How to tell if your website has been hacked and what to do next
Most website breaches are not announced by a dramatic defacement. Attackers prefer to stay hidden — quietly extracting data or using your server's resources while your site continues to operate normally.
Warning signs your website has been hacked
Your website is sending spam emails. Contacts report receiving unsolicited emails from your domain.
Google is showing warnings. If visitors see "This site may be harmful," Google has detected malicious content.
Your site is redirecting visitors. Visitors arriving from search engines being redirected to other sites — SEO spam or pharma hack.
New admin accounts you did not create. Check your CMS for unrecognised admin accounts.
Unexpected files on your server. Unfamiliar PHP files — often web shells allowing remote control.
Your site is slower than usual. Server resources being used for cryptocurrency mining or spam.
Customers reporting suspicious activity. Customer accounts accessed without their knowledge.
What to do if hacked
Take the site offline immediately. Contact your hosting provider. Assess what data was affected. Report to the ICO within 72 hours if personal data was affected. Change all passwords. Restore from a clean backup. Patch the vulnerability. Get a security test.
Yrzo AI runs 75+ automated checks and delivers a report in under 20 minutes to confirm vulnerabilities are fixed. Starting at £149.
Find out if your website has these vulnerabilities
Yrzo AI runs 44 automated security checks and delivers a full report in under 20 minutes. Starting from £149.
Scan your website →