How to Check if Website Hacked: 7 Quick Signs & Fixes
OverMCP Team
TL;DR: To check if your website is hacked, look for unexpected redirects, strange files in your codebase, warnings from Google Search Console, sudden traffic spikes from weird referrers, changes in file modification dates, unknown admin users, and forms sending spam. Run a quick malware scan with tools like OverMCP or your hosting provider's security suite.
How to Check if Website Hacked: 7 Signs You Can't Ignore
If you're an indie developer or solopreneur building with AI tools like Cursor, Bolt.new, or v0, you ship fast. But that speed can leave security holes. Here's how to check if website hacked—and what to do about it.
1. Unexpected Redirects
Open your site in an incognito browser. If it redirects to a spammy domain, a fake giveaway, or a phishing page, you've been hacked. This is often caused by injected JavaScript that checks the user agent or referrer.
Check via curl:
curl -I https://yoursite.comLook for a 302 Found or 301 Moved status pointing to an unknown URL.
Fix: Scan your database and theme files for base64-encoded redirects. Look for wp_redirect() in PHP files or window.location in JavaScript.
2. Strange Files in Your Codebase
Hackers often upload backdoors disguised as legitimate files. Common names: wp-rss.php, c99.php, shell.php, or files with timestamps like 20250321.php.
How to find them:
find /var/www/html -type f -name "*.php" -mtime -7This shows PHP files modified in the last 7 days. If you see files you didn't create, investigate.
Pro tip: Use OverMCP to scan your repo for known malware signatures and suspicious code patterns automatically.
3. Google Search Console Warnings
Google often detects hacked sites before you do. Log into Google Search Console and check for "Security Issues" under the "Security & Manual Actions" section.
What you'll see:
Click each issue to see which URLs are compromised.
4. Unexplained Traffic Spikes
A sudden spike in traffic—especially from unusual referrers like buy-cheap-pills.ru—often means your site is being used to send spam or host phishing pages.
Check in your analytics:
grep -i "spam" /var/log/nginx/access.log5. Modified File Timestamps
Hackers edit legitimate files to inject malicious code. If your index.php or .htaccess was modified recently and you didn't change anything, you're hacked.
Command to compare with a backup:
diff -r /backup/site /var/www/html --exclude=wp-content/uploads6. Unknown Admin Users
On CMS platforms like WordPress, hackers create new admin accounts to maintain access.
Check in MySQL:
SELECT * FROM wp_users;Look for users you don't recognize. Also check wp_usermeta for elevated roles.
Fix: Delete unknown users immediately and change all passwords.
7. Forms Sending Spam
If your contact form is suddenly emailing random visitors or sending spam, your form handler may be compromised.
Test: Submit a test entry and check if the email contains unexpected fields or headers.
What to Do If You Find Signs of a Hack
Follow these steps immediately:
index.php with a static maintenance page..env files.Preventing Future Hacks
define('DISALLOW_FILE_EDIT', true); to wp-config.php.Real-World Example: A Vibe-Coded App Hack
A developer used Cursor to build a Next.js SaaS app. They stored the database password in a .env file that was accidentally committed to a public GitHub repo. Within hours, a bot found the credential and dropped a crypto miner into their node_modules directory. The miner consumed 90% of CPU, causing the hosting bill to spike to $2,000 in one day.
How they caught it: Heroku sent an alert about unusual CPU usage. They ran top on the server and saw an unknown process named xmrig. Checking the git history revealed the leaked .env file. They rotated the credential, removed the miner, and added .env to .gitignore.
Lesson: Always scan your codebase for secrets before deploying. OverMCP can automate this check in your CI/CD pipeline.
FAQ
How often should I check if my website is hacked?
At least once a month. If you update often, use third-party code, or store sensitive data, run a scan weekly. Automated tools like OverMCP can monitor continuously.
Can Google penalize my site if it's hacked?
Yes. Google may display a warning in search results or remove your site entirely. Fixing the hack and requesting a review through Search Console can restore your ranking.
What is the fastest way to check if website hacked?
Use an online scanner like OverMCP's free scan, or check for the 7 signs listed above. The fastest manual check is to view your site in an incognito browser and look for unexpected redirects or content.