Can a website be hacked without any visible change?

Yes. Cloaked spam, credential skimmers and backdoors are all designed to leave the visitor-facing site looking normal, which is why search-side and log-based checks matter.

Should I take the site offline while investigating?

If there is evidence of active data theft or malware delivery, yes. For SEO spam, a maintenance page is usually unnecessary, but preserve logs and a forensic copy before making changes.

Website Securitybeginnerguide

How to Check if a Website Is Hacked

Eight checks that reliably separate a compromised site from a slow or misconfigured one, in the order that finds problems fastest.

Cyber Security Space editorial desk · Published 23 Jul 2026 · Updated 27 Aug 2026 · 2 min read · Reviewed 27 Aug 2026

Short answer

Check whether a website is hacked by reviewing what search engines have indexed, testing the page as a crawler and as a mobile visitor, capturing redirect chains, comparing file timestamps and hashes against a known-good copy, auditing user accounts, and reading authentication and access logs for unexpected writes.

Key takeaways

Most compromises are visible from outside the server before any file is inspected.
Conditional behaviour is the norm: test logged out, on mobile, and with a search referrer.
Unexpected new administrator accounts are among the strongest single indicators.
If any check is positive, preserve logs and take a forensic copy before cleaning.

The eight checks

STEP 01
Search listings
Run a site: query and compare against your real pages. Foreign-language or unfamiliar URLs indicate injected content.
STEP 02
Crawler view
Fetch key pages with a crawler user agent and diff against the browser response.
STEP 03
Redirects
Test with a mobile user agent, a search referrer and no cookies, capturing the entire redirect chain.
STEP 04
File integrity
Compare core, theme and plugin files against official releases; list files by modification time.
STEP 05
Accounts
Review administrators, API tokens, SSH keys and Search Console owners.
STEP 06
Response headers
Look for unexpected headers, missing security headers, and server software you did not deploy.
STEP 07
Logs
Read authentication failures, POST requests to unusual paths, and writes outside deploy windows.
STEP 08
External reputation
Check Search Console security issues and browser safe-browsing status for warnings already issued.

What if the checks are inconclusive?

Inconclusive usually means the payload is conditional or time-based. Widen the conditions: different geographies, different devices, and repeat over several days. If your host provides them, examine raw access logs for requests to files that do not exist in your repository — that is often where a backdoor hides.

Symptoms that are not compromise

Symptom	Often actually is
Sudden traffic drop	Ranking change, tracking outage or seasonality
Slow pages	Unoptimised queries, missing caching, hosting limits
Broken layout after update	Plugin or theme conflict
Email going to spam	Missing SPF, DKIM or DMARC records

Frequently asked questions

Can a website be hacked without any visible change?: Yes. Cloaked spam, credential skimmers and backdoors are all designed to leave the visitor-facing site looking normal, which is why search-side and log-based checks matter.
Should I take the site offline while investigating?: If there is evidence of active data theft or malware delivery, yes. For SEO spam, a maintenance page is usually unnecessary, but preserve logs and a forensic copy before making changes.

Sources

Help for hacked sites — Google Search CentralSupports: Recommended investigation sequence for compromised sites.
Malware, phishing and unwanted software reports — Google Safe BrowsingSupports: External reputation checks.