Why a breach is not always visible
Films taught everyone that a hacked site goes down or fills up with hacker graffiti. Reality is quieter and more dangerous: the site keeps working normally while sending spam in the background, harvesting form data, or serving somebody else’s ads only to search engines. The attacker’s goal is to stay unnoticed for as long as possible.
Early warning signs
| Sign | What it means |
|---|---|
| Spam coming from your domain | the server is being used as a mail relay |
| Browser or search-engine warning | malicious code has been detected |
| Redirects to unfamiliar sites | a third-party script has been injected |
| New files and admin accounts | the attacker has established persistence |
| A spike in load and traffic | your site is being used in somebody else’s scheme |
| Rankings falling away | the search engine has flagged the site as unsafe |
No single sign is proof on its own, but several together mean it is time to check properly. A frequent entry point is an outdated platform — see how to check a website for malware.
What to do, step by step
- •Preserve the current state as a copy for analysis, without overwriting traces,
- •Restore from a clean backup taken before the breach,
- •Rotate every password — admin panel, database, FTP/SSH, mail,
- •Find and close the entry point (platform, plugin, password, server),
- •Set up recurring checks so a repeat gets caught early.
How to avoid getting there
Prevention is far cheaper: keep the platform and plugins updated, never install pirated extensions, use strong passwords, and audit the server regularly. Pirated extensions in particular are covered in why nulled plugins are dangerous, and the audit itself can be run over SSH by ServerShield.
Frequently asked questions
How do I tell quickly whether my site has been hacked?
Check the indirect signs: complaints about spam from your address, a browser or search-engine warning, redirects to other sites, unfamiliar new files and admin accounts. A compromise often shows up in the site’s behaviour rather than on the site itself.
Does a hacked site always look broken?
No, and that is the real danger. Very often the site works exactly as usual while quietly sending spam, harvesting form data, or showing somebody else’s ads only to search crawlers. The owner is the last to find out.
What should I do if the site has been hacked?
Do not panic and do not delete everything. Take a copy of the current state for analysis, restore from a clean backup taken before the breach, rotate every password, and close the hole they came in through. Otherwise it happens again.
How do I find out how they got in?
Usually through an outdated CMS or plugin, a weak password, or a server-level vulnerability. An audit of logs and files shows the entry point. Without that step, a repeat breach is close to guaranteed.