Guides
How to Check if a Website Is Hacked
Eight checks that reliably separate a compromised site from a slow or misconfigured one, in the order that finds problems fastest.
Published 23 Jul 2026 · Updated 27 Aug 2026 · 2 min read
Short answer
Check whether a website is hacked by reviewing what search engines have indexed, testing the page as a crawler and as a mobile visitor, capturing redirect chains, comparing file timestamps and hashes against a known-good copy, auditing user accounts, and reading authentication and access logs for unexpected writes.
The eight checks
STEP 01
Search listings
Run a site: query and compare against your real pages. Foreign-language or unfamiliar URLs indicate injected content.
STEP 02
Crawler view
Fetch key pages with a crawler user agent and diff against the browser response.
STEP 03
Redirects
Test with a mobile user agent, a search referrer and no cookies, capturing the entire redirect chain.
STEP 04
File integrity
Compare core, theme and plugin files against official releases; list files by modification time.
STEP 05
Accounts
Review administrators, API tokens, SSH keys and Search Console owners.
STEP 06
Response headers
Look for unexpected headers, missing security headers, and server software you did not deploy.
STEP 07
Logs
Read authentication failures, POST requests to unusual paths, and writes outside deploy windows.
STEP 08
External reputation
Check Search Console security issues and browser safe-browsing status for warnings already issued.
What if the checks are inconclusive?
Inconclusive usually means the payload is conditional or time-based. Widen the conditions: different geographies, different devices, and repeat over several days. If your host provides them, examine raw access logs for requests to files that do not exist in your repository — that is often where a backdoor hides.
Symptoms that are not compromise
| Symptom | Often actually is |
|---|---|
| Sudden traffic drop | Ranking change, tracking outage or seasonality |
| Slow pages | Unoptimised queries, missing caching, hosting limits |
| Broken layout after update | Plugin or theme conflict |
| Email going to spam | Missing SPF, DKIM or DMARC records |
Sources
- Help for hacked sites — Google Search Central
- Malware, phishing and unwanted software reports — Google Safe Browsing
Prefer summary updates? Subscribe to the newsletter.