Is My Website Hacked? 13 Signs to Check Today (October 2026)

Your website is hacked when it does things nobody on your side set up: it shows pages you never wrote in Google, sends visitors somewhere else, gets a warning from Google or your host, or has logins and files you don't recognise. Here are all 13 signs, in the order I'd check them. The first four need no login at all.

Yes. Pages in Google that you never wrote, usually in Japanese or selling pills, casino games or fake designer goods, are the most common sign of a hacked website I come across. It's often called the Japanese keyword hack: the attacker adds thousands of spam pages to your domain to borrow your site's standing with Google.

Sign 1, how to check:

1. Search Google for site:yourdomain.com.sg, with your own address and no space after the colon.
2. Scroll through the first three or four pages of results. Look for Japanese or Chinese titles, words like "viagra", "slot" or "replica", and addresses made of random letters.

Google's guide to fixing the Japanese keyword hack starts with the same search. It also warns that clicking a result may show you a "page doesn't exist" message while the hacked content is still there, so a dead link proves nothing. In Search Console, the URL Inspection tool's live test shows a screenshot of the page as Google's crawler sees it (Google's help page shows where).

Google's spam policies call this page injection, where hackers "add new pages to your site that contain spammy or malicious content".

"This site may be hacked" is a label Google prints under a search result "when we believe a hacker might have changed some of the existing pages on the site or added new spam pages". That's Google's wording on its Search help page.

Sign 2, how to check: search your business name on your phone and on a computer, and read the grey text under your own result. Sites carrying malware get a different label, "This site may harm your computer".

Sign 3 is a red screen before your site loads. Chrome shows a full-page warning when Google Safe Browsing, Google's list of dangerous sites, flags an address. For scam content the heading is "Deceptive site ahead", according to Google's page on social engineering. To check, look your domain up on Google's Safe Browsing site status page, or ask someone who has never visited your site to open it in Chrome.

What a label or a red screen does to your enquiries is its own question, and I've answered it in what a hack does to your Google ranking.

Customers get redirected when you don't because many hacks are written to hide from the site's owner: they target phones, visitors arriving from Google, or first-time visitors, and leave everyone else alone. You're on a desktop, you type the address in, you've visited a hundred times, and you're often logged in. That's every exemption at once.

Google is open about this. Its guide for sites hacked with malware says hackers "might only serve malicious content to users with specific user-agents or referrers" to "avoid detection from site owners and malware scanners", and that "some malware is only activated when users come from Google Search results". The security company Sucuri documented an infection that "only redirects visitors on mobile devices" and sets a cookie "to prevent redirects for returning visitors" (Sucuri's write-up). So a customer gets bounced once, and next time the site looks fine. Many infections also skip anyone logged in to WordPress.

Sign 4, how to check like a stranger:

1. On your phone, turn off Wi-Fi and open a private (incognito) tab.
2. Search Google for your business name and tap your own result. Don't type the address.
3. Watch the address bar. If it changes to a site you don't know, you've found it.
4. Close the tab and repeat once or twice, because some redirects fire only on a first visit.

If a customer says they were sent to a scam page, believe them, even if you can't make it happen. Ask for a screenshot and the time.

Open Search Console, pick your site, and go to Security & Manual Actions, then Security issues: "No issues detected" is what you want, and anything else names the problem and lists sample pages. Search Console is Google's free dashboard for site owners.

Sign 5 is anything in that report. Google's Security Issues help page lists three kinds of problem: hacked content, malware and unwanted software, and social engineering. It treats the report as the place to confirm whether a problem remains, since Safe Browsing warnings can't always be reproduced on your own computer.

While you're there, open Settings, then Users and permissions. Google's Japanese keyword hack guide says that if "someone you don't know has verified your site in Google Search Console", your site has likely been hacked. Removing a verified owner also means deleting their verification token from the site, as Google's permissions help explains. Can't log in at all? Whoever built the site may have set it up under their own Google account, so ask them to add you.

Inside WordPress and your hosting account, look for admin users nobody created, files you don't recognise, a warning email from your host, and a site that has gone slow for no reason.

• Sign 6: admin users you didn't create. In WordPress, go to Users and click Administrator. You should be able to name everyone on the list. Attackers add admins so they can get back in after a clean-up: Sucuri found at least one malicious admin user on 55% of the sites it saw with database malware in 2023 (Sucuri's 2023 report).
• Sign 7: files you don't recognise. In your host's File Manager, open public_html and sort by last modified. Files changed last week when nobody touched the site are suspicious, and so is any .php file inside wp-content/uploads, which should only hold images and documents. Don't delete them yet. They're evidence.
• Sign 8: an email from your host. Hosts warn, then suspend, accounts that serve malware or send spam. Search your inbox and spam folder for your host's name plus "malware", "suspended" or "abuse". If a developer signed up for the hosting, the email went to them.
• Sign 9: a slow site or resource limit warnings. Spam pages, mass-mailing scripts and hidden crypto-mining code all eat server power. A slow site on its own is usually old plugins or cheap hosting, so count this one only alongside another sign.

Yes. A hacked website can get your business email blocked as spam, fill your analytics with visitors from countries you don't serve, show popups you never added, and in the worst case change your checkout so it steals card details.

• Sign 10: your emails bounce. Hacked sites are often used to send spam, the server lands on a blocklist, and business email on the same hosting goes down with it. If a bounce message mentions a blocklist, look up your domain and server IP on the Spamhaus reputation checker.
• Sign 11: a traffic spike from abroad. In Google Analytics, look at visitors by country and page over the last 90 days. A Singapore bakery suddenly getting thousands of visits from Japan, to addresses it doesn't have, is usually feeding the spam pages from sign 1.
• Sign 12: popups or ads you didn't add. Reload the site a few times in a private tab. Google's social engineering page says deceptive ads rotate, and that pop-ups and redirects to deceptive pages count against your site even if you run no ads.
• Sign 13: your payment page has changed. Go through your own checkout. An extra card form, a step that looks different, or customers reporting card fraud soon after buying all point to a card skimmer, code that copies card details as they're typed. Google names credit card skimmers as an example in its Ads policy on compromised sites.

Sign 13 is the one I'd act on within the hour. Switch off online payments, then call your payment provider.

If your website is hacked, don't delete anything yet: take screenshots, tell your host, and then work through the clean-up in a fixed order. Deleting the spam first destroys the evidence of how they got in, and without that the site usually gets reinfected.

1. Write down what you saw and when, with screenshots, including anything customers sent you.
2. Contact your host and ask what backups they hold and how far back they go.
3. If customers are at risk from a scam redirect or a fake card form, put up a holding page with your WhatsApp number.
4. Follow the order in my guide to the first 24 hours after a hack: contain, copy, change passwords, clean or restore, find the hole, patch, then ask Google to review.
5. If customer details sat on the site, you have 30 days to assess whether the PDPC has to be told, and 3 days to notify once you decide it does. My guide to your PDPA duties after a hack explains the tests.

You can also report it to SingCERT through CSA's reporting page.

It could if your site runs on an unpatched version of PHP, though when this series was researched on 23 October 2026, nobody had publicly confirmed a successful break-in through PHP2Shell. PHP is the software on your server that builds each page when someone visits. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, out on 21 October, per the PHP security advisory, and 8.1 or older got no fix from PHP at all. Amazon logged an attack attempt on 17 October, so if your site was unpatched, check the signs above for anything since then.

Most hacked sites I see got in through something duller, though: a plugin nobody updated, a reused password, or the login of a developer who left years ago. My plain-English guide to PHP2Shell covers whether your site is exposed.

A free online scanner can confirm some hacks, but a clean result doesn't prove your website isn't hacked, because an outside scanner only sees what your site chooses to show it. The hacks that hide from owners hide from scanners too, and Google's malware guide says that's the point. Checks that run on the server, like Wordfence or your host's file scan, see more. My roundup of free website security check tools says what each one misses.

Check once a month, and straight away after a security alert like PHP2Shell: the site: search, the Safe Browsing page, the phone test and Search Console take about ten minutes together.

If you'd rather it was someone else's job, that's part of my website maintenance service. A one-off clean-up or fix starts from SGD 850, at a fixed price in writing once I've looked at the site. Monthly upkeep is the content retainer at SGD 550 a month: updates, daily backups and security, plus 5 hours of changes, month to month with 30 days' notice.