A hacked website rarely announces itself with a skull and crossbones. More often it’s subtle: a customer mentions a weird redirect, your traffic quietly drops, or Google starts showing a warning next to your listing. By the time most small business owners notice, the damage has been building for weeks. Knowing the signs your website has been hacked — and acting fast — is the difference between a quick clean-up and a drawn-out mess that costs you customers and rankings.
This guide walks through the five most common warning signs, what each one actually means, and the steps to take if you spot them. It’s written for Australian small business owners, not security engineers, so there’s no jargon you’ll need to look up.
The signs your website has been hacked, at a glance
Before we dig into each one, here’s the shortlist. The clearest signs your website has been hacked are unexpected redirects or pop-ups, browser and Google security warnings, sudden swings in traffic, changes to your site you didn’t make, and alerts from your host or customers. We’ll take each in turn.
1. Unexpected redirects, pop-ups or content you didn’t add
This is the classic tell. You (or a customer) click through to your site and get bounced to a dodgy page selling counterfeit goods, pharmaceuticals or gambling. Or pop-ups appear that you never set up. Sometimes the redirect only triggers on mobile, or only for visitors coming from Google — which is why you might not see it yourself while everything looks normal on your own screen.
Attackers inject this code to hijack your traffic and send it somewhere they profit from. If anyone reports being redirected, or you spot links, banners or pages on your site that you didn’t create, treat it as a compromise until proven otherwise. Try loading your site on your phone, and from an incognito window via a Google search, to see what visitors actually experience.
2. Google or your browser flags your site as unsafe
If Google detects malware or deceptive behaviour on your site, it acts quickly and visibly. You might see a red “Deceptive site ahead” or “This site may be hacked” warning in the search results, or the browser may block the page entirely before it loads. Chrome, Firefox and Safari all pull this data from Google’s Safe Browsing system.
This is one of the most damaging signs precisely because it’s so public — potential customers see it before they ever reach you. Check whether your site has been flagged using Google’s own tools; the Security Issues report in Google Search Central will tell you if Google has detected a problem and roughly where. A flag here means the hack is already affecting real visitors, so it needs urgent attention.
3. A sudden, unexplained drop in traffic
A sharp fall in visitors with no obvious cause is a red flag worth investigating. When a site is hacked, traffic can collapse for several reasons: Google may have de-indexed pages it now considers unsafe, browser warnings are scaring people off, or the injected spam is dragging your rankings down.
The opposite can also happen — a strange spike in traffic to pages that don’t exist, or a flood of visits from countries you don’t serve, often points to spam pages the attacker has created on your domain. Either pattern is worth a closer look. If your analytics show a change you can’t explain, don’t just assume it’s a quiet week. Cross-check it against the other signs here before you rule out a hack.
4. New admin users, files or changes you didn’t make
Attackers who get in usually want to stay in. A common move is to create a new administrator account so they keep access even after you change your password. Log into your site’s dashboard and review the user list — if there’s an admin account you don’t recognise, that’s a serious warning sign.
Other tells include files with odd names appearing in your site’s folders, your homepage or key pages being altered, content or settings changing on their own, or your site suddenly running much slower because it’s busy sending spam or mining in the background. On a WordPress site in particular, unfamiliar files and unexpected admin users are two of the clearest indicators something is wrong. If you have website security services monitoring your site, these changes get flagged automatically rather than sitting unnoticed.
5. Your host, customers or spam filters raise the alarm
Sometimes the first warning comes from outside. Your hosting provider may email to say they’ve detected malware or suspicious activity — and in serious cases they’ll suspend your site to stop it harming others, taking you offline without notice. Email providers might start bouncing messages from your domain, or your address may land on a spam blacklist because the attacker is using your server to send junk mail.
Customers can be your early-warning system too. If someone mentions your site “looks weird”, threw a warning, or sent them somewhere strange, take it seriously even if it looks fine to you — remember, many hacks are designed to hide from the site owner. A single credible report is worth investigating properly.
What to do if you spot these signs
Finding one or more of these signs is stressful, but panic leads to mistakes. Work through it methodically instead.
- Confirm it’s real. Load the site on mobile and via a Google search in an incognito window. Check Search Console’s Security Issues report and your user list for unknown admins.
- Take the site offline or into maintenance mode if the hack is actively harming visitors, so no more customers are exposed while you fix it.
- Change every password — hosting, dashboard, database, FTP and email — and remove any admin accounts you don’t recognise.
- Restore from a clean backup from before the compromise if you have one. This is exactly why daily, off-server backups matter so much; they turn a disaster into an inconvenience.
- Remove the malware and patch the hole. The site got in through something — usually an outdated plugin, theme or weak password. Cleaning the infection without closing that door just invites them back.
- Ask Google for a review once you’re clean, so any warnings and de-indexing are lifted and your traffic can recover.
If that feels beyond your comfort zone, it’s a job worth handing to someone. A messy clean-up done wrong often leaves a back door open, and the site gets re-infected within days.
How to avoid getting hacked in the first place
Prevention is far cheaper than recovery. The overwhelming majority of small business hacks come through known, avoidable gaps. Keep your platform, plugins and themes updated promptly — outdated software is the number-one way in. Use strong, unique passwords with two-factor authentication on every admin account. Run automated daily backups stored off your server, and put a firewall or security service such as Cloudflare in front of your site.
Good habits here also protect the money you’re putting into Google Ads and organic SEO — none of that traffic converts if it lands on a flagged or defaced site. Pairing sensible security with a regular website care plan keeps most threats out entirely.
The bottom line
The most dangerous thing about a hacked website is how quietly it can happen. Watch for the five signs — unexpected redirects, browser or Google warnings, strange traffic swings, changes you didn’t make, and alerts from your host or customers — and act the moment one appears. If you catch it early, restore a clean backup, close the gap and request a review, most sites bounce back fully. Left alone, a small compromise can cost you rankings, customers and trust that takes far longer to rebuild.
Not sure whether your site is clean right now? A quick security check will tell you where you stand — and our Gold Coast web design team can help you lock things down properly.
FAQs
How do I know if my website has been hacked?
Common signs your website has been hacked include unexpected redirects or pop-ups, a “deceptive site” or “this site may be hacked” warning in Google or your browser, a sudden unexplained drop or spike in traffic, unfamiliar admin accounts or files, and alerts from your hosting provider. If you notice any of these, check your site on mobile and via an incognito Google search, and review Search Console’s Security Issues report.
Can a small business website really be a target?
Yes. Most website hacks aren’t personal — they’re automated bots scanning millions of sites for known weaknesses like outdated plugins or weak passwords. Small business sites are targeted constantly precisely because they’re often less protected than large ones. Attackers use them to send spam, host scams, redirect traffic or mine cryptocurrency, all without needing any specific reason to choose you.
What should I do first if my website is hacked?
First, confirm the hack by checking your site on mobile, via a Google search, and in Search Console. Then change all your passwords (hosting, dashboard, database and email) and remove any admin accounts you don’t recognise. If the site is actively harming visitors, put it into maintenance mode. Restore from a clean backup taken before the compromise, remove the malware, and patch whatever let them in.
Will a hacked website hurt my Google rankings?
Yes, often significantly. Google may flag your site as unsafe, add warnings to your search listing, or de-index infected pages entirely, which causes traffic to fall sharply. Injected spam content can also drag your rankings down. Recovery is possible once the site is fully cleaned and you request a review through Search Console, but rankings can take time to return, so acting quickly limits the damage.
How can I stop my website being hacked?
Keep your platform, plugins and themes updated promptly, since outdated software is the leading cause of hacks. Use strong, unique passwords with two-factor authentication on all admin accounts, run automated daily backups stored off your server, and put a firewall or security service in front of your site. Regular maintenance and monitoring catch problems early, before they turn into a full compromise.
