The average time between a website being hacked and the owner finding out is 206 days. More than six months. In that window, attackers are quietly using your site — redirecting your visitors, sending spam from your domain, stealing customer data, or mining cryptocurrency on your server.
43% of cyberattacks target small businesses — and most aren't discovered by the owner. They're discovered by customers, partners, or Google's automated scanners. Source: Verizon Data Breach Investigations Report
The warning signs are often subtle. Attackers don't want you to notice — a noisy, obvious hack gets cleaned up quickly. A quiet one can persist indefinitely, harvesting value the whole time. The five signs below are what to look for, what they indicate, and how to check each one without technical expertise.
Unexpected redirects or pop-ups
Your visitors are landing on your site and immediately being sent somewhere else — a pharmacy site, a gambling site, a phishing page. Or they're seeing pop-ups that you never created. You probably don't see this yourself because attackers often only redirect new visitors or visitors arriving from search engines — returning visitors and people accessing the site directly get the normal version.
Why it happens: Attackers inject malicious JavaScript or PHP into your site files. The code checks whether you're coming from Google Search, then sends those visitors (who are more valuable, since they're high-intent) to an affiliate site that pays the attacker per visit. Your site's search traffic becomes their monetization engine.
What it looks like:
- Customers tell you they were "sent to a weird site" after clicking your Google result
- Your Google Analytics shows high bounce rates on pages that used to perform well
- Suspicious pop-ups appear on the site that you don't recognize
- Google Search Console shows warnings about "Pages with redirects"
- Open your site in a private/incognito browser window (this simulates a new visitor)
- Search for your site on Google and click the result — note where it actually sends you
- Check Google Search Console → Security Issues for redirect warnings
- Use Aegisly's free scan to check for security anomalies in your domain's response headers
Google "This site may be hacked" warning
When Google detects that a site has been compromised, it adds a warning label to your search result: "This site may be hacked" or "This site may harm your computer." Chrome also shows a full-screen red warning before visitors can access the page. This is devastating for traffic — most users will not click through a security warning.
Why it happens: Google's Safe Browsing system continuously crawls websites and compares them against known malware signatures, spam patterns, and phishing indicators. When it finds something, it flags your domain. The flag propagates to Chrome, Firefox, and Safari — all of which use Safe Browsing data. The effect is immediate and significant: typical sites lose 80–95% of their search traffic the day the warning appears.
What it looks like:
- Your Google search result shows a red or grey warning label under the title
- Visitors see a red "Dangerous site" warning screen in Chrome before your site loads
- You receive a notification in Google Search Console (if you've verified your site)
- Sudden unexplained drop in organic search traffic
- Visit
https://transparencyreport.google.com/safe-browsing/searchand enter your domain - Search for your brand name on Google and check if warnings appear under your result
- Check Google Search Console → Security & Manual Actions → Security issues
- Ask a colleague to visit your site in Chrome on a device they've never used to visit it before
Not sure if your site is compromised?
Aegisly's free scan checks your domain's security posture in under 30 seconds.Get our free Small Business Security Checklist
10 steps to protect your business — sent to your inbox in 30 seconds
Unusual spikes in outbound traffic or bandwidth
Your server is suddenly using 10x its normal bandwidth, sending huge amounts of data outbound to unknown IP addresses, or your hosting provider is sending you overage alerts. Your site itself might look completely normal to visitors — but underneath, your server is being used as a relay for spam, a participant in a DDoS botnet, or a file host for malicious content.
Why it happens: Once attackers have access to your server, they often install additional tools — spam mailers, IRC bots, crypto miners, or file distribution nodes. These run in the background and don't affect what visitors see. The only tell is the server resource usage. Hosting providers with bandwidth caps will often notice this before you do — which is why unexpected billing notices or "resource limit exceeded" emails from your host warrant immediate investigation.
What it looks like:
- Your hosting provider sends a bandwidth overage notice
- Server CPU or memory usage is much higher than normal with no new traffic
- Your hosting dashboard shows outbound traffic to unexpected IP addresses
- Email delivery issues or your IP appearing on spam blacklists
- Log into your hosting control panel and review bandwidth usage by date — look for anomalies
- Check your server's access logs for unusual outbound connection patterns
- Search for your IP address at
mxtoolbox.com/blackliststo see if it's been blacklisted - Review cron jobs and running processes — look for unfamiliar scripts
Modified files or new admin accounts you didn't create
Core files on your server have recent modification timestamps that don't match any deployment you made. Or you log into your WordPress or CMS admin panel and find accounts you didn't create — often with administrator privileges and generic names like "admin2" or random strings.
Why it happens: When attackers get into a site, the first thing they do is create persistence — a way to get back in even if the initial entry point is closed. Backdoor files (often disguised as legitimate PHP files) and rogue admin accounts are the two most common methods. The backdoor file might be named wp-includes/images/icons.php — looks legitimate, isn't. The admin account might have been created months ago and never used, just waiting.
What it looks like:
- Files in your site's core directories have "last modified" dates that don't correspond to any update you performed
- Admin user list shows accounts you don't recognize
- New PHP files appear in
/uploads/or image directories (PHP shouldn't be in these folders) - Your site's source code contains obfuscated JavaScript you didn't write
- In WordPress: Users → All Users — look for accounts you don't recognize
- Via FTP/file manager: Sort all files by "Last Modified" and look for recent changes on core files
- Use a WordPress security plugin (Wordfence, Sucuri) to run a file integrity scan
- Check your site's HTML source in-browser for obfuscated script tags (
eval(,base64_decode)
Suspect something's wrong with your site?
Run a free external security scan — checks DNS, SSL, and HTTP headers instantly.Blacklisted by email providers — SPF/DKIM failures
Your legitimate business emails are suddenly landing in spam, bouncing, or not arriving at all. Clients say they never received your invoice. Your newsletter delivery rate has tanked. The root cause: your domain has been used to send spam, and email providers have blacklisted it in response. Or your mail authentication records (SPF, DKIM, DMARC) are missing, making it easy for anyone to send email impersonating your domain.
Why it happens: Attackers who control your server can use it to send massive volumes of spam. When recipients mark those emails as spam, spam filters log your domain and IP as sources of malicious mail. Even if you clean up the server, getting off blacklists takes days or weeks of active requesting. Separately, missing or misconfigured SPF/DKIM records let anyone impersonate your domain, and the resulting spam complaints still damage your sending reputation.
What it looks like:
- Your emails are going to spam for recipients who previously received them normally
- You receive bounce-back messages about delivery failures
- Clients and contacts say they aren't getting your emails
- Email platforms show declining delivery and open rates with no change in content
- Check your domain at
mxtoolbox.com/blacklists— run against 100+ blacklists at once - Verify your SPF record:
dig TXT yourdomain.com | grep spf - Check DMARC policy:
dig TXT _dmarc.yourdomain.com - Run an Aegisly scan — it checks SPF, DKIM, and DMARC configuration automatically and grades your DNS security
Quick reference: all 5 warning signs
Here's a summary of each sign, its risk level, and the fastest way to check it:
| Warning Sign | Risk | Fastest Check |
|---|---|---|
| Unexpected redirects or pop-ups | Critical | Visit your site from an incognito window via Google search |
| Google "This site may be hacked" warning | Critical | Google Safe Browsing transparency report |
| Unusual outbound traffic spikes | High | Check hosting control panel bandwidth + cron jobs |
| Modified files or new admin accounts | High | Sort all files by Last Modified; check Users list in CMS |
| Email blacklisting / SPF-DKIM failures | Critical | MXToolbox blacklist check + Aegisly DNS scan |
If you see one of these signs, what next?
Finding a warning sign isn't the same as confirming a hack — but it means you need to investigate immediately. Here's the sequence:
- Don't panic, but act fast. Every hour the infection persists, more damage accumulates — reputation, SEO, data.
- Put the site in maintenance mode if you suspect active malicious redirects or malware delivery. Prevent further harm to visitors.
- Change all admin passwords immediately — hosting, CMS, FTP, database. Use new, unique passwords via a password manager.
- Run a full scan — use Aegisly to check your domain's external signals, and a server-side scanner (Wordfence, Sucuri, or your host's malware scan tool) to check file integrity.
- Restore from a clean backup if you have one from before the compromise. This is the most reliable way to get to a known-good state.
- Fix the entry point — update all software, remove unused plugins, review admin accounts. If you don't close the hole, they'll be back.
- Request a review from Google Search Console if your site was flagged. The review process takes 1–3 days.
The single most effective prevention strategy: don't wait until you see these signs. Run periodic external scans and keep your software updated. Most hacks exploit known vulnerabilities that had available patches — the attack succeeds because no one applied them.
Read more: 5 Security Gaps Most Small Businesses Don't Know They Have and the Website Security Checklist: 7 Things to Check.
Run a free scan now
Aegisly checks your SSL, DNS security records, and HTTP headers automatically. Get an A–F security grade and plain-English fixes in under 30 seconds — no account required.
Run your free security scan →No credit card. No signup. Results in 30 seconds.