends spam in bulk or attacks other sites, and that drives up the server load. This is why you may receive an email from your provider with a subject like “excessive resource usage” or “abuse”. Using your hosting resources is exactly what the attackers are after.
How to check: treat an email like this as a sign of a possible hack, not as technical noise. (Fake payment demands sent in your provider’s name are a separate thing you should learn to recognise – see our article on “your domain is expiring” scams and fake hosting invoices.)
6. Unknown files and recent modification dates
Attackers often hide a backdoor where you wouldn’t expect it – for example, they slip a .php file into the wp-content/uploads/ folder, which normally only holds images.
How to check: you don’t need to be a developer for this. In your hosting file manager, sort the files by modification date and see whether there are recent changes you didn’t make. A security plugin’s file integrity checker will also flag unfamiliar files.
7. Spam pages appear in search results
Hacked sites often show “SEO spam”: hundreds of foreign pages about pharmaceuticals, counterfeit brands or gambling – which your visitors don’t see, but Google does.
How to check: type site:yourwebsite.co.uk into Google and see how many pages it has indexed. If the number is much higher than the pages you actually have, or strange titles in foreign languages turn up, it points to a hack.
8. Outgoing spam and blacklisting
If your customers complain that your emails land in their spam folder, or your system has sent out unknown messages in your name, your site may well have become a spam sender and your server’s IP address may have been blacklisted.
How to check: keep an eye on customer feedback, and look in your hosting mail log for an unusually high number of outgoing messages you didn’t send.
Quick overview: where to check each sign
What to do if you see even one sign
The most common mistake is to panic. Don’t start deleting files, because removing the visible symptom doesn’t remove the backdoor – the attacker simply comes back. Instead, first change your passwords for the admin, the hosting account and the database, turn on two-factor authentication, and then take a backup of the current (possibly infected) state as well, because it is needed for the investigation. After that comes a professional investigation and clean-up.
With one of our online shop clients, for example, it wasn’t the home page but Search Console that raised the alarm first: the “security issue” warning appeared while the shop looked perfectly fine from the outside. In another case, the first sign was an email from the hosting provider about resource abuse – in the background, the site was sending spam. In both cases, the sooner it came to light, the less damage there was and the cheaper the recovery.
Frequently asked questions
How do I know if my WordPress site has been hacked?
Rarely from the home page itself. The most telling signs turn up elsewhere: an unknown admin account under Users, a redirect that sends visitors somewhere else, Google’s “This site may be hacked” warning, a sudden drop in traffic, or an email from your hosting provider about resource abuse. If you see even one of these, it’s worth having the site checked.
What signs point to an infection if the site looks fine?
Most hacks are deliberately hidden from you. Logged in, on your own computer, everything may look fine, while a stranger arriving from Google on a mobile is redirected, or spam pages appear in search results. So don’t trust your eyes – check Search Console, the user list and your hosting emails.
What does Google's “This site may be hacked” message mean?
It means Google has found malicious code, spam content or suspicious redirects on your site and is warning visitors about it in search results. You can check at transparencyreport.google.com/safe-browsing/search and in the Security issues section of Google Search Console. The warning alone costs you traffic, so it is urgent.
Why am I getting a resource abuse email from my hosting provider?
Often because your hacked site is sending spam in the background or taking part in attacks on other sites, which drives up the server load. Attackers are using precisely your hosting resources. If you receive an email like this, treat it as a possible hack, not just technical noise.
What should I do first if I notice one of the signs?
Don’t delete anything and don’t rush. Change the passwords for the admin and the hosting account, turn on two-factor authentication, and take a backup of the current (infected) state as well, for the investigation. Then have the site investigated, because removing the visible symptom doesn’t remove the backdoor.
Don't want to check every day? We'll keep watch for you
These 8 signs are dangerous precisely because they appear slowly and quietly – and when you’re running an online shop, you don’t have time to go through them every day. WPShield monitoring watches for unknown admin accounts, redirects, Google warnings and file changes on your behalf, and alerts you before your customers notice the problem.
If you’re unsure right now, book a free quick security check with us: in 15 minutes we go through the signs above on your site and tell you whether it is clean or worth a closer look. If something looks suspicious, we can also carry out a fast, professional investigation – without rushing or panic.
