How to tell if your website is hacked or has malware

If your site runs on WordPress, there is also a specific guide with 10 signs of a hacked WordPress.

Signs your visitors see

These are the ones customers tell you about. Take them seriously even if you cannot reproduce them yourself:

• It sends them to another site: gambling, pharmacy, fake giveaways, "your phone has a virus". Often only on mobile and only when coming from Google. I explain it in my website redirects to another site.
• Pop-ups or notification requests you did not add.
• Text or links that are not yours, sometimes invisible on screen but present in the code (press Ctrl+U and search for words like casino or viagra).
• A payment form that looks different from usual, or a payment step that fails the first time and works the second.
• The site is very slow or goes down without more traffic: it may be sending spam or attacking others.
• The visitor's antivirus blocks the site.

To reproduce them, use your phone over mobile data (not your Wi-Fi), in a private window, coming in from a Google result, never with your admin session open. A lot of malware switches itself off precisely when it detects the owner.

Signs in Google

• "This site may be hacked" under your result, or Chrome's red screen with "Deceptive site ahead" or "contains malware". How to remove it is in this guide.
• Pages in Google that are not yours. Search site:yourdomain.com: if you see titles in Japanese, products you do not sell or casino pages, someone is creating content on your site.
• An email from Search Console about security issues, or an alert in the Security issues report.
• A sudden drop in Google traffic without any change on your side.
• Odd keywords in the Search Console Performance report: searches for products or topics that have nothing to do with you.

If your site is not in Google Search Console yet, verify it even if you suspect nothing: it is free and it is the only way Google tells you directly by email when it detects a security problem. If you verify it after a hack, also check the list of owners: sometimes the attacker has added themselves.

Signs in your email

Email is where it takes longest to notice and where it hurts a business most:

• Your emails land in spam or bounce with messages that mention blacklists (blacklisted, listed in).
• Bounces for emails you never sent: your server or your domain is being used to send spam.
• Customers receiving fake emails in your name, for example invoices or payment notices with a link.
• Your hosting provider throttles or blocks sending because of volume.

Part of this is not a website hack but a weak domain setup: without SPF, DKIM and DMARC, anyone can spoof your address. The free scan checks those three records and the blacklists.

Free outside checks

With no access to anything, from any browser:

1. Google's Safe Browsing transparency report: it tells you whether Google considers your site dangerous right now.
2. VirusTotal: it runs your address through dozens of antivirus engines and blocklists. A single warning from a little-known engine may be a false positive; several at once are not.
3. site:yourdomain.com in Google, going through several pages of results.
4. The homepage headers, pretending to be a phone coming from Google, to spot server-side redirects:

curl -sI -A "Mozilla/5.0 (Linux; Android 14) Mobile" -e "https://www.google.com/" https://your-site.com/

If you see a Location: header pointing to a domain that is not yours, there is a redirect. My free scan runs these tests and more (plugin or module versions with published flaws, exposed files such as backups or .git, certificate, security headers, domain email) and gives you a grade with what it finds.

Inside checks

To really rule it out you have to look inside. With access to the hosting (file manager, phpMyAdmin) or over SSH:

1. Files that do not match the original

This is the most reliable test. Compare the CMS core with the official package of your exact version: WordPress has wp core verify-checksums; for PrestaShop, Joomla or Drupal you compare against the package downloaded from the official site. If the site is in a Git repository, git status and git diff on the server tell you what has changed.

2. Recent or misplaced files

# PHP files modified in the last 10 days
find . -name "*.php" -mtime -10 -printf "%TY-%Tm-%Td %TH:%TM  %p\n" | sort -r | head -40

# PHP in upload or image folders
find . -path "*upload*" -name "*.php" -o -path "*/img/*" -name "*.php"

# Typical obfuscated code
grep -rlE "eval\(base64_decode|gzinflate\(base64_decode|str_rot13\(" --include=*.php .

Go through the results calmly: some legitimate libraries use those functions, and empty protective index.php files are normal. What is suspicious is whatever does not fit with the rest.

3. Users and access

Admin users you do not recognize in the CMS, extra FTP accounts in the hosting panel, keys in ~/.ssh/authorized_keys that nobody can account for.

4. Scheduled tasks

crontab -l over SSH, or the Cron section of the hosting panel. A task that downloads something from an unknown domain or runs an oddly named PHP file is the typical way an infection comes back after it was cleaned.

5. Database

Search for <script, eval(, atob( and String.fromCharCode in the settings and content tables. A script in the site settings or in the footer that nobody remembers adding is a bad sign.

6. Server logs

POST requests to PHP files you do not know, or thousands of requests to the admin login page, tell you what is going on. Ask your hosting provider for the access logs if you cannot see them in the panel.

7. Server configuration

Malware also hides in configuration files almost nobody opens. Check the .htaccess in the root and in every subfolder (rules that redirect depending on the browser or where the visitor came from) and look for .user.ini or php.ini files in the site: an auto_prepend_file line pointing to an unknown PHP file makes that file run before every page, without touching the site's code.

find . -name ".user.ini" -o -name "php.ini" | xargs grep -l "auto_prepend_file" 2>/dev/null
find . -name ".htaccess" -newer index.php

The second command lists the .htaccess files modified after the root index.php, which is usually one of the files that changes least. It is not proof, but it is a good place to start.

If you would rather not give FTP access to anyone, the read-only connector runs the integrity comparison, the malware search and the version inventory from inside the CMS admin itself, without being able to change anything.

If you find something

1. Do not delete blindly. First make a full copy of the current state: it is your evidence and it will tell you how they got in.
2. Change the passwords for the hosting, the database and the admins, from a clean computer.
3. Follow an order: clean, close the way in and only then ask Google for a review. It is all in how to recover a hacked website.
4. If customer data is involved, the GDPR clock (72 hours to notify your data protection authority if there is a risk) starts when you find out: data breach on your online store.

If you want a full diagnosis before deciding, the website security audit (the inside report, with the connector) costs €129 excluding VAT for a business website and €169 for an online store, and it is fully deducted if you then order the cleanup or maintenance within 30 days. If you already know it is hacked, the next step is the cleanup: hacked WordPress cleanup, hacked PrestaShop cleanup or, for any other CMS, hacked website repair.

Sources

• Google Search Central: spam policies (hacked-site redirects that depend on the referrer, the browser or the device).
• Search Console Help: Security issues report (where the owner sees the security issues Google detects).
• Safe Browsing transparency report (the domain's current status for Google).
• WP-CLI: wp core verify-checksums (compares the WordPress core with the official checksums).
• PHP: auto_prepend_file and .user.ini files (a file that runs before every script, configurable per folder).
• Gmail Help: email sender guidelines (SPF, DKIM and DMARC to authenticate email and protect against spoofing).