How to know if your website has been hacked (and what to do)

43% of cyberattacks target small businesses. Most of these companies discover it too late: when a customer warns them, when Google flags them as dangerous or when their emails start landing in the spam folder. By then, the damage is already done.

The pattern repeats: small businesses with their site compromised for months, completely unaware. This article walks you through the 8 most common signs, what to do if you spot any of them, and what recovery really involves, both cleaning the code and getting back into search.

1. Why small businesses are the favourite target of hackers

When you think of a cyberattack, you imagine a hacker going after Google or a bank. The reality is far more practical: hackers go after the easiest websites. And the easiest websites belong to small businesses.

Three reasons:

The software is not maintained. 70% of hacked WordPress sites have outdated plugins. Every month new vulnerabilities are discovered in popular plugins; hackers exploit them before owners patch them.

There is no monitoring. A small business does not have a security team watching the website 24/7. It can run for months with malicious code injected and nobody notices. The average owner only checks their site 2 or 3 times a month.

Passwords are weak. “admin / 123456” is still one of the most common combinations. Hackers try thousands of combinations per minute with automated tools. A 6-character password breaks in less than a minute.

And the consequences are disproportionate: for a multinational, an attack is an inconvenience. For a small business, it can mean closing the doors.

2. The 8 signs your website has been hacked

Sign 1: Strange results when you search for your business on Google

Search Google for your domain in quotes (for example: site:yourbusiness.com). If you see pages with Japanese titles, content about pharmaceutical products, online casinos or keywords that have nothing to do with your business, your site is hacked.

This is the most common SEO attack: hackers inject hundreds of new pages into your site with spam content, leveraging your domain to rank products they want to sell.

Sign 2: Google Search Console reports security issues

If your site is verified in Google Search Console (and it should be), this is where you will see the first warnings. In the “Security issues” section, Google notifies you if it detects:

• Malware (malicious code that infects visitors)
• Unwanted or harmful software (extensions, suspicious downloads)
• Phishing (attempts to steal data)
• Hacked content (unauthorised changes on your site)

If you see any notification in this section, act immediately. Do not wait more than 24 hours.

Sign 3: Pop-ups you did not add

If you visit your site and pop-ups, strange ads, redirects to other websites or a fake counter saying “your computer is infected” suddenly appear, the site is compromised. Hackers have injected JavaScript code that runs in visitors’ browsers.

Important: these pop-ups may only appear in certain browsers or countries. Test the website in incognito mode and from another device.

Sign 4: Unknown admin accounts

If you use WordPress, go to Users > All Users and check for any admin accounts you do not recognise. Hackers often create accounts with technical-sounding names (wpadmin, support, admin1) to keep access even if you change your password.

Also check whether any users have recent creation dates that you do not remember creating.

Sign 5: New or modified files on the server

If you have FTP access or access to your hosting file manager, look for files with strange names: wp-x.php, wso.php, marvin.php, index2.php. These are typical names for “shells” (programs hackers use to control the website).

Also check modification dates. If you see WordPress files modified recently without you running any update, that is a red flag.

Sign 6: Sudden traffic drop in Google Analytics

If your website was getting 500 monthly visits and suddenly drops to 50, Google may have penalised you. The most common cause of such a drop is hacked content or malware that triggered a Google filter.

Also check whether the drop affects only certain pages: if Google detects malware in a specific section, it can deindex only that section.

Sign 7: The browser flags your website as dangerous

Visit your site with Chrome and Firefox. If you see a red screen with messages like “Deceptive site ahead” or “This site may harm your computer”, Google has already detected the attack and blocked the site from its users.

It is the worst-case scenario: at this point, 95% of potential traffic flees without ever seeing your content.

Sign 8: Your hosting notifies suspicious activity

Serious hosts monitor their servers. If they see your account sending spam, consuming excessive resources or making suspicious connections, they send you an email warning. Always read the emails from your hosting provider; many owners ignore them thinking they are marketing.

3. What to do if you find any of these signs

If you have spotted one of the 8 signs, follow this protocol in this exact order:

Step 1: DO NOT DELETE ANYTHING. Your first instinct will be to clean everything at once, but you can destroy valuable evidence about how the attack happened. Make a complete backup before touching anything.

Step 2: Put the site in maintenance mode. If your platform allows it, show a temporary “Be right back” page. This stops visitors from getting infected while you clean the site.

Step 3: Change every single password. All of them. WordPress, FTP, hosting panel, database, corporate email if it uses the same domain. Use 16+ character passwords generated by a manager like 1Password or Bitwarden.

Step 4: Scan the site with a specialised tool.

• Sucuri SiteCheck (free): scans your site and tells you if it detects malware, blacklisting or known vulnerabilities.
• Wordfence (for WordPress): scans every file on your site looking for malicious code.
• VirusTotal (free): checks whether your domain is on security blacklists.

Step 5: Restore a backup from before the infection. If you have backups (and you should), restore one from before the problems started. First check the exact date of the infection by looking at the modified files.

Step 6: Update all software. WordPress, plugins, themes, PHP, database. If there are plugins that are no longer maintained, delete them and look for actively maintained alternatives.

Step 7: Notify Google Search Console that the issue has been resolved. In the “Security issues” section, click “Request review” once you have cleaned the site. Google reviews the request within 24 to 72 hours.

Step 8: If you cannot fix it yourself, hire a professional. Companies like Sucuri, Wordfence or cybersecurity consultants do professional cleanups for between 200 and 500 EUR on the market. It is worth it: a hacked website loses customers every day it stays infected.

4. The other half of the job: recovering visibility

This is where most owners think they are done. They are not. Cleaning the malicious code and recovering your position in search are two different jobs, on two different timelines, and the second one is longer.

What is actually happening while the site is flagged

When Google classifies a site as compromised, three things happen at once. Browsers show the red warning screen, and the visitor leaves before seeing anything. The injected spam pages enter the index under your domain, and start competing with your real pages. And the legitimate pages the attacker modified lose their positions, because the content no longer matches the query.

That is why technical cleanup does not reverse the damage on its own: even if the malicious code disappears today, Google’s index keeps reflecting the infected site until it crawls you again.

The re-indexing process, step by step

1. Confirm the site is genuinely clean before requesting anything. If you request the review with malicious code still present, Google denies it and the next request takes longer. Scan twice, with two different tools, and manually check the most recently modified files.

2. Request the security review in Search Console. Under “Security issues”, explain in the form what happened, how you cleaned it and what you have done to stop it recurring. A concrete description resolves faster than a generic one. The response usually arrives within 24 to 72 hours. Once approved, the red browser warning disappears.

3. Remove the spam pages from the index. Injected URLs must return a 404 or 410 status, not a redirect to your homepage. Once they do, use the Search Console URL removal tool to hide them while Google recrawls. If there were hundreds, this is the part that takes the most work.

4. Review robots.txt and the sitemap. Attackers often modify both to hide their content or block crawling of your pages. Regenerate them from scratch and submit the updated sitemap.

5. Resubmit your important pages for indexing. Using Search Console’s URL inspection, request indexing for your main pages, one by one. Prioritise the ones that brought commercial traffic.

6. Watch the trend over the following weeks. Look at impressions and positions in Search Console, not just visits. Impressions recover before clicks, and they are the first sign that crawling has normalised.

Realistic timelines

There is no guaranteed figure, and anyone who gives you one cannot honour it. What can honestly be stated is the order of magnitude of each phase:

• Technical cleanup: hours to a few days, depending on the size of the site and whether a clean backup predating the infection exists.
• Browser warning removal: normally 24 to 72 hours once Google approves the review.
• Legitimate pages returning to the index: days or weeks, depending on how often Google crawls your domain.
• Position and traffic recovery: weeks, and longer on sites that had little authority to begin with. Some pages do not return exactly where they were.

Two things speed this up far more than anything else: having a clean, dated backup, and having caught the attack early. A site compromised for three days recovers very differently from one compromised for eight months.

While the recovery runs

Notify customers if the attack may have touched personal data: this is not optional, GDPR requires notifying the supervisory authority within 72 hours when there is a risk to the rights of the people affected. Also check that your domain’s email has not ended up on blacklists, because attackers frequently use it to send spam, and that affects your ability to reach the inbox long after the site itself is clean.

5. How to prevent it in the future

Recovering a hacked website is expensive and stressful. Preventing it is cheap and easy. These are the 5 basic measures:

1. Automatic updates. Enable automatic updates for WordPress core, plugins and themes. If you use another CMS, set weekly reminders to update manually.

2. Strong passwords and two-factor authentication (2FA). Never use “admin” or “123456”. Enable 2FA wherever possible (Google Authenticator, Authy).

3. Automatic and external backups. Backups must be daily and stored outside the server (Google Drive, Dropbox, AWS S3). A backup on the same server is useless if the server is compromised.

4. Server-level or application-level firewall. Cloudflare, Sucuri or Wordfence offer firewalls that block known attacks before they reach your site. Their free versions are already useful.

5. Reduce the attack surface. Every plugin you add is a potential entry point. Delete plugins you do not use. Delete themes you are not using. Less code = fewer vulnerabilities.

6. Why a static website cuts the attack surface so far down

At serpixel we do not use WordPress. The websites we build use Astro, a framework that generates static HTML at build time.

What does this mean for security?

No database. No SQL queries, no possible injection, no login to a database.

No PHP. The server does not execute any code when someone visits the site. It only sends pre-generated HTML files. No execution = no execution vulnerabilities.

No vulnerable third-party plugins. Every feature is built as our own code, reviewed and audited. We do not depend on hundreds of small plugins built by anonymous developers.

No public admin panel. In WordPress, anyone can try to log in at yourdomain.com/wp-admin. In Astro there is no admin panel: the website is generated from the code repository and published via Git. To attack the site, a hacker would have to compromise our GitHub repository and the Vercel deployment process.

CDN with built-in DDoS protection. Vercel includes denial-of-service protection, automatic blocking of malicious bots and constant monitoring.

No website is invulnerable, and anyone who claims otherwise is selling you smoke. What a static architecture does change is the surface: the attack vectors most commonly used against a small business (outdated plugin, exposed login, SQL injection) simply are not there.

The maintenance routines that stop you getting here

These are the checks we run on the websites we maintain, and that you can ask of any provider:

1. Update every dependency on the website and check for new vulnerabilities at npm advisories
2. Monitor server logs to detect suspicious behaviour
3. Verify with Sucuri SiteCheck that the domain has not landed on a blacklist
4. Check that Google Search Console shows no security issues
5. Keep the full history in Git, so every change is recorded and can be rolled back to a known clean state

That last point is what matters most on the bad day. If the whole website lives in a versioned code repository, the “clean backup from before the infection” is not a hope: it is a specific commit with a date on it.

If you suspect your website has a security problem, or you have already cleaned it and the rankings are not coming back, let’s talk it through in 30 minutes. We will go over what your Search Console is showing, where you are in the recovery, and what should happen next.