How Do You Notice Your Site Has Been Hacked? Common Signs, and the Monitoring to Set Up in Advance

A hacked site can look exactly the same to its owner. Some attacks show different pages only to visitors arriving from search, or only to Google, and Google’s own developer guide notes that the owner sees either a normal page or a “not found” (web.dev). You can open your site every day and still miss it.

This article covers the signs that most often lead people to notice a compromise, and the monitoring to set up in advance so you notice sooner. It is the second of four articles on website security basics. If you do notice something, please don’t rush to delete files; what to do first is in the third article, what to do in the first 24 hours after a hack.

How people notice

The clearest sign is a warning from Google. Search results show “This site may be hacked” when Google detects altered pages or added spam pages, and the label stays until the owner fixes the site, requests a review and Google confirms it (Google). A red warning screen in the browser means Google has judged that the site contains malware or deceptive pages. Search Console’s Security issues report lists three kinds of problems, hacked content, malware and social engineering (deceptive pages), with sample URLs, though the samples may not cover every affected page (Search Console Help).

Sometimes people tell you before Google does. When a customer says they were “sent to some weird site,” the site is often redirecting only visitors from search or from phones. When your hosting company contacts you about heavy load or spam being sent, the server is being used for attacks or spam. A call from a card company or payment provider can mean the checkout page has been altered and card details are being stolen as people type them.

You may also notice an admin or a plugin in the admin screen that you don’t recognize. Treat it as a door the attacker left open to get back in.

Finding pages the owner can’t see

To look for yourself, start by searching Google for “site:yourdomain” and going through a few pages of results for anything unfamiliar. If nothing turns up, try another search engine too. Search Console’s URL Inspection lets you compare the page Google sees with the page you see, which reveals content shown only to search (web.dev).

When a customer reports being redirected, opening the site directly in a desktop browser isn’t enough. Open it on a phone, from a search result. The redirect may not happen for the owner’s own visits.

Monitoring to set up in advance

The first thing to do is register with Search Console. Google’s findings show up in its reports, and notices about review results or being treated as a repeat offender go to the registered email address (Search Console Help, Google). It is also the only place to request a review to remove a warning. Register it with an account the company controls, not a staff member’s personal one. When that person leaves, nobody knows where the notices are going.

Next is uptime monitoring, a service that opens your site from outside at regular intervals to see whether it is down. Free options exist. If you set it to check that a specific phrase is on the page, not just that the page loads, you’ll also notice when the home page has been altered.

File change detection works well too. On WordPress, security plugins can flag files that differ from the official core and plugin files. This site keeps its master copy of every file in a system called Git and publishes only from there, so if anyone alters a file on the server, the next publish puts it back. For sites without a CMS, this is the most reliable setup.

Logs are the part people overlook. After a compromise, the access log is what tells you when and how the attacker got in, yet shared hosting often keeps logs only briefly or doesn’t keep them by default. Check now where your access and error logs are, how many days they cover, and whether admin logins are recorded. Without logs you can’t explain afterward what happened, and that is exactly where reporting to the authorities gets hard if personal data may have leaked.

One more thing: on top of two-factor authentication, set up an email alert whenever an admin logs in, so you notice an unfamiliar login right away. On WordPress, a security plugin can do this as well.

A human look once a month

Even with monitoring in place, have a person look once a month. Check Search Console’s Security issues report and the “site:yourdomain” results, look over the admin screen’s users and plugins for anything unfamiliar, and confirm that updates haven’t stalled.

The string of unauthorized access to member systems in Japan, and the methods JPCERT/CC described, is covered separately. If you need help setting up monitoring or checking logs, contact us.