A customer says your website sent them to an unfamiliar page. Another sees a malware warning. You open the homepage and it looks normal. Has your business website been hacked?

A visible change can be a warning, but a normal-looking homepage does not rule out a compromise. For a small service business, the priority is to recognize suspicious behavior, protect visitors, and get qualified help before making changes that could complicate recovery.

Warning Signs Worth Investigating

Some website problems are ordinary technical failures. Others warrant a security investigation, especially when several appear together:

  • Visitors report unexpected redirects, unfamiliar advertisements, or warnings about malware or phishing.
  • Pages, blog posts, or search results contain text or links you did not publish.
  • A new administrator account appears, or a legitimate account loses access unexpectedly.
  • Your hosting provider suspends the site or alerts you to suspicious activity.
  • Google Search Console reports a security issue affecting your website.

WordPress's guidance for hacked sites identifies unauthorized changes, host warnings, and security flags as potential indicators. Google's malware prevention guidance recommends checking Search Console's Security Issues report and looking for unfamiliar pages in search results.

None of these signs alone proves that an attacker has access. A failed update or misconfiguration can also disrupt a site. But do not dismiss unfamiliar content or security alerts as a harmless glitch without checking.

What to Do When You Suspect a Compromise

Start with a short incident record: what you saw, when it appeared, which pages or accounts were affected, and who reported it. Save relevant screenshots and messages. Avoid uploading sensitive customer information into unverified scanning tools.

Next, contact your hosting provider or website security specialist through a known, trusted support channel. Ask them to assess the problem, preserve available logs and evidence, and advise whether the site or affected services should be isolated to protect visitors. If the site appears to be sending visitors to malicious pages or exposing information, rapid containment is more important than keeping every page online.

Have the responsible specialist check administrator access, hosting credentials, software components, and other affected systems. Credentials may need to be reset and active sessions revoked, ideally from a trusted device. Do not install random cleanup plugins, delete suspicious files, or immediately overwrite the site with a backup before the incident has been assessed. Those actions can erase useful evidence or leave the original entry point open.

The Federal Trade Commission's data breach response guide emphasizes securing operations, preserving evidence, and getting appropriate technical and legal advice when personal information may have been exposed. A hacked website is not automatically a reportable data breach; notification obligations depend on what happened, what data was affected, and applicable laws.

Why Your Hosting Provider Matters

When something goes wrong, the difference between a hosting plan and useful incident support becomes clear. A capable provider may be able to help review server logs, suspend affected services, recover account access, identify the available backups, or coordinate with a security professional.

But professional hosting does not mean guaranteed protection or guaranteed cleanup. Some providers offer infrastructure support only; malware removal, forensic investigation, or recovery assistance may cost extra or fall outside their responsibility.

Before an incident, ask your provider who responds to security alerts, how urgent support is reached, which logs are retained, and whether website files and databases are backed up. Know which tasks belong to the host, the website developer, and the business owner. A provider that can explain these responsibilities clearly is more useful than one offering vague claims of complete security.

Where Regular Backups Fit Into Recovery

A recent backup can reduce the amount of website content or customer inquiry data lost during recovery. However, a backup is not necessarily clean: the unauthorized changes may have been present before the copy was created.

Ask whoever manages your site whether backups include the necessary files and database, how often they are taken, where they are stored, and whether restoration has actually been tested. Copies protected from the compromised website account are especially valuable if an attacker can alter or delete accessible backups.

WordPress recommends preserving a snapshot of an affected site before cleanup, even when that snapshot is compromised, because it can help document what happened. Your recovery specialist should establish which backup is safe to use, address the underlying vulnerability, and then test the restored website. Simply restoring yesterday's files is not proof that the attacker is gone.

This is why backups and hosting support work together: one offers a possible recovery point; the other may provide the technical access and expertise to investigate and restore safely.

Before You Declare the Website Safe Again

Ask for confirmation that the cause of the compromise has been addressed, unauthorized access has been removed, and the restored site has been checked. Test key service pages and the contact form, including whether an inquiry actually reaches the business. Review Google Search Console for any remaining security issues; if Google has flagged the site, follow its instructions for resolving the issue and requesting a review where available.

If customer information may have been accessed, get advice about applicable notification requirements rather than assuming the issue ended when the homepage looked normal.

The best preparation happens before any warning appears: know who to call, who controls the hosting and domain accounts, and where tested backups are kept. Those arrangements cannot prevent every attack, but they can make the response more controlled when your website—and customers' trust—are at risk.

Sources and Further Reading