In this article
Hacked websites can put your visitors at risk, but many hackers break into a site simply to hide links to their own websites in it, often using a trick called cloaking. Cloaking shows one version of a page to search engine bots such as Googlebot, and another to visitors. This kind of hack shows the hidden links to search engines while the website owner has no idea the site has been hacked. Here are some ways to find out whether your website has been hacked.
Check Google’s Safe Browsing Status
Google regularly scans websites for malicious content. When it finds malware on a site, browsers such as Chrome show visitors a red warning telling them not to open the website. To check whether your site has been flagged, search for your domain in Google’s Safe Browsing site status tool, part of the Google Transparency Report. If you have verified your site in Google Search Console, its Security issues report will also tell you whether Google has found malware or hacked content on your site, and what kind.
View Your Site the Way Google Sees It
Because cloaked links are hidden from normal visitors, you need to see your site the way Googlebot does. Google Search Console’s URL Inspection tool lets you do exactly that: test any page and view the HTML that Google received.
Use the tool to view your website’s code. Look for any links to online pharmacies or other sites you never added to your website. Hacked websites typically contain links to online pharmacies, adult sites or other hacked sites.
Google Your Site Using the “Site” Operator
Since hacked websites often contain links to online pharmacies, you can use Google to search for content that wouldn’t normally be on your site. For instance, type “viagra site:yoursite.com” in the search box. If any pages are found, your site has probably been hacked. If you don’t see those words when you open the page in your browser, use the URL Inspection tool to view the page’s code.
Preventing Your Site from Being Hacked
Even if you haven’t found malware on your site, always take precautions to avoid being hacked in the future. Use strong, unique passwords and turn on two-factor authentication where you can, and keep your computer’s security software up to date. If you use WordPress, keep WordPress, your plugins and your theme up to date. Keep regular backups so you can restore your site if anything goes wrong, and choose a host that includes malware scanning and a firewall.