Most small business owners find out their website was hacked from somebody else. A customer mentions that the site sent them to a strange page. Google shows spam in your search results. A browser throws up a red warning. By then the problem has usually been there for a while. The good news is that most compromises leave signs you can spot yourself, and a few basic checks will tell you a lot about how exposed your site is.
9 Warning Signs Your Website Has Been Hacked
None of these signs proves a hack on its own, but if you see two or three of them together, treat it as urgent.
- Visitors get redirected. Your site sends some visitors, often only phone users or people coming from Google, to a pharmacy, gambling or fake prize page. Attackers do this on purpose so the owner does not notice when typing the address directly.
- Strange results in Google. Search for site:yourbusiness.com. If you see pages you never created, especially in another language or selling products you do not carry, someone has added them.
- Browser or Google warnings. A red “Deceptive site ahead” screen or a “This site may be hacked” label in search results means Google has already flagged a problem.
- New admin users you did not create. In WordPress or similar systems, check the user list. An unknown administrator account is a serious red flag.
- Your hosting company suspended the site. Hosts often shut down sites that are sending spam or hosting malware.
- Your email starts bouncing or landing in spam. If your domain is being used to send spam, mail providers stop trusting it, and your real messages suffer.
- The site is suddenly slow or crashing. Malicious code can eat server resources or break pages.
- Files or content changed without anyone touching them. New pop-ups, links in the footer you do not recognize, or edits to your homepage.
- Your contact form goes quiet. A hacked or broken form can stop delivering leads without any visible error. If inquiries dropped to zero overnight, test the form yourself.
What to Do in the First Hour
If you think your site has been compromised, move quickly but carefully. Panicked fixes can destroy the evidence of how the attacker got in, which means it happens again.
- Change the passwords for your website admin, your hosting account and your domain registrar, and turn on two-factor sign-in wherever it is offered.
- Check the list of admin users and remove any you do not recognize.
- Contact your hosting company. Many hosts have a security team and can tell you what they see on the server.
- Find your most recent clean backup, but do not restore it until you know how the attacker got in.
- If you take payments or collect personal information on the site, talk to whoever handles your compliance before you notify anyone.
How Small Business Websites Get Hacked
Most attacks on small business sites are not personal. Automated tools scan thousands of websites looking for the same handful of weaknesses: outdated software, weak or reused passwords, abandoned plugins and missing security settings. That is why a small bakery in Hendersonville can get hit by the same campaign as a national retailer.
The most common causes I see are a WordPress install or plugin that has not been updated in a year or more, an admin password shared among several people, an old staging or test copy of the site that nobody remembers, and hosting with no monitoring at all.
The Problems You Cannot See From the Outside
Some weaknesses do not cause visible symptoms until they are exploited. Missing security headers, an expired or misconfigured SSL certificate, and missing email protection records (called SPF, DKIM and DMARC) are all invisible to a normal visitor. Without email protection, a scammer can send messages that look like they came from your business, and your customers have no way to tell the difference. We explain those email records in more detail in SPF, DKIM and DMARC explained.
Check Your Website for Free in About 20 Seconds
We built a free tool for exactly this. The DirecTech Website Security Check runs 33 checks against your site, including encryption, security headers, email spoofing protection and what your site reveals to an attacker. It only looks at what any visitor can see, so it is safe to run on any site. You get a score right away and a plain-English explanation of each finding, and you can have the full report sent to your inbox.
There is also an optional HIPAA website check for medical and dental offices or anyone handling patient information.
How to Keep It From Happening Again
Prevention is mostly routine work done consistently:
- Keep the website software, theme and plugins updated, and remove anything you no longer use.
- Give each person their own login with only the access they need, and turn on two-factor sign-in.
- Keep automatic daily backups stored somewhere other than the website server.
- Set up SPF, DKIM and DMARC for your email domain.
- Run a security check every few months, and again after any big change to the site.
If you would rather have someone else handle this, DirecTech provides managed IT and security for small businesses, and every website we build includes hosting, SSL, backups and security updates.
Found something you do not understand in your results? Contact our team or call 866-832-7117 and we will walk through it with you.
Danielle Lemons is Vice President of Operations at DirecTech Connect, where she oversees phone, IT and support operations for small and mid-sized businesses. You can also find her work at daniellelemons.com.
