Updated 26 October 2026. Signs to investigate and practical first steps when you suspect a website compromise.
Unexpected pages, changed content or unfamiliar administrator accounts can indicate a website compromise. Slow performance or a failed login can also have ordinary technical causes. Treat the symptoms as a reason to investigate and establish what changed.
Warning signs worth checking
- Pages, links, redirects or search listings that your team did not publish.
- New administrators, changed permissions or unfamiliar sign-in activity.
- Files or scheduled tasks that have changed unexpectedly.
- Browser security warnings, suspicious outbound messages or hosting alerts.
Preserve evidence and contain the incident
Contact the person responsible for your hosting and website security. Record the URLs, times and symptoms, and preserve relevant logs and a recovery copy before cleanup. Agree containment measures that reduce further harm while preserving the information needed to understand the incident.
Review website, hosting and administrator access, including active sessions and integrations. Credentials may need to be changed from a trusted device. If personal information may be involved, include the appropriate business owner in the assessment and consult the OAIC’s data breach preparation and response guidance.
Remove the cause and verify recovery
Cleanup should address the entry point and any remaining unauthorised access as well as the visible content. Check the application, plugins, themes, accounts and scheduled tasks. Restore from a verified clean recovery point where appropriate, then test important pages and business functions.
HTTPS protects the connection to a website. A padlock alone does not establish that the website’s content, software or administrator accounts are uncompromised. Likewise, the absence of a search-engine warning is not a complete security check.
Check search results after cleanup
Remove injected links and spam entries from your sitemaps. Deleted spam pages should return a genuine 404 or 410 response. Review Search Console’s security and manual-action reports, and monitor for new unauthorised content as Google revisits old URLs.
Get help with website security
See MaxIT’s cyber security services and web and hosting services, or contact MaxIT to discuss an investigation and recovery plan.