{"id":18940,"date":"2026-10-21T20:17:52","date_gmt":"2026-10-21T17:17:52","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/signs-your-website-is-hacked\/"},"modified":"2026-10-21T20:17:54","modified_gmt":"2026-10-21T17:17:54","password":"","slug":"signs-your-website-is-hacked","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/signs-your-website-is-hacked\/","title":{"rendered":"How to Tell if Your Website Is Hacked: 10 Signs and Quick Checks"},"content":{"rendered":"<div class=\"hkb\" dir=\"ltr\">\n<div class=\"hkb-tldr\"><b>In short<\/b>A hack is not always obvious. Most attackers want to stay hidden as long as possible, so the signs are small: some visitors redirected, strange pages with your domain in Google, a new admin user, sudden slowness, or email leaving your account. If you notice any of these, check your site right away with the steps in this guide.<\/div>\n<figure class=\"hkb-fig\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.hyyat.com\/zasogooh\/2026\/10\/hkb-hacked-signs.webp\" alt=\"Inspecting a website with a magnifying glass and a warning sign to detect a hack\" width=\"1200\" height=\"630\" loading=\"lazy\" \/><\/figure>\n<h2>10 signs of a hack<\/h2>\n<ol class=\"hkb-steps\">\n<li><b>Redirected visitors:<\/b> Some visitors, especially from Google or on mobile, end up on another site.<\/li>\n<li><b>Strange results in Google:<\/b> Search <code>site:yourdomain<\/code> in Google. Pages in other languages or unrelated topics point to SEO spam.<\/li>\n<li><b>A browser warning:<\/b> A red page before your site opens. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/fix-google-dangerous-site-warning\/\">fixing the Google warning<\/a>.<\/li>\n<li><b>A new admin user:<\/b> A WordPress account you did not create.<\/li>\n<li><b>PHP files in uploads:<\/b> The <code>wp-content\/uploads<\/code> folder should hold images and files only.<\/li>\n<li><b>Files changed without you:<\/b> Theme files or index.php modified recently with no update from you.<\/li>\n<li><b>Email leaving your account:<\/b> A high-sending alert from your host, or bounces for mail you never sent.<\/li>\n<li><b>Sudden slowness or high usage:<\/b> A miner or spam script eating resources.<\/li>\n<li><b>Strange links or ads:<\/b> Hidden links at the bottom of pages, or pop-ups you did not add.<\/li>\n<li><b>A third-party alert:<\/b> A message from Search Console, your host or a visitor who noticed something odd.<\/li>\n<\/ol>\n<h2>Quick checks you can run yourself<\/h2>\n<ul class=\"hkb-list\">\n<li>Run an <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/cxs-tool-from-configserver\/\">ImunifyAV<\/a> scan from cPanel and review the results.<\/li>\n<li>Open the WordPress users list, sort by role and look for an admin you do not know.<\/li>\n<li>In the File Manager sort files by modified date and look for changes on days you did not work on the site.<\/li>\n<li>Open your site on mobile data and from a Google result, not only from the direct link.<\/li>\n<li>Review \u201cSecurity issues\u201d in Search Console.<\/li>\n<li>Run the WP Toolkit vulnerability scan. Read <a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/wordpress-vulnerability-scan-wp-toolkit\/\">scanning WordPress for vulnerabilities<\/a>.<\/li>\n<\/ul>\n<div class=\"hkb-note w\"><b>Confirmed a hack?<\/b> Do not delete files at random. Back up the current state, follow the malware removal steps, change every password, or open a ticket and we will help.<\/div>\n<div class=\"hkb-hh\">\n<h2>How Hyyat Host protects your site<\/h2>\n<ul>\n<li><strong>ImunifyAV<\/strong> scans files daily and shows its results in cPanel.<\/li>\n<li><strong>Imunify360<\/strong> and <strong>CSF<\/strong> block addresses that attempt attacks.<\/li>\n<li>We monitor sending from accounts and alert you when it spikes.<\/li>\n<\/ul>\n<p style=\"margin:10px 0 0\">Learn more about <a href=\"https:\/\/www.hyyat.com\/en\/log-analysis\/\">our log analysis service<\/a>, which reveals attack attempts.<\/p>\n<\/div>\n<h2>Frequently asked questions<\/h2>\n<div class=\"hkb-faq\">\n<details>\n<summary>My site works normally. Could it still be hacked?<\/summary>\n<p>Yes. Many infections hide from the owner and only show to visitors from Google, so scan the files rather than relying on how the site looks.<\/p>\n<\/details>\n<details>\n<summary>How often should I check my site?<\/summary>\n<p>The server scans files daily; review users and updates weekly, and search for your site in Google monthly.<\/p>\n<\/details>\n<details>\n<summary>What is the first thing to do once I confirm a hack?<\/summary>\n<p>Back up the current state, change your passwords, then clean the site and close the hole.<\/p>\n<\/details>\n<\/div>\n<div class=\"hkb-rel\"><b>Related guides<\/b><\/p>\n<ul>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/website-malware-types\/\">Types of Website Malware and How to Recognise Each One<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/fix-google-dangerous-site-warning\/\">How to Fix the Google \u201cDangerous Site\u201d or \u201cDeceptive Site Ahead\u201d Warning, Step by Step<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/hacking-tools-c99-shell\/\">What Is a C99 Shell? How It Gets In and How to Find and Remove It<\/a><\/li>\n<li><a href=\"https:\/\/www.hyyat.com\/en\/knowledgebase\/protect-website-from-hacking\/\">How to Protect Your Website from Hacking: 10 Practical Steps<\/a><\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hyyat.com\/en\/kb\/website-protection\/\">All website security guides \u2192<\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>In shortA hack is not always obvious. Most attackers want to stay hidden as long as possible, so the signs are small: some visitors redirected, strange pages with your domain in Google, a new admin user, sudden slowness, or email leaving your account. If you notice any of these, check your site right away with [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"inline_featured_image":false,"_templately_pack_id":"","_templately_imported_at":"","_templately_source":"","_templately_import_session_id":"","footnotes":""},"doc_category":[2744],"doc_tag":[],"class_list":["post-18940","docs","type-docs","status-publish","hentry","doc_category-website-protection"],"year_month":"2026-10","word_count":521,"total_views":0,"reactions":{"happy":0,"normal":0,"sad":0},"author_info":{"name":"ahmed fathy","author_nicename":"ahmed-fathy","author_url":"https:\/\/www.hyyat.com\/en\/author\/ahmed-fathy\/"},"doc_category_info":[{"term_name":"Website Security","term_url":"https:\/\/www.hyyat.com\/en\/kb\/website-protection\/"}],"doc_tag_info":[],"knowledge_base_info":[],"knowledge_base_slug":[],"_links":{"self":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs\/18940","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/comments?post=18940"}],"version-history":[{"count":0,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/docs\/18940\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/media?parent=18940"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/doc_category?post=18940"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/www.hyyat.com\/en\/wp-json\/wp\/v2\/doc_tag?post=18940"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}