To tell if your website has been hacked, start with the Security issues report in Google Search Console.
Google tells site owners to rely on it “as the source of truth”, so make sure someone in your business can open Search Console and reads that report.
Two more checks need no developer at all: a site: search for pages you never made, and clicking your own result in Google as well as typing your address.
The signs Google lists
Google’s FAQ for hacked sites names four signs:
- “Unusual traffic spikes, especially from unrelated search terms.”
- “Visitors reporting malware.”
- “Newly created accounts with administrator privileges.”
- “Suspicious new pages added to your site.”
Google may also tell you itself. If you are a verified owner in Search Console, Google says “you should receive an email from Search Console warning that your site is suspected of being hacked”.
Your visitors can see it too, as a “This site may be hacked” label on your results. Google shows it “when we believe a hacker might have changed some of the existing pages on the site or added new spam pages”.
And in the browser, an affected page can show a full-page warning before it loads, which Google calls an “interstitial warning page”.
A checklist to tell if your website has been hacked
You can run all five checks with a Google account and access to Search Console.
- Open the Security issues report. In Search Console, the Security issues report “will show Google’s findings” if a Google evaluation decides your site was hacked. If it lists pages, leave those pages to the person who fixes the site.
- Search for pages you never made. Type site: followed by your address into Google, for example site:example.com. Google’s guide on how to know if your site was hacked says this “shows you all the pages on your site, including pages a hacker might have added.” The same guide points to Search Console’s URL Inspection tool as a second check.
- Look at the searches that find you. In Search Console, read the search terms that bring people to your site, and watch for a sudden jump in traffic from terms you never wrote about. That is the first sign on Google’s list: “Unusual traffic spikes, especially from unrelated search terms.”
- Click your own result in Google. Search for your business, click your result, and check that you land on your own page. Then type the address yourself. In Google’s words, a click from search “could redirect you to a suspicious page, but there is no redirect when you visit the same URL directly from a browser”. We’d try it on a phone as well, because Google says the kind of redirect “sometimes depends on the referrer, user agent, or device.”
- Check Safe Browsing. Google’s Transparency Report has a Safe Browsing site status page where you can enter your address.
Why you might not see what Google sees
Some hacks are built to stay out of your sight. Google’s spam policies say “it’s not uncommon for the hacker to use cloaking to make the hack harder for the site owner to detect”. Cloaking means showing Google one thing and visitors another.
The same page lists hidden text and links added “by using CSS or HTML”, the code behind a page, so a visitor never sees them.
Hackers can also add new pages and leave the ones you know alone. Google warns that such “newly-created pages could harm your site’s visitors or your site’s performance in search results.”
That is why Google says, of its own warnings, that “you may or may not be able to reproduce the warnings.”
One more piece of Google’s advice: “Avoid using a browser to directly view infected pages on your site”. Looking is the job of whoever cleans the site.
What we checked on our own site
On October 25, 2026, we fetched four pages of sp-partners.co twice: once as a desktop browser, and once with Googlebot’s user agent. A user agent is the name a browser or a crawler gives when it asks for a page.
On all four pages, both fetches returned a normal 200 response. The two versions also had the same SHA-256 fingerprint, a code computed from every byte, which means they were byte for byte the same. On that day, those pages showed a browser and a visitor calling itself Googlebot the same thing.
The check has limits. It can’t see a redirect keyed to where a visitor came from or the device they use. And Google’s real crawler fetches from Google’s own network, which ours did not.
What to do if your site has been hacked
Cleaning up is a job for your developer or your host. Google says fixing malware “requires the ability to read and understand code, and possibly web server configurations for your site.”
Ask them to close the way in as well. Google is direct about it: “Fix the security issue that allowed your website to be infected. Otherwise, your site is likely to be reinfected.”
Then every page has to be clean. In Google’s words, “Fixing the issue on just some pages will not earn you a partial return to search results.” After that, you request a review in the Security issues report, and Google says a review “can take from a few days to a few weeks to complete.”
We covered what a hacked site costs you in Google in our article on the PHP2Shell flaws, so we won’t repeat it here.
Make prevention an owner question
Google’s FAQ lists software vulnerabilities and leaked or guessed passwords among the ways sites get hacked. Both come down to who does what in your business.
Someone, at your company or at your host, owns software updates. And a person who can log in to Search Console reads the Security issues report and the emails Google sends there.
Next step
Keeping a site visible in Google is part of our search work. The clean-up itself belongs with your developer or host. If you’d like to talk through how your site is looked after in search, book a call. It’s a 30-minute conversation with Simon or Phillip about your organization and whether we’re the right fit.
Sources
We checked every source in this article on October 25, 2026.
- Google Search Console Help: Security issues report
- Google Search Console Help: email notice for hacked sites
- Google Search Help: “This site may be hacked”
- Google web.dev: FAQ for hacked sites
- Google web.dev: How do I know if my site was hacked
- Google Search Central, last updated August 28, 2026: Spam policies for Google web search
- Google Transparency Report: Safe Browsing site status
- S&P’s own check of four sp-partners.co pages, fetched as a browser and as Googlebot, October 25, 2026, 15:33 UTC
Want to see how this plays out in a real engagement?
Start with the proof if you are still evaluating. If you already know where things are getting stuck, a direct conversation with a founder is the faster next step.