2 June 2026
5 signs your website may already be compromised
Compromises rarely announce themselves with a ransom note on day one. Far more often, a site is quietly abused for weeks — serving malware to visitors, sending spam, or hosting a phishing page — before anyone notices. Here’s what to actually check.
1. Unexpected admin users, plugins, or files
If you didn’t create it, someone else did. Attackers who gain access almost always leave a backdoor so they can get back in even after the original entry point is patched — a second admin account, a plugin you don’t recognize, or a file with an oddly generic name sitting in an upload directory. Periodically auditing your admin user list and installed plugins against what you actually remember installing is one of the cheapest checks available.
2. Search engine or browser warnings
If Google Search Console or Chrome starts flagging your site as “deceptive” or “may harm your computer,” take it seriously — it usually means malicious code (often injected JavaScript that redirects visitors or serves ads) has already been detected by an external crawler. By the time you see this warning, the infection has typically been live long enough to get crawled and flagged.
3. Unexplained spikes in outbound traffic or server load
A compromised site is frequently repurposed as infrastructure — sending spam email, participating in a botnet, or mining cryptocurrency in the background. A server that’s suddenly working much harder than your visitor numbers would explain is a strong signal something else is running on it.
4. Customers reporting spam “from” your domain
Email spoofing doesn’t require your mail server to be compromised — but a leaked contact form, guessed credentials, or a misconfigured mail setup can let attackers send convincing spam that appears to come from your domain. If customers mention receiving strange emails referencing you, it’s worth checking your domain’s SPF/DKIM/DMARC configuration and mail logs.
5. Pages redirecting somewhere you didn’t configure
Conditional redirects — where the malicious behavior only triggers for visitors coming from search engines, and shows the site normally otherwise — are a common technique specifically because they’re designed to stay invisible to the site owner. Testing your own site by clicking through from a search result (not just typing the URL directly) is a simple way to catch this.
None of these signs are proof on their own, but any one of them is worth investigating immediately rather than waiting to see if it happens again. If several line up at once, treat it as an active incident: rotate credentials, take a clean backup of what you can verify is unaffected, and get someone to look at server and access logs before doing anything else.