Signs your website has been compromised, and what each one means

The short answer

A compromised website looks completely normal to its owner. That is by design: attackers hide injected pages and redirects from logged-in users and often from visitors in the site’s own country, while search engines and visitors elsewhere see pharmacy spam, gambling pages or a redirect to somewhere else. The signals that give a compromise away are mostly external, and they are easy to check once you know to look.

Below are the eleven signs, what each usually means, and what to do the moment one is confirmed.

The eleven signs

Sign	What it usually means
Search results under your domain you do not recognise: foreign language, products you do not sell	Injected spam pages, often thousands, visible only to search engines
A browser warning: “deceptive site” or “this site may be hacked”	Search engines or browser vendors have already detected malware or phishing on the site
Visitors report being redirected, but you see nothing	Conditional redirect targeting mobile, foreign or non-logged-in visitors
Your emails start bouncing or landing in spam, or the domain appears on a blocklist	The server or a script is sending spam, or a phishing page is hosted on your domain
An admin user you did not create	Direct evidence of access; the account is a way back in
Files changed or added when nobody deployed anything	A backdoor, a web shell or injected code; the date shows when
The site suddenly slow or the server busy for no reason	Crypto-mining scripts, spam sending or the site being used to attack others
New plugins, themes or scheduled tasks you did not add	Persistence mechanisms left by the attacker
Traffic from search drops sharply	Search engines have demoted or delisted the site for spam or malware
Ads, pop-ups or content on the site that is not yours	Injected JavaScript, sometimes only for some visitors
Hosting or registrar notices about abuse, or an unexpected password reset email	Someone else is operating your accounts

How to check as a stranger

What to do once a sign is confirmed

Contain first: take the site offline or put a holding page in front, so visitors are not exposed and the site stops sending spam. Preserve evidence: logs, a copy of the compromised files, the date range. Restore from a known clean build and a backup from before the compromise, not from the infected state. Rotate every credential the site touches: admin, hosting, database, registrar, API keys, email. Then find the entry point, usually an outdated component or a reused password, and close it. The first hour guide in this hub walks through the sequence.

What this means for you

Do the stranger check this week: search your domain, open the site on mobile data, look at the search console, list the admin users. If everything is clean, set up the four early-warning signals so it stays that way. If you find a sign, do not tidy; contain, restore clean, rotate everything, close the door. A compromise noticed in an hour is an incident. One noticed after six months of quiet spam is a lost reputation with search engines and customers alike.