The hacked website that hides from its owner
How would you know your website was hacked? Six signs that give it away even when the site looks flawless to you, and where to look for them.
- Written by
- Kristóf Karner — independent developer, Budapest
- Updated
- 25 September 2026
A hacked website rarely announces itself. The attacker is best served if the site keeps working and the owner notices nothing: that way the injected code can work for months, send email in the domain's name, or send some of the visitors on to another site.
On an Australian government portal, an OpenAI agent accessed non-public files on 18 June 2026. The operator did not notice, and found out on 10 September, from an email sent by OpenAI (ABC News). At Hugging Face, according to the technical timeline, the signs of the July break-in came in from several layers of its security stack, but the alert's severity was not raised to critical and the on-call team was not notified. The company says this cost precious time. What AI attacks have changed for a small business website is covered in a separate piece.
Why the owner is the last to notice
According to Google's Search Console help, attackers often hide injected spam so that the site owner does not notice it, and some links only appear when the visitor arrives from Google. Owners typically open their own site by typing the address, often while logged in, and so they see exactly the clean version. The signs are therefore worth looking for where the attacker cannot hide: in the user list, in the server's files, and in what Google sees.
Six signs that still give it away
An unknown admin account. A name in the WordPress user list that you did not add, or an old account that has suddenly been given admin rights. It is one of the most common traces of a hack, because it lets the attacker back in even after the flaw they came in through has been fixed.
Strange pages in search. If you type
site: followed by your domain into Google, all indexed
pages of your site appear. Japanese product pages, pharmacy or casino
ads under your site's address mean that someone has created new pages
or written spam into the existing ones.
A warning in Search Console or the browser. In Google's free Search Console, the Security issues report shows if Google has found hacked content on the site. A warning label can then appear next to the search result, and the browser may show visitors a warning page before letting them in. After the hacked content is removed, a review has to be requested, which according to Google takes from a few days to a few weeks.
An executable file among the uploads. WordPress puts
uploaded images and documents into the
wp-content/uploads folder. WordPress itself puts no
executable files there; some plugins typically add only an empty
index.php to protect the folder. A .php file
with an unfamiliar name there is a strong sign of a hack.
Email you did not send. Bounces from addresses you never wrote to, or complaints that spam is coming from your domain. Some hacked sites are used to send email. If your domain requests DMARC reports, they show who has sent email in your name.
Unusual load. The host tells you the site has exceeded its resource limits, or the site slows down while its traffic has not grown. The injected code works on your server: it sends email or attacks other sites.
What I do about it in my own work
On the WordPress sites I maintain, a daily check looks for these signs from the inside. It compares the list of admin accounts with the expected one, checks that my own code files are still on the server and have not been emptied, and goes through the server's error log. How I check the integrity of my own files is covered in a separate piece in the Workshop.
On one of the sites, the host offers no command line, so there is no way to look around inside. On that site, an endpoint of its own, tied to a login and read-only, reports the lists of admins, plugins and application passwords, along with any executable files among the uploads. The daily check queries it with a machine account that can reach nothing else.
If the morning check finds an unknown admin, foreign code, or my own code missing, an email goes out immediately; smaller deviations go into a weekly summary. What else maintenance covers is listed on the maintenance page.
Questions on this topic
What are the signs that a website has been hacked?
The most common: an unknown admin account, strange pages among the results of a site: search, a warning in Google Search Console or the browser, an unfamiliar .php file among the uploads, email you did not send, and unusual load. A hacked site often hides from its owner, so these are worth checking regularly.
Why can't I see the spam Google shows on my site?
According to Google, attackers often hide injected spam so that the site owner does not notice it, and some links only appear when the visitor arrives from Google. What Google sees of the site shows in Search Console.
How long does it take for Google's warning to disappear?
After the hacked content is removed, a review has to be requested in Search Console. According to Google, the review takes from a few days to a few weeks.
Do I have to report a hacked website to the authorities?
If personal data is affected, for example data sent through a form, under Article 33 of the GDPR the controller notifies the competent supervisory authority, usually the national data protection authority. The deadline: without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. The 72 hours therefore run from detection.