In shortA hack is not always obvious. Most attackers want to stay hidden as long as possible, so the signs are small: some visitors redirected, strange pages with your domain in Google, a new admin user, sudden slowness, or email leaving your account. If you notice any of these, check your site right away with the steps in this guide.
10 signs of a hack #
- Redirected visitors: Some visitors, especially from Google or on mobile, end up on another site.
- Strange results in Google: Search
site:yourdomainin Google. Pages in other languages or unrelated topics point to SEO spam. - A browser warning: A red page before your site opens. Read fixing the Google warning.
- A new admin user: A WordPress account you did not create.
- PHP files in uploads: The
wp-content/uploadsfolder should hold images and files only. - Files changed without you: Theme files or index.php modified recently with no update from you.
- Email leaving your account: A high-sending alert from your host, or bounces for mail you never sent.
- Sudden slowness or high usage: A miner or spam script eating resources.
- Strange links or ads: Hidden links at the bottom of pages, or pop-ups you did not add.
- A third-party alert: A message from Search Console, your host or a visitor who noticed something odd.
Quick checks you can run yourself #
- Run an ImunifyAV scan from cPanel and review the results.
- Open the WordPress users list, sort by role and look for an admin you do not know.
- In the File Manager sort files by modified date and look for changes on days you did not work on the site.
- Open your site on mobile data and from a Google result, not only from the direct link.
- Review “Security issues” in Search Console.
- Run the WP Toolkit vulnerability scan. Read scanning WordPress for vulnerabilities.
Confirmed a hack? Do not delete files at random. Back up the current state, follow the malware removal steps, change every password, or open a ticket and we will help.
How Hyyat Host protects your site #
- ImunifyAV scans files daily and shows its results in cPanel.
- Imunify360 and CSF block addresses that attempt attacks.
- We monitor sending from accounts and alert you when it spikes.
Learn more about our log analysis service, which reveals attack attempts.
Frequently asked questions #
My site works normally. Could it still be hacked?
Yes. Many infections hide from the owner and only show to visitors from Google, so scan the files rather than relying on how the site looks.
How often should I check my site?
The server scans files daily; review users and updates weekly, and search for your site in Google monthly.
What is the first thing to do once I confirm a hack?
Back up the current state, change your passwords, then clean the site and close the hole.
