How do I know if my website was hacked?
Most hacked small business sites do not look hacked to the owner. Attackers often show spam only to Google, redirect only phone visitors, or quietly add an admin account. These seven signs take about 15 minutes to check. An outside check cannot prove a site is clean, so use both.
Seven signs your website was hacked
1. Google shows pages you never made. Search Google for site:yourbusiness.com (your real address, no spaces) and scroll a few pages. Casino, pill, fake-shoe or foreign-language pages you did not write are a strong sign. This is one of the most common.
2. Your site sends people somewhere else. Open your site on your phone, from a Google search rather than a bookmark. Attackers often redirect only phone visitors, or only people arriving from Google, so the owner never sees it.
3. An admin user you did not create. In WordPress, open Users and sort by role. Any Administrator you do not recognise is a red flag.
4. Google or your browser warns visitors. "This site may be hacked" under your listing, or a red "Deceptive site ahead" page. Sign up for free Google Search Console and check Security issues. Google will email you next time.
5. Your host suspends you or emails about malware or abuse. Hosts scan for this. Do not ignore those emails.
6. Customers get spam that appears to come from you. Your email, or your site's contact form, may be abused.
7. Things changed that you did not change. New plugins, changed prices, a new popup, or the site suddenly running slow.
Things that look scary but are not a hack
- "Not secure" in the address bar. That means the padlock (SSL certificate) is missing or broken. See Why does my website say "Not secure"?
- Contact form spam. Annoying, usually bots finding the form. Turn on the form's spam filter.
- A news story about a flaw. "There is a flaw" is not the same as "you were hacked." If you run WordPress on a hosting plan, ask your host whether your server software is up to date.
I think I was hacked. What now?
- Do not delete everything in a panic. You may need the evidence to find how they got in.
- Change every password: hosting, website admin, email and domain account. Turn on two-step login.
- Call your host. Ask for a clean backup from before the problem and whether they offer cleanup.
- Remove unknown admins and plugins you did not add.
- Update everything (WordPress, theme, plugins) and delete what you do not use.
- Ask Google to re-check in Search Console once the site is clean.
If you sell online, consider pausing orders until it is fixed, and tell customers who may be affected.
Making it less likely next time
- One named person owns updates.
- Auto-updates are on for plugins you keep.
- You have a backup you have actually tried restoring.
- Hosting, site admin and email use separate passwords.
- Google Search Console is on, so Google can warn you first.
How DeployVet fits
A DeployVet check looks at your live site from the outside: HTTPS, files that should not be public, exposed keys, security headers and broken pages. It cannot look inside your server, find a past hack or hidden malware, or replace a security professional. If you suspect a hack, start with your host.
FAQ
Can I tell if my website was hacked just by looking at it?
Often not. Attackers hide spam from logged-in owners. Use a Google site: search and check from your phone.
Does "Not secure" mean I was hacked?
No. It means the padlock (SSL certificate) is missing or broken.
Can DeployVet tell me if I was hacked?
No. It checks what is visible from the outside and helps you close common open doors. For a suspected hack, start with your host.
Do Wix, Squarespace and Shopify sites get hacked?
Server-level attacks are much less likely, because the company runs the server. Your account password is still the main risk, so turn on two-step login.
Check your site for free
DeployVet checks your live site from the outside, like a stranger would. You get a score out of 100 and the most important finding with a fix.
DeployVet has three plans. The Free check is $0. A one-time Scan is $7. The Fix it pack is $10 once and adds 30 days of "Did I fix it?" re-checks and score history. For paid plans you pay first, then the scan runs.
DeployVet is an outside-in check, not an audit, a penetration test or a certification. It sees only what a stranger can reach from the public internet, and a clean result is not a guarantee. Only check sites you own or have permission to check. See the methodology for what is and is not checked.