Website hacking is more common than most site owners realize. According to Sucuri, over 90,000 websites are hacked every day, and most owners don't find out until Google displays a warning — or a customer calls to report it. The fallout includes lost traffic, damaged reputation, and potentially weeks of recovery work.
This guide covers 10 clear warning signs your site may have been compromised, along with actionable steps to verify and recover.
Sign 1 — Website Content Changed Without Your Action
Defacement — Attackers Replacing Your Pages
The most obvious sign: you open your site and see content that isn't yours. Sometimes attackers leave a message like "Hacked by..." or replace pages with foreign-language content. In subtler cases, only hidden pages are altered — used for spam — while the homepage remains normal.
Sign 2 — Google Shows "This Site May Harm Your Computer"
Google Safe Browsing Malware Detection
Google Safe Browsing continuously scans websites. When it detects malware, phishing, or unwanted software, it shows a red warning page before visitors can access your site — instantly eliminating traffic and conversions.
Check your site status at: https://transparencyreport.google.com/safe-browsing/search?url=yourdomain.com
Sign 3 — Unexplained Server Slowness or High CPU/RAM Usage
Cryptomining or Bot Infections
Attackers often install cryptominers or DDoS bots on compromised servers, pushing CPU usage to near 100% continuously. Your site will slow to a crawl or become unresponsive. If your hosting provider reports resource overages with no obvious cause, investigate immediately.
Sign 4 — Unknown User Accounts Created
Ghost Admin Accounts in WordPress or DirectAdmin
Check WordPress Dashboard → Users → All Users for admin accounts you didn't create. Similarly, inspect DirectAdmin for unexpected email or FTP accounts. These backdoor accounts allow attackers to maintain persistent access even after you've cleaned up.
Sign 5 — Sudden Unexplained Traffic Drop
Google Deindexing or Ranking Penalties
When Google detects malware, it can remove affected pages from its index or apply ranking penalties overnight. If GA4 shows organic traffic plummeting over 50% with no known algorithm update, check Search Console immediately.
Sign 6 — Google Search Console Security Issues
Security Issues Panel in Search Console
Google Search Console has a dedicated "Security Issues" tab. When problems are detected, Google sends an email alert and shows which pages were flagged and why — hacked content, malware, deceptive pages, or harmful downloads.
Sign 7 — Strange Files on Your Server
PHP Shells and Hidden Backdoors
Attackers typically plant PHP shells in various directories. These files often have suspicious names like c99.php, r57.php, or shell.php, or disguise themselves as innocuous names like image.php inside an images folder.
Sign 8 — Suspicious Redirects
Redirecting Visitors to Gambling or Spam Sites
Attackers sometimes configure redirects only for mobile users or visitors arriving from Google, sending them to spam websites while desktop testing appears normal. Check using a mobile user agent or Google's Mobile-Friendly Test tool.
Sign 9 — Your Email Is Blocked or Blacklisted
Server Used as Spam Relay
Hackers frequently use compromised servers to send bulk spam, causing the hosting IP to land on email blacklists. Your business emails then fail to deliver or land in spam folders. Check at MXToolbox Blacklist Check.
Sign 10 — Your Hosting Provider Alerts You to Malware
Proactive Malware Detection from Hosting Support
Quality hosting providers run automated malware scanning and notify site owners when threats are found. Imunify360, used by AsiaGB, automatically scans and quarantines dangerous files before they cause harm.
How to Check If Your Site Has Been Hacked
| Tool | What It Checks | URL |
|---|---|---|
| Google Safe Browsing | Malware / Phishing status | transparencyreport.google.com |
| Sucuri SiteCheck | Malware, blacklists, errors | sitecheck.sucuri.net |
| Google Search Console | Security issues, index status | search.google.com/search-console |
| MXToolbox Blacklist | Email IP/domain blacklisting | mxtoolbox.com/blacklists.aspx |
| VirusTotal | URL/file scan across multiple engines | virustotal.com |
| Imunify360 Dashboard | Server-level malware detection | Via DirectAdmin Panel |
Steps to Take After Your Site Is Hacked
Step 1 — Take Your Site Offline Temporarily
Enable maintenance mode or bring the site down to prevent visitors from being exposed to malware and to stop attackers from causing additional damage while you investigate.
Step 2 — Backup the Current State
Even with malware present, backup everything first. You'll need to compare the infected state with a known-clean backup to identify exactly what was changed.
Step 3 — Change All Passwords
- FTP / SFTP credentials
- DirectAdmin / Hosting Control Panel
- MySQL database passwords
- All WordPress admin accounts
- Email accounts associated with the site
Step 4 — Scan and Remove Malicious Files
Use Imunify360 through DirectAdmin or a WordPress security plugin like Wordfence to scan the entire server. Remove or quarantine all threats. Find recently modified files with:
find /home/user/public_html -name "*.php" -newer /tmp/reference_date -lsStep 5 — Restore From a Clean Backup
AsiaGB Hosting performs twice-monthly automated backups (on the 1st and 15th of each month). Contact support to restore from a backup predating the attack.
Step 6 — Request a Google Review
After cleaning up, go to Google Search Console → Security Issues → Request Review. Google typically processes review requests within 1–3 days.
How to Prevent Future Hacking Attempts
| Security Measure | Details | Priority |
|---|---|---|
| Keep CMS/Plugins Updated | Update WordPress, plugins, and themes immediately when new versions release | 🔴 Critical |
| Use Strong Passwords | Minimum 16 characters with mixed numbers and special characters | 🔴 Critical |
| Enable 2FA | Two-factor authentication for WordPress admin and DirectAdmin | 🔴 Critical |
| Limit Login Attempts | Block brute force attacks by limiting failed login attempts | 🟡 High |
| Use SSL/HTTPS | Encrypt traffic to prevent man-in-the-middle attacks | 🟡 High |
| Application Firewall (WAF) | Block SQL injection, XSS, and common attack patterns | 🟡 High |
| Regular Backups | Maintain personal backups in addition to hosting backups | 🟢 Medium |
| Correct File Permissions | PHP should not have write access to directories unnecessarily | 🟢 Medium |
Hosting With Built-In Malware Protection
AsiaGB Hosting includes Imunify360, DirectAdmin Control Panel, and automatic backups — protecting your site and enabling fast recovery when needed.
View Hosting PlansFAQ — Frequently Asked Questions About Website Hacking
Summary
Website hacking can happen to anyone, but knowing the warning signs and having a clear response plan minimizes the damage. The 10 key signs to watch for are: defaced content, Google Safe Browsing warnings, abnormal server resource usage, unknown user accounts, sudden traffic drops, Search Console security alerts, strange server files, suspicious redirects, email blacklisting, and hosting malware alerts.
The best defense is keeping your CMS and plugins updated, using strong passwords with 2FA, and choosing hosting with built-in malware protection.