Why owners often don't notice a hack
Modern website malware is built to hide. In a recent security audit of a group of small-business WordPress sites, we found three patterns again and again:
- Spam shown only to Google. The home page was replaced with code that shows the real site to people but serves spam pages and fake sitemaps to Google's crawler, so the owner sees nothing wrong.
- Fake "verify you are human" screens. Plugins disguised as Cloudflare tools showed visitors a fake CAPTCHA that asks them to paste a command into their computer, which infects the visitor.
- Backdoors that reinstall the malware. Small files that load on every page and download the malware again from the internet, so a quick clean-up does not last.
What are the signs that a website is hacked?
| Where to look | What a hack looks like |
|---|---|
| Google search for site:yourdomain.in | Pages you never made, often in Japanese or about medicines, casinos or loans |
| Google Search Console | A warning under Security issues, or an owner or user you don't recognise |
| Clicking your site from Google on a phone | You land on a different website |
| Visiting the site | A pop-up asking you to verify you are human by pressing keys or pasting text |
| WordPress Users and Plugins | Administrators or plugins nobody on your team added |
| Files on the server | Random-named .php files, PHP files inside the uploads folder, extra google*.html files |
| Your hosting provider | Emails about malware, suspended sites or unusually high resource use |
How can you check your website in 10 minutes?
- Search Google for site:yourdomain.in and scroll through the results.
- Open Google Search Console, check Security issues, and review Settings, Users and permissions.
- In WordPress, open Users and filter by Administrator; then open Plugins and look for names you don't know.
- Run the malware scanner in your hosting panel and read the results, not just the score.
- Open your site from a Google search on a phone, not only by typing the address.
What should you do if your website is hacked?
- Take a full backup first of files and database, even though it is infected. It helps the clean-up and is evidence of what changed.
- Change every password: hosting account, FTP, database, every WordPress administrator. Turn on two-factor login for the hosting account.
- Remove unknown administrators and any plugin or theme you did not install.
- Replace WordPress core files with clean copies of the same version, and reinstall plugins from their official source.
- Hunt for backdoors: the mu-plugins folder, PHP files inside uploads, random-named files in the main folder, and a changed index.php.
- Ask Google to review the site in Search Console once it is clean, and remove any owners you don't recognise.
Restoring an old backup is not enough on its own. If the way in is still open, the site is usually infected again within days.
Can one hacked website infect your other websites?
Yes, if they share a hosting account. On shared hosting, every site in the account usually runs as the same user, so malware that gets into one WordPress site can write files into all the others. Keep your main business website on its own account, and delete old test sites you no longer use.
How do you prevent your website from being hacked?
| Common cause | Prevention |
|---|---|
| Pirated ("nulled") premium themes and plugins | Use licensed copies from the official seller only |
| Outdated plugins and WordPress | Turn on updates and remove plugins you don't use |
| Reused or weak passwords | Unique passwords and two-factor login on the hosting account |
| File manager plugins left installed | Remove them after use; use the hosting file manager instead |
| PHP allowed to run in uploads | Block PHP in the uploads folder |
| Backup .zip files in the public folder | Keep backups outside the website folder; anyone can download a public zip |
Regular care matters more than any single tool. Our guide to website maintenance costs in India explains what an AMC should include, and the domain and hosting guide covers keeping accounts in your own name.