How to Tell If Your Website Has Been Hacked

Most hacked websites look perfectly normal. That is by design. Attackers who make a visible mess get discovered quickly. The smarter approach is to use your site quietly without your knowing.

Here is how to check whether your site has been compromised. This checklist takes about fifteen minutes and requires no technical background.

What does a hacked site actually look like?

Often it looks like nothing has changed. That is the first thing to understand.

Attackers who want to use your site for spam do not want you to notice. Attackers who want to redirect traffic to other sites wait until they have what they need. The damage you can see, a defaced homepage or error messages, is actually less common than the damage you cannot see.

Roughly 13,000 WordPress sites are hacked every day. The majority of those owners do not know it for days, weeks, or months.

How to check your site right now

Run a Google search for your own site. Type this in the search box: site:yourdomain.com. Look at every result. Do any pages appear that you did not create? Pages with strange titles, foreign language text, or topics that have nothing to do with your business? Those are spam pages that attackers injected to use your site’s ranking.

Open Google Search Console. This is the free tool Google provides to website owners. Sign in and look at the Security Issues section. Google actively flags sites serving malware or running phishing content. If you have a flag here, it is serious.

Check your browser. Visit your own site using a browser where you are not logged in, ideally on a different device or in a private window. Does it redirect you somewhere else? Does your browser show a security warning? Redirects to unrelated sites are a clear sign of compromise.

Look at your admin users. Log into your WordPress dashboard and go to Users. Are there accounts you did not create? Attackers often add admin accounts so they can return later even if you change your password.

Check your outbound email reputation. Your site may be sending spam without you realizing it. Visit MXToolbox.com and enter your domain name to see if it is on any email blacklists.

Listen to your customers. If anyone contacts you saying your site redirected them somewhere strange, or that your emails are landing in spam, take it seriously. These are often the first reports owners hear.

What you can do today

1. Run the Google site search right now. It takes two minutes and finds injected spam pages instantly.
2. Sign into Google Search Console and check the Security Issues section.
3. Visit your site in a private browser window and confirm it loads normally.
4. Log into your WordPress dashboard and review your list of admin users.
5. Check your domain on MXToolbox to see if your email is blacklisted.

Why this keeps happening

In 2025, researchers logged 11,334 new WordPress security holes. Most attacks are automated. Bots scan millions of sites looking for known vulnerabilities. When they find one, they act immediately, often within hours of the vulnerability being published.

Your site does not need to be famous or handle sensitive data to be targeted. Attackers want computing resources, not your customer list. A small local business website is just as useful as a large one for sending spam or storing files.

If you found something in this checklist, start with what to do after a WordPress site is hacked. If you want to understand why your site ended up in this position, the plugin ecosystem is the root cause.

Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free.

Find out what is wrong in 60 seconds

Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.