Five Signs Your Website May Have Been Hacked
Website compromises aren't always dramatic.
Sometimes there's no giant skull appearing on the homepage announcing that you've been hacked.
Attackers often prefer that you don't notice them.
1. Strange Search Results
Search for your own domain.
If Google suddenly shows pages advertising pharmaceuticals, gambling, counterfeit products, or other things you've never published, investigate.
Attackers sometimes create hidden pages specifically for search engines.
2. Unexpected Redirects
If visitors occasionally get sent to another site—especially only on mobile or only after arriving from Google—that's suspicious.
Conditional redirects are sometimes used specifically to make infections difficult for site owners to reproduce.
3. Unknown Administrator Accounts
Check the administrative users in your CMS.
If you don't recognize an administrator, don't simply delete the account and assume the problem is solved.
You need to figure out how it got there.
4. Modified Files
Unexpected PHP files, recently modified core files, strange JavaScript, or obfuscated code can indicate compromise.
Comparing files against known-good versions can help identify changes.
5. Your Hosting Provider Complains
Warnings about unusual CPU usage, outgoing email, malware, or suspended services shouldn't be ignored.
A compromised website may be sending spam or attacking other systems without visibly affecting your homepage.
What Should You Do?
- Preserve information that may help determine what happened.
- Change important credentials.
- Identify and remove malicious files or code.
- Update vulnerable software.
- Review administrator accounts.
- Check server and website logs when available.
- Restore clean files when appropriate.
- Verify that the vulnerability used to gain access has actually been fixed.
Simply deleting the obvious malware isn't enough.
If the door the attacker originally used is still open, they'll probably be back.