A compromised website may still look normal to its owner. Attackers can show redirects only to search visitors, create hidden spam pages or add administrator access for later use.
Signals worth investigating
- Unknown administrator or deployment keys
- Unexpected redirects or pop-ups
- Search results for pages you did not publish
- Modified core files or new executable uploads
- Outbound mail or CPU spikes
Contain before cleaning
Preserve logs and a copy for investigation, restrict access and rotate credentials from a clean device. Include hosting, database, SFTP, DNS and email, not only the CMS password.
Find persistence
Replace trusted core and plugin files from official packages, inspect uploads and scheduled tasks, remove unknown users and patch the entry point. Simply deleting visible spam leaves the original weakness.
Recover deliberately
Restore only from a known-clean point, test in isolation and monitor after reopening. Notify affected users and authorities when law or the nature of exposed data requires it.
Search Console can reveal hidden impact
Unexpected indexed titles, security warnings or new URL patterns may appear before the homepage changes visibly. Compare sitemap URLs with indexed reports and server files, but do not delete evidence before investigation.
Communicate accurately
If users were exposed, describe what happened, the affected period and the action they should take. Avoid claiming the incident is resolved until credentials, persistence and the original entry point have been addressed.
Collect evidence from different views
Check rendered behavior from search referrals and mobile visitors, response headers, file hashes, timestamps and scheduled jobs. Review unfamiliar analytics changes and other sites sharing the same account. Preserve the evidence before broad cleanup where practical.
Take the site offline or restrict it if visitors are at risk. A maintenance response can reduce exposure while investigation continues.
Verify recovery beyond the homepage
Check the integrity and date of the recovery source and reconcile current business data. Verify administration, scheduled jobs and public pages. Request a search or browser security review after cleanup and external checks, and document monitoring for the missed technique.