TL;DR:

  • The most common signs of a hacked website are: Google showing a “this site may be hacked” warning, unusual content appearing (ads, links, foreign-language pages), redirects to other sites, or your hosting company suspending your account
  • First priority is containing the damage: take the site offline or into maintenance mode, change all passwords, and scan with a malware scanner before anything else
  • Most small business website hacks are automated, opportunistic attacks targeting known CMS vulnerabilities — they’re fixable, and the cleanup process is the same regardless of how technical you are

Discovering your website has been compromised is alarming. But most small business website hacks are not targeted attacks — they’re automated bots scanning for known vulnerabilities in WordPress installations, outdated plugins, or weak passwords. The damage is real (spam, redirects, blacklisting) but it’s also fixable, and the recovery process follows a predictable pattern.

How to Tell If Your Site Has Been Hacked

Sometimes it’s obvious. More often, you won’t know until a customer tells you, a Google warning appears, or your hosting company contacts you. Common signs:

Google Search warning. Search for your business name on Google. If results show “This site may be hacked” or “This site may harm your computer” beneath your listing, Google has already detected malware. This damages your reputation with customers and can severely reduce your search traffic.

Unexpected redirects. Visitors who click links to your site end up on a different site entirely — often a gambling site, pharmacy spam, or a page in another language. The redirect often only affects visitors coming from Google (not you when you visit directly), which is why you might not notice it yourself.

Strange pages or links appearing. Logging into your website admin shows pages you didn’t create, often with pharmaceutical keywords, casino content, or links to external sites. This is “SEO spam” — attackers use your site’s authority to improve rankings for their own pages.

Your hosting company suspends you. Shared hosting providers actively scan for malware and often suspend accounts when they detect it, sending you an email. This is actually useful — they’ve identified the problem.

Your browser shows a warning. Chrome, Firefox, and Edge all display interstitial warnings for sites on Google’s Safe Browsing blocklist. If visitors see this, they almost certainly won’t proceed.

Customers report unusual behaviour. Pop-ups, phishing pages that look like yours, or requests for payment information on pages that shouldn’t have payment forms.

Immediate Steps: The First Hour

1. Don’t panic and don’t immediately delete things. You need to understand what happened before you clean up. Deleting infected files before you’ve documented what was changed means you lose the ability to understand the attack vector — which matters because if you don’t know how they got in, they can get back in.

2. Take the site offline or into maintenance mode. Your goal is to stop visitors being harmed while you clean up. In WordPress, you can enable maintenance mode via your admin panel. If you can’t access admin, contact your hosting company — they can usually put an account on hold without deleting anything. Some hosts do this automatically when they detect malware.

3. Change all passwords immediately. Change: your website admin password, your hosting control panel password, your FTP/SFTP credentials, and any database passwords if you have separate access. Do this before you start cleanup — if attackers have credentials, cleaning the site without changing passwords means they can simply re-infect it.

4. Enable two-factor authentication on your hosting and admin accounts. If your hosting provider and CMS support 2FA, enable it now. Many WordPress sites are compromised through brute-force attacks on admin passwords — 2FA stops this class of attack cold.

5. Notify your hosting company. Even if your site is still up, contact them. They can often identify the entry point, check other sites on your hosting account (shared hosts are sometimes completely compromised), and assist with cleanup. They’ve dealt with this before.

Scanning and Identifying the Problem

Before cleaning up, you need to know what’s infected. Scanning tools:

Sucuri SiteCheck (free, at sitecheck.sucuri.net): paste your URL and it runs an external scan, checking your site against blacklists and identifying obvious malware in publicly accessible pages. It won’t catch everything hidden in your server files, but it’s a quick first check.

WordFence (for WordPress, free tier available): a plugin that scans your WordPress installation for modified core files, infected plugins, and malicious code. It compares your files against known-good versions and flags differences. Install it, run the scan, and work through the results.

Maldet / ClamAV (for those with server access): command-line scanners that can check all files on a server. If your hosting company provides SSH access, these run more thorough scans than plugin-based tools.

Your hosting company’s scanner: many shared hosts (cPanel-based hosts, SiteGround, Kinsta, WP Engine) have built-in malware scanners in their control panels. Check if yours has one before installing third-party tools.

Cleaning Up

If you have a recent clean backup, this is usually the fastest recovery path:

  1. Verify the backup is from before the infection (check the date; compare file hashes if you can)
  2. Restore the backup to a staging environment if possible, or directly to the live site
  3. Change passwords again after restore (the backup may contain old credentials)
  4. Update all software, plugins, and themes before going back live
  5. Check for and remove any backdoors that may have been planted before your last backup

If you don’t have a clean backup, or the backup may itself be infected:

For WordPress sites, the manual cleanup process is:

  • Re-download and reinstall WordPress core files (overwrite them; don’t modify the wp-content folder during this step)
  • Check each plugin and theme against the official WordPress.org versions — if you downloaded plugins from unofficial sources, delete and reinstall from the official repository
  • Check the wp-content/uploads folder for PHP files (there shouldn’t be any — PHP in uploads is a malware red flag)
  • Check wp-config.php for anything added that shouldn’t be there
  • Check .htaccess for redirect rules you didn’t create
  • Review database content for injected links or spam content

For non-WordPress sites, the approach is similar: compare your files against known-good versions (from your repository if you have one, or from your last clean backup), identify modified files, review them for injected code, and restore clean versions.

Getting Off Blacklists

Once your site is cleaned, you need to request removal from blacklists:

Google Search Console: verify your site ownership (if not already done), use the “Security Issues” section to review what Google detected, and once cleaned, submit a review request. Google’s typical review time is a few days to a couple of weeks.

Other blacklists: Sucuri SiteCheck shows which specific blacklists you’re on. Most have similar review request processes. McAfee SiteAdvisor, Norton Safe Web, and Spamhaus all have removal request forms.

Google Ads (if applicable): if you run Google Ads and your site is blacklisted, your ads will be paused. Request a review through Google Ads support once the site is clean.

Preventing Recurrence

The vast majority of small business website hacks exploit one of three things: an outdated CMS or plugin with a known vulnerability, a weak or reused password, or a misconfigured hosting environment. Address these:

  • Auto-updates: enable automatic updates for WordPress core, plugins, and themes. The risk of a plugin update breaking something is much smaller than the risk of not patching known vulnerabilities.
  • Remove unused plugins and themes: every installed plugin is an attack surface, even if it’s inactive. Delete plugins you don’t use.
  • Strong, unique passwords on your admin account and hosting panel — use a password manager if you’re not already.
  • Limit login attempts: the Limit Login Attempts Reloaded plugin (or your host’s equivalent) blocks brute-force password attacks on your WordPress login.
  • Web Application Firewall (WAF): Cloudflare’s free tier, Sucuri’s WAF, or your host’s built-in WAF blocks many common attack patterns before they reach your site.
  • Regular backups to an offsite location: your hosting company’s backups are useful but not sufficient on their own. A plugin like UpdraftPlus can send daily backups to your Google Drive or Dropbox automatically.
  • Consider managed WordPress hosting: hosts like Kinsta, WP Engine, and SiteGround’s managed WordPress plans include daily malware scanning, automatic backups, and dedicated support for security incidents — the cost is higher than shared hosting but the security baseline is significantly better.

If you’re not technical and the cleanup feels overwhelming, Sucuri’s website cleaning service (paid) handles the process for you and includes a cleanup guarantee. Many web developers and agencies also offer emergency hack cleanup — it’s a common enough service that you should be able to find someone quickly.