Signs your website has malware or has been hacked

Signs to look for

• Redirects only some visitors see. Visitors from Google or on phones get sent to scam or gambling sites, while you see your normal site.
• Spam in Google. Search site:yourbusiness.com and look for pages about pills, replica goods, casinos or pages in another language.
• A warning from Google in search results or Chrome. See getting Google’s hacked warning removed.
• Admin users you didn’t create, or a new owner in Search Console.
• Your host suspended the account or warned about outgoing spam or high resource use.
• Files you don’t recognize, or files changed recently that nobody touched.
• The site suddenly slow, or customers saying their antivirus blocked it.
• A checkout page that looks slightly different, which can mean card skimming. See card skimming on websites.

Check from the outside

• Open the site on your phone over mobile data, from a Google search, in a private window.
• Run Google’s Safe Browsing site status check on your domain.
• Run our free website check and plugin check.

If you find something

Don’t delete everything in a panic; you’ll destroy the evidence of how they got in. Take a backup, change the passwords on the hosting and admin accounts from a clean device, and follow the first hour guide.