My website was hacked and is showing spam

What you can do

1. Why spam on the site costs a call

   Open the address the way a customer would. A plumber, a roofer, a landscaper, and a contractor can use the same pass. If the page is about gambling, pills, or a language you do not use, that person does not see the jobs, the towns, or a number to tap. Some people leave as soon as the page looks wrong. Google Search help says you will see "This site may be hacked" when Google believes a hacker might have changed existing pages or added new spam pages, and that a visit could be redirected to spam or malware. Google tells searchers not to visit while that message is on the result. The Search Central blog says the same message can mean the site was hacked to display spam. A red browser screen that says "Deceptive site ahead" is a different warning. Google says that screen can mean the site may be serving phishing or social engineering, and that a hacker can use an ordinary site to do that. Search Central describes social engineering as content that tricks a visitor into something dangerous, such as revealing confidential information or downloading software. Search Console says pages with a security issue can show a warning label in results or a warning page in the browser. Either one can stop the call before the phone number is on the screen. This page does not promise that removing the spam will bring a set number of calls.

   Source: Spam policies, including hacked content (Google Search Central); "This site may be hacked" (Google Search Help); How do I know if my site is hacked? (Google Search Central Blog); Social engineering and "Deceptive site ahead" (Google Search Central); Security issues report (Search Console Help)

2. What a critical error and a redirect are

   The sentence "There has been a critical error on this website. Please check your site admin email inbox for instructions." is a WordPress message. WordPress.org says it means something on the site caused a critical error that prevents WordPress from running as expected. The same page lists plugin conflicts, a theme problem, an incompatible PHP version, the memory limit, and corrupted files among the causes. A critical error is not, by itself, proof of a hack. If you also see spam pages, an administrator you do not know, or a Google warning, treat a hack as possible and use this guide along with the guide on a site that is down. That guide covers the recovery mode email. A redirect is a different sign. Google's spam policies say a hacker can inject code that sends some visitors to another site, and that the redirect can depend on the referrer, the browser, or the device. The example Google gives is a visit from search results that jumps away, while typing the same address shows your page. A bad ad can also redirect people. The Search Central blog calls that malvertising, and says it can look like a hack when it is an ad. Write down whether the jump happens from Google, on a phone, or on every visit. Do not follow the redirect into a page that asks for a card or a password.

   Source: Common WordPress errors, including the critical error (WordPress.org); Spam policies, including redirects (Google Search Central); How do I know if my site is hacked? (Google Search Central Blog)

   On this site: My business website is down or showing an error

3. A 10 minute self check

   Set aside about 10 minutes. Do not click through a red browser warning on the computer you use for the bank and the books. Google tells searchers not to open a result that says "This site may be hacked" until that message is gone. Search Console says a Safe Browsing warning can depend on the browsing context, so you may not be able to reproduce it, and that the Security Issues report is the source of truth. For malware, Search Console also says to avoid opening an infected page in a browser, because malware can use a browser weakness. Use the checks below first. In Google, search site: immediately followed by your domain, with no space, as in the shape on Google's site: help page. Google's prevent-malware page says to do this from time to time, and that unknown pages, or topics you did not write, can mean the site was hacked. A site: search does not list every indexed URL. Search Console help also says to try a site: search for spam words you do not offer, and it uses a pharmaceutical word as the example. If you saw gambling, pills, or a language you do not use, search site: plus your domain plus one of those words. Write down every address that is not a page you published. Google documents one spam pattern, on web.dev, as the Japanese keyword hack. A page in a language you do not use is a reason to write the address down. That article is the reference for that one pattern. It is not proof that every page in another language is that hack. Then look on a phone and in a private window, also called incognito. The Search Central blog says to view the site from a mobile browser in incognito mode, and to check that the phone and the computer show the same content. Google's spam policies say a redirect can depend on the device. Sign out of the builder first, or use the private window, so you are not looking at the editor view. If the private window or the phone shows spam, or jumps to another site, and the signed-in view looks normal, customers are seeing the bad page. Write down the words and the full address. If you can sign in to Search Console, open the Security Issues report. Search Console says that if Google decides the site was hacked, or that it could harm a visitor or their computer, that report shows the findings. A green check means the report has no security issues. A count at the top means it does. Expand an issue for sample addresses. Search Console says that list is a sample, not every page, and that an issue can have no sample addresses. The report also shows the date the issue was first detected. Google's prevent-malware page says the same report shows hacked pages Google has identified. This page does not sign in for you. If you do not have Search Console yet, Google's search help says to register and verify the site, then open Security Issues. Last, open the Google Safe Browsing site status page and enter your domain. web.dev says that transparency report shows public information about whether a site is potentially harmful. Search Console help says that if you are not the verified owner, you can use that report, and that a dangerous mark means the site needs to be fixed. The Search Central blog says a clean Safe Browsing verdict does not mean the site was not hacked to distribute spam. Spam and a dangerous mark are different checks. Write down what the status page says. The free checker on this site reads one public page and reports HTTPS and the response status. It logs the website address and the score, not personal data. It does not open Search Console, it does not read the Safe Browsing status, and a normal status on the homepage does not prove the other pages are clean.

   Source: site: search operator (Google Search Central); Prevent malware, including a site: search (Google Search Central); Security issues report (Search Console Help); Why a site is labeled dangerous (Search Console Help); "This site may be hacked" (Google Search Help); Safe Browsing site status (Google Transparency Report); Assess spam damage (web.dev); Fix the Japanese keyword hack (web.dev); How do I know if my site is hacked? (Google Search Central Blog)

   On this site: Free website checker

4. Safe first steps

   Do not start by deleting pages, plugins, or the whole site. WordPress.org says the first actionable step is to write down what you are seeing, when you noticed it, and what you changed lately, such as a new plugin or a theme edit. A backup you make after the spam appeared can contain the spam. web.dev says to note when the suspicious activity happened, because that helps you tell which older backup might still be clean, and to back up the site before you remove files, in case you need to put a file back. Search Console says that when you are ready to clean, you can replace affected files with the last good backup, or remove the spam yourself. Deleting at random can remove the real pages and leave the way in. Contact the host before you delete anything. Tell them the exact words on the screen, and ask whether they have a backup from before the spam and whether they can restore it. WordPress.org says to ask the host what their backup policy is. On shared hosting, WordPress.org's hardening guide says a compromised site on the same server can put your site at risk even if you follow the guide, and it says to ask the host what precautions they take. If the host already suspended the account, use the contact on a bill you already have, not a link in an email you did not expect. Change the hosting password and the admin password, and do not reuse the old ones. WordPress.org says a password is one piece of the problem, and that access points include FTP or SFTP, the WordPress admin, the host control panel such as cPanel, and the database. It says to use long, unique passwords, and to reset passwords for every user who can get in, especially administrators. It also says to update the secret keys in wp-config.php so people who are already signed in are signed out. If you do not edit files, leave the secret keys to the host or to the person who edits the site. Do not paste a password into a chat or into a plugin you do not recognize. Remove administrator accounts you do not recognize. On WordPress, open Users. WordPress.org says that screen can delete a user. Hover the row and use Delete. The account you are signed in with does not show Delete. If you are not sure which account is yours, stop and get help. Do not delete your own login. Restore a clean backup only when you know it is from before the spam. WordPress.org says a backup of the database and the files is what you put back when something goes wrong, and that you should back up before an upgrade. A restore replaces the current files and database with that copy. Pages you wrote after the backup date can be lost. If you do not know the date of the backup, ask the host before you restore. After a clean copy is back, update WordPress itself, the plugins, and the themes. WordPress.org's Updates screen says that before upgrading you should back up the database and files, and that the screen can update the core, the plugins, and the themes. WordPress.org's hardening guide says to keep the software current. An update does not, by itself, remove spam that is already in the database. For a malware issue, Search Console says the fix can require reading code, and it points people who are past their comfort to get help. This page is general guidance. It is not a guarantee.

   Source: FAQ: My site was hacked (WordPress.org); Hardening WordPress (WordPress.org); Backups (WordPress.org); Users screen (WordPress.org); Dashboard Updates screen (WordPress.org); Identify the vulnerability (web.dev); Fix the Japanese keyword hack, including a backup first (web.dev); Security issues report (Search Console Help)

5. On WordPress

   Sign in at the address with /wp-admin on the end, if you can. If the critical error is up, use the down guide and the recovery email before you hunt for spam. If you can sign in, open Users and remove administrators you do not know, as the Users screen describes. Open Dashboard, then Updates, and update core, plugins, and themes after a backup, as that screen says. Then look at Pages and Posts for titles you did not write. Do not delete a page until you are sure it is not a real job page with spam added to it. WordPress.org says finding and removing the hack is the hard part, and that the steps depend on what happened. Replacing core files, editing wp-config.php, and reading the database are jobs for the host or for someone who does this work, if you do not already edit those files. Ask the host to restore a backup from before the spam if you have one. Then change the passwords WordPress.org lists: FTP or SFTP, the admin users, the host panel, and the database. Update the database password in the place the host shows you, or the site can lose its connection. Leave that pairing to the person who edits the site if you are not sure. When the public pages are the real business again, use the review steps below. A new site is a separate ask if the old one cannot be cleaned.

   Source: Users screen (WordPress.org); Dashboard Updates screen (WordPress.org); FAQ: My site was hacked (WordPress.org); Backups (WordPress.org)

   On this site: My business website is down or showing an error

6. On Wix

   Wix says its sites are malware free, and also says that code you add with the HTML app or with Velo can contain malware. Wix says that if it detects malicious code, it takes the site down. Review any custom code you added, and remove code that did not come from a source you trust. After the code is gone, or if you think the report is wrong, Wix says you can submit a request to be removed from the malware list. That request is Wix's process. It does not replace the Google review below. Change the Wix account password. Wix says you do that in Account Settings, then Edit Password, and that a password must be at least 6 characters, with at least 12 recommended. Use a password you do not use for email. If you cannot see a screen that matches that article, contact Wix and describe the spam or the warning. Do not delete the site to make the warning go away.

   Source: Site reported for malware (Wix Help); Changing your Wix password (Wix Help); Security issues report (Search Console Help)

7. On Squarespace

   Squarespace's help page for Google warnings says you might see "This site may be hacked" under the result. Squarespace says Google applies that message when something seems suspicious, which can include normal content, especially content with external text formatting, and Squarespace says the message was most likely triggered by content you added, not by a hacker. Check before you assume the site was taken over. Squarespace says to verify the site in Search Console, open Security Issues, remove the content that triggered the message, and request a review. Squarespace also says a red warning that says "The site ahead contains malware," or "Deceptive site ahead," is managed by Google, not by Squarespace SSL or DNS settings. Squarespace says it cannot remove those warnings. Google's own pages, above, still say a hacker can put spam or social engineering on a site. Use Security Issues to see which one you have. Change the Squarespace password. Squarespace says a new password applies to all sites and other subscriptions on that account. Remove contributors you do not recognize. Squarespace says only an owner or an administrator can remove another contributor, and that removal takes away their access. If you added custom code from a source you do not know, remove it, then request the Google review. Squarespace says Search Console itself is outside Squarespace support.

   Source: Resolve Google security warnings (Squarespace Help); Resetting your Squarespace password (Squarespace Help); Remove a contributor (Squarespace Help); Security issues report (Search Console Help)

8. On GoDaddy

   GoDaddy's hacked-site article is written for Web Hosting (cPanel) and Windows Hosting (Plesk). It says to change the passwords for that hosting type: primary and secondary FTP, databases, and apps such as WordPress. It says to restore a backup of the site and the database that you know was not corrupted. It says it is nearly impossible to reliably remove malware by hand. If that is the screen you are on, ask GoDaddy or hire help rather than deleting files one by one. GoDaddy's redirects article says attackers can add code that sends visitors to another site, and it says to change FTP, database, and application passwords, and to update themes, plugins, and extensions. If your product is Websites + Marketing and you do not see FTP or a database password, do not invent those screens. Contact GoDaddy, tell them the words on the page, and ask about a backup from before the spam. The WordPress section above still applies when the site is WordPress, including WordPress hosted at GoDaddy, for users, updates, and unknown administrators. Do not change DNS records while you are guessing.

   Source: My website was hacked. What should I do? (GoDaddy Help); Malicious redirects (GoDaddy Help)

9. Request a review after the cleanup

   Do this only when the public pages are the real business again, in a private window and on a phone, and when the way in has been closed. Google's search help says the "This site may be hacked" message is not removed until the owner takes action, and that you should request a review in Security Issues when the entire site is clean and secure. It also says that if you do not fix the security issue, the site is likely to be reinfected. Search Console says to fix every issue on the report, on the whole site, because fixing some pages does not earn a partial return. Then select Request Review. A useful note, Search Console says, explains the issue, describes the steps you took, and documents the outcome. web.dev says that for each kind of hacked spam, include a short line about how you cleaned it, such as removing the spam and updating an outdated plugin. web.dev also says the site has to be back online, the vulnerability corrected, and the vandalism cleaned, and that you should be a verified owner, before you request the review. Do not send the request while the spam is still up. Search Console says a request sent before the issue is fixed can make the next review take longer. Search Console says most reviews take several days or weeks. web.dev says a review for a site hacked with spam can take up to several weeks, and that if Google finds the site is clean, warnings in browsers and search results are removed within 72 hours. Those are Google's time frames, not a promise that your review will pass. You get email when the request is received and when it is done. Do not send a second request before you have a decision. If the review is not approved, Search Console can show more sample addresses. Clean those, then ask again. This page is general guidance. It is not a guarantee that the warning will come off, or that calls will return.

   Source: "This site may be hacked" (Google Search Help); Security issues report (Search Console Help); Request a review (web.dev)

10. What you can fix, and when to get help

    You can do the 10 minute pass yourself. You can change a password on a screen you understand, remove an administrator or a contributor you are sure you do not know, and ask the host, in writing, for a backup from before the spam. You can request the Google review after the public site is clean. Hand the rest over. That includes file edits, wp-config.php, DNS, a database password you are not sure how to pair, and any delete you cannot explain. Search Console says to get help when a malware fix is past your comfort, and WordPress.org says you can do the work or engage a professional. One change at a time, then look again in a private window and on a phone. If the whole site is a critical error and there is no spam page to read, use the down guide first. If the screen is only a placeholder that says the site is not ready, use the guide on a site that still says it is under construction. If you want a new site because this one cannot be cleaned, ask on the start page.

    Source: Security issues report (Search Console Help); FAQ: My site was hacked (WordPress.org)

    On this site: My business website is down or showing an error; My website says coming soon or under construction

11. Check the page, or ask for help

    If the homepage loads, start with the free website checker. It reads one public page and reports HTTPS and the response status. It logs the website address and the score, not personal data. It does not open Search Console, and it does not read a Safe Browsing status. A normal status does not mean the site is free of spam. Website Quick Diagnostic is $19, paid once. An automated PDF within about 1 hour with your speed and mobile scores, the top 5 issues ranked, and a plain fix for each. The $19 is credited toward the $99 Checkup within 30 days. Website Checkup is $99, paid once: a ranked report of what to fix on your website first, covering speed, SEO, mobile, and AI search visibility, delivered within 2 business days. No login is needed. The report goes only to you. If the site is down and there is nothing to check, you get a refund. Those checks describe a page they can fetch. They do not remove spam, change a password, or request a Google review. If you want a new site, ask on the start page.

    On this site: Free website checker; Website Quick Diagnostic; Website Checkup; Start a site quote

Check a page now

The free website checker reads one public URL. It reports HTTPS, a mobile viewport tag, and whether GPTBot, ClaudeBot, PerplexityBot, and Google-Extended are blocked. It logs the website address and the score, not personal data.

The AI search readiness check is the free look for AI search. It reports whether OAI-SearchBot, ChatGPT-User, and PerplexityBot are blocked, and whether the words are in the server HTML. It logs the website address and the score, not personal data.

Website Checkup is $99, paid once. A ranked report of what to fix on your website first, covering speed, SEO, mobile, and AI search visibility, delivered within 2 business days. No login is needed. The report goes only to you.

FAQ

More guides

• Why your business is not showing up on Google

  A business can be missing from Google because the page is not in the index, because the words you searched are not the words a customer uses, or because the page is blocked. A page can also be in the index and still sit far down the results. The free check on this site reads the public page, and it does not look up a rank.

• How much a small business website audit costs

  You can check a public page for free. The checker on this site reads one URL, reports what it found, and logs the website address and the score, not personal data. If you want a report that ranks what to fix first, Website Checkup is $99, paid once, and it is delivered within 2 business days.

• How much does a small business website cost

  If you build it yourself, published US prices checked for this page start at $4 a month on WordPress.com when billed annually, $17.77 a month on Wix Light for a yearly plan, or $19 a month on Squarespace Basic billed annually ($228 for the year). If you hire an agency, Clutch says web design agencies typically charge $2,000 to $100,000, and that most reviewed projects cost less than $10,000. If Telep IO builds it, the founding offer is $500 to set up, then $50 a month. Limited to the first 3 Ohio businesses. The start page splits that setup into two payments and makes the first upkeep month free, which comes to $1,050 in the first year, then $50 a month.

• What website maintenance costs a small business

  Website maintenance is the work that keeps a live site reachable and current: hosting, domain renewal, SSL, backups, software and plugin updates, security, small content edits, uptime checks, and keeping a Google Business Profile matched to the site. You do not always need a monthly plan. You need one when you will not do that work, or when a fee is the only way the site stays hosted and edited. Other providers set their own prices. This page does not print those prices. The only prices stated here are the ones Telep IO publishes.

• How to hire a web designer for a small business

  Before you hire, ask who owns the domain and the site, what hosting costs, who edits it later, whether the page works on a phone, whether they will help with a Google Business Profile, and when you will see a first look. Walk away if you will not own the domain, if the contract locks you in, if there is no portfolio you can open, or if the monthly fee does not say what it covers. Other people set their own prices. Ranges vary. The only build price stated here is the one Telep IO publishes.

• How to get your website back from a web designer

  Start with the domain. The registrar is the company that holds the registration. The registrant is the person or business the record lists as the holder. ICANN's free lookup shows the registrar and the contact data that registrar publishes. A hidden name, or a privacy service, is not proof that you own the name. If a former designer, a relative, or an agency stopped answering, write down the lookup, then ask that registrar about the account or a transfer. If the designer refuses, talk to a lawyer. This page is not legal advice.

• My business website is down or showing an error

  First check whether the site fails for everyone, or only on your phone and your network. Then match the words on the screen to the usual cause, and contact the person who can fix that cause. This page is general information. It is not a guarantee that a step will bring the site back.

• Signs your business website needs a redesign

  Redo the site when it no longer matches the business, you cannot edit it, or a customer on a phone cannot read it and call. Many of the usual problems can be fixed without a full rebuild. Old hours, a missing call link, a page that is hard to read on a phone, and an address that is not on HTTPS are often edits. A new look does not, by itself, put the business on Google or on Maps.

• Does an outdated website hurt your business

  A visitor can miss you when the phone number is wrong, the hours are wrong, the form does not send, the page does not fit a phone, or the browser warns about the connection. An old year in the footer is a reminder to check those facts. Google says content is rated by quality, regardless of age, and that a trivial change to look fresh has no additional value. This page is general information. It is not a guarantee that fixing the page will rank higher or bring more calls.

• Wix vs Squarespace vs hiring a web designer

  A DIY builder can be the right call when you will finish the page, you will own the domain, and a customer on a phone can tap to call, see the towns you serve, and open your Google Business Profile. Hire when you will not keep the page current, when the number cannot be tapped, or when the domain and the site would sit in an account you do not control. Wix, Squarespace, and the GoDaddy website builder are typical monthly subscription plans. This page does not print their prices. Other designers set their own prices. The founding offer is $500 to set up and $50 a month, limited to the first 3 Ohio businesses. Hosting and ordinary upkeep are included. You see a demo of your own site before you pay.

• How to check if your website works on phones

  Open the site on a phone you already own and try to call the business from the page. If you have to pinch and zoom, or you cannot find the number, the page is hard to use on a phone. A viewport tag tells the browser to use the screen width. It is a setup signal, not a grade of the layout.

• Why your small business website is slow

  A page feels slow when the main photo or the headline takes too long to appear, when a tap does nothing for a moment, or when the page jumps while it loads. You can test that for free with PageSpeed Insights. It runs a lab test called Lighthouse, and it can show real Chrome visits from the last 28 days when enough people have used the page. This page is general information. It is not a guarantee that a faster page will rank higher or bring more calls.

• Why your website contact form is not working

  Send one test from a phone, then look in the inbox, in spam, and in the list of messages the form saved. A missing lead can be the message sitting in spam, going to an old address, or never leaving the page. This page is general information. It is not a guarantee that every message will arrive, or that a fix will bring more calls.

• Broken links on my small business website: how to find and fix them

  A menu item that opens a page not found screen does not show the jobs, the towns, or the phone number on that page. A customer can leave before they call. MDN calls that screen a 404 when the server cannot find the page. Google says a 404 will not, in general, hurt search performance when the address should not exist. A link you still show in the menu is worth fixing because a person taps it. This page is general information. It is not a guarantee that fixing the link will rank higher or bring more calls.

• My website says coming soon or under construction

  A customer who opens the address and sees coming soon, under construction, a parked page, or a builder message that the site was not found does not see the jobs, the towns, or a phone number to tap. Someone who found the business on a Google listing, or who heard the name from a neighbor, can leave before they call. Google says a success code does not guarantee indexing. A placeholder with little content about the business can look like a page Google excludes from Search when Google treats it as a soft 404. A private or unpublished builder site can also stay out of search results. The builder help page says which setting does that. This page is general information. It is not a guarantee that publishing the real page will rank higher or bring more calls.

• Can ChatGPT and other AI tools find your business

  An AI tool can mention your business when it has public information to use, or when a person typed the facts in. A robots.txt file can ask specific crawlers to stay off the site. That file is a request, not a record of what a tool has already saved. Blocking one crawler does not block every AI product.

• Is a Facebook page enough without a website

  A Facebook page is not a website you control. Google's guidelines say the website on a Business Profile should represent the business, and they say not to use a page created on a social media site as that website. A site you control can name the work, the towns, and a phone number a person can tap.

• What a small business website should include

  A local site should say what you do, name the towns you actually serve, and put a phone number a person can tap. It should also load on a phone. That is not a promise of a ranking or a set number of calls.

• How to show up on Google Maps for your town

  Map results come from a Google Business Profile, which is separate from the website. Google says that when you add and verify a Business Profile, customers can find the business on Search and Maps, and that only verified businesses can show their info there. A website does not create the profile. This page does not create it for you.

• How to get more Google reviews

  Ask a real customer after the job is done, and give them a direct review link from your Google Business Profile. Google lets you share that link, or a QR code, in a text or email, on a receipt, and at the counter. Do not pay for a review, do not offer a discount for one, and do not ask only the people who already said they are happy.

• How to get more calls from a trade website

  A website does not promise a set number of calls. For an HVAC company, a plumber, or a landscaper, the page can make the call easy: the number is tappable, the jobs are named, and the towns are the ones you drive. If those facts are buried, the person on the phone has to hunt.