How to Tell If Your Website Is Hacked: 6 Checks You Can Run Today
Rescue · Free guide
How to tell if your website is hacked: six checks you can run this afternoon.
A hacked website rarely looks hacked to its owner. These six checks take about twenty minutes, need no technical skill, and show you what Google sees instead of what you see.
Site down, redirecting, or showing pages you never wrote? Skip the guide and call (754) 302-4631.
The short answer
Search site:yourdomain.com on Google and compare the page count with the number of pages you know you have. Then search site:yourdomain.com casino. Then check every administrator account, your Search Console traffic over 12 months, what Googlebot gets from your homepage, and when each plugin was last updated.
If any of those turns up something you can’t explain, don’t delete anything yet. Call.
Why looking isn’t enough
Your website has two audiences. You only ever see one.
When you type your own domain, you see the site your browser shows a logged-in administrator on a familiar device. Search engines can be shown something different: different pages for different visitors, redirects that only fire for people arriving from Google, and content that appears for a crawler and vanishes for you.
That’s deliberate. A competent attacker isn’t trying to break your website. He needs it up, fast, indexed and trusted, because he’s borrowing the reputation you spent years building to rank pages he could never rank on a domain of his own. Breaking it would destroy the only thing he came for.
So the symptom isn’t a broken site. The symptom is silence. Enquiries thin out. Rankings for your real services slide. Someone mentions they couldn’t find you, and you assume they typed it wrong.
This happened to me. In 2024 my own site was taken over by a spammer who built tens of thousands of hidden pages underneath it: casinos, pharmaceuticals, mail-order brides. My homepage looked exactly the way it always had. I found out from the silence, not from an alert. The full account is on the story page.
What you’re looking for
The four moves of a silent compromise.
Nearly every injection I’ve cleaned up follows the same shape. Each of the six checks below is aimed at one of these moves.
The way in.
An outdated plugin, an abandoned theme, a reused password, or a stale administrator account belonging to a developer who left years ago. Rarely anything clever.
Persistence.
Before anything visible, the attacker makes sure he can get back in: a second admin user, a backdoor in a theme file, a scheduled task that recreates both if you delete them.
Publication.
Thousands of pages appear, usually served only to search engines and to visitors arriving from search. Log in as yourself and the site is spotless.
The slide.
Search engines decide your domain is now mostly about casinos. Your real rankings decay slowly enough that every week looks like normal variance.
Do this yourself
Six checks. About twenty minutes.
None of this needs me. Do them in order, write down what you find, and don’t change anything while you’re looking. Replace yourdomain.com with your own domain.
-
Check 1 · Two minutes
Search site:yourdomain.com on Google.
How: type
site:yourdomain.cominto Google, with no space after the colon, and press Enter. Google shows roughly how many pages it holds for your domain.What it means: read the page count. If you believe your site has 30 pages and Google shows thousands, something has been added that you didn’t write. Click through the results, page after page, until you find a title you don’t recognise.
Worry if: the count is wildly bigger than your real page count, or you find titles in languages you don’t publish in.
-
Check 2 · Ten seconds each
Search site:yourdomain.com casino, then viagra, then payday.
How: run
site:yourdomain.com casino, then the same withviagra, thenpayday. Then try any word that has nothing to do with your business.What it means: this is the single fastest check there is. Spam pages are built to rank for exactly these words, so if they’re on your domain, these searches surface them.
Worry if: any result appears that you didn’t write. One is enough. Take a screenshot.
-
Check 3 · Five minutes
Open Users in your admin panel and read every account.
How: log in to your website’s admin area (on WordPress, it’s the Users menu) and filter by Administrator. Read every name and email address.
What it means: every administrator should be a person you can name. An account you don’t recognise is how an attacker gets back in after a clean-up. An old account for an agency that stopped working for you years ago is an open door.
Worry if: there’s an administrator you can’t name. Don’t delete it yet; write it down and call. A former agency you can name is a housekeeping job once you’re sure nothing else is wrong.
-
Check 4 · Five minutes
Look at Google Search Console → Performance, set to 12 months.
How: open Google Search Console, choose your site, open Performance, and set the date range to the last 12 months. Look at the chart, then the list of queries underneath it.
What it means: you’re looking for two things. Queries you don’t recognise, such as gambling or pharmacy terms, mean Google is showing pages you didn’t write. A decline that started abruptly, rather than gradually, points to something that happened on a particular day.
Worry if: you see strange queries, or clicks fell off a cliff. If Search Console isn’t set up for your site, that’s worth fixing anyway: it’s free and it’s where Google tells you about problems.
-
Check 5 · Five minutes
Fetch your own homepage as Googlebot.
How: in Search Console, open URL Inspection, paste your homepage address, then click Test Live URL and view the tested page. Compare what Google got with what your browser shows you.
What it means: a difference between those two is the whole game. Hidden spam is often served only to Google’s crawler, so this is the one check that shows you the version of your site you never see.
Worry if: the page Google received has links, text or redirects that aren’t on the page you see.
-
Check 6 · Five minutes
Check when each plugin was last updated by its developer.
How: list the plugins installed on your site. For each one, look up its page in the plugin directory and find “Last updated”. That’s the date the developer last released a version, not the date you last clicked update.
What it means: anything abandoned for over a year is an unlocked door, whether or not anyone has used it yet. Patchstack’s State of WordPress Security in 2026 recorded 11,334 new vulnerabilities across the WordPress ecosystem in 2025, and 91% of them were in plugins rather than WordPress itself.
Worry if: a plugin hasn’t been updated by its developer in over a year, or has been removed from the directory.
Want a head start?
The free Site Check runs the outside checks for you in about 20 seconds.
It compares your homepage as a browser, as Googlebot and as a visitor from Google, looks for spam words in your homepage and sitemap, and shows when your visible plugins were last updated. It gives you the links for the searches and Search Console steps it can’t run for you.
If something looks wrong
Don’t delete anything yet. Call (754) 302-4631.
The instinct is to start deleting the strange pages and the strange user. Don’t. Deleting before you understand how someone keeps getting back in is how people spend the next month cleaning the same site four times. A second administrator account, a backdoor in a theme file or a scheduled task can put everything back. A surface clean-up that “fails” a fortnight later almost always means the door was never shut.
Write it down.
Take screenshots of what you found and note the date and time.
Leave things where they are.
Don’t delete pages, users or plugins, even the ones that look wrong. They are evidence.
Hold off on restoring.
Don’t restore an old backup over the site yet. The backup may carry the same problem.
Call or text.
Describe what you saw. You’ll get a straight answer on what it probably means before anything is touched.
Call now, don’t book, if:
- Your site is down, or showing an error instead of your homepage.
- Your site redirects somewhere you didn’t choose.
- Google is showing pages on your domain you never wrote: casino, pharmacy, or anything in a language you don’t publish in.
- Google Search Console has flagged your site, or a browser is warning visitors away from it.
- You’ve found an administrator account that isn’t a person you can name.
If everything came back clean
Real peace of mind, not assumed peace of mind.
Every owner I meet has the same reasonable and completely wrong instinct I had: my site looks fine, therefore my site is fine. If the six checks come back clean, you’ve spent twenty minutes and replaced that assumption with evidence.
Clean today isn’t clean forever. The number of ways in keeps climbing, and nobody finds these things quickly: IBM’s Cost of a Data Breach Report 2025 puts the average breach lifecycle at 241 days, 181 of them to identify it. That’s enterprise data, from organisations with security teams. A small business with no monitoring should expect longer, not shorter. Run the checks again every few months, and every time the phone goes unusually quiet.
If you want it handled
The Site Rescue: find it, fix it, get back online.
- $997, fixed, quoted up front. No hourly billing.
- I find what’s wrong and fix what’s causing the damage: malware, rogue accounts, the entry point.
- A full backup before any change, and every change logged.
- A written report: what was found, what was fixed, what is left.
- If your site turns out to be fine, it is the same $997 and you get the straight answer.
$997fixed
Frequently asked questions
Straight answers.
How can I tell if my website has been hacked?
Search site:yourdomain.com on Google and compare the page count with the pages you know you have, then search site:yourdomain.com casino, viagra and payday. Check every administrator account, look at 12 months of Search Console performance for strange queries or a sudden drop, compare what Googlebot gets from your homepage with what you see, and check when each plugin was last updated by its developer. Together that takes about twenty minutes.
My website looks normal. Can it still be hacked?
Yes. A competent attacker needs your site up, fast and trusted, so he can borrow its reputation. The spam is usually served only to search engines and to visitors arriving from search. Logged in as yourself, the site can look spotless. The usual symptom is silence: fewer enquiries and slipping rankings.
I found pages or a user I don’t recognise. Should I delete them?
Not yet. Take screenshots, note the date and time, and call (754) 302-4631. Attackers usually leave a way back in, such as a second admin account, a backdoor in a theme file or a scheduled task. Deleting before you find it is how people end up cleaning the same site several times.
Should I restore a backup?
Hold off. A backup may carry the same problem, and restoring over the site can destroy the evidence of how the attacker got in. Get the entry point found first.
Is there a free tool that does these checks for me?
The free Site Check at sosstevie.com/site-check/ runs the outside checks in about 20 seconds: your homepage as a browser, as Googlebot and as a visitor from Google, spam words in your homepage and sitemap, and plugin update dates. It gives you links for the searches and Search Console steps it can’t run. A green result is good news, not a guarantee.
What does the Site Rescue cost?
$997, fixed and quoted up front, with no hourly billing. It includes a full backup before any change, a log of every change, and a written report of what was found, what was fixed and what is left. If your site turns out to be fine, it is the same $997 and you get the straight answer.
My site is down or redirecting right now. What do I do?
Don’t book anything and don’t fill in a form. Call (754) 302-4631. Outside Monday to Friday, 9 to 6 Eastern, text the same number. In an emergency, diagnosis and containment happen at the same time.
Next step
Found something you can’t explain?
That’s a call. Describe what you saw, and don’t delete anything first. If it turns out you need the Site Rescue, it is $997, fixed.
Call Monday to Friday, 9 to 6 Eastern. Outside those hours, text the same number; I’ll see it first thing the next business morning.