Monitoring your website for hacked content

The simplest way to monitor your website for hacked content is to do three things: search Google for pages on your own site that you didn't create, turn on Google's free security alerts for your domain, and spend ten minutes a week looking at your site the way a visitor would. You don't need technical skills for any of it.

Hacked content is anything added to your site without your say-so. Usually that means spam pages selling pills or promoting gambling, hidden links to other sites, or code that quietly sends visitors somewhere else. Hackers like it when you don't notice, because your site's good reputation is what they're borrowing. Here's how to notice.

How do I check Google for pages I didn't make?

Go to Google and type site:yourwebsite.com (swap in your real address, no spaces). Google will list the pages it knows about on your site. Scroll through the results and read the titles.

You're looking for anything that doesn't belong:

• Titles about medication, casinos, loans, or cheap designer goods
• Pages in a language you don't use
• Strange page addresses full of random letters and numbers
• Far more pages than you remember creating

Do this once a month. If your site has twelve pages and Google shows 4,000, something's wrong. Also click a few of your results from Google itself rather than typing the address. Some hacks only show their bad content to people arriving from a search, so you'll miss them if you only visit directly.

What free alerts can warn me automatically?

Google Search Console is a free tool from Google that shows how your site appears in search. Once you've added your site to it, it has a Security Issues section. If Google detects hacked content or malware, it reports it there and emails you.

Setting it up takes a few minutes. You sign in with a Google account, add your website address, and prove you own it. The tool walks you through the proof. After that, make sure the email notifications go to an address you actually read, not an old inbox. An alert nobody sees is no alert at all.

Your browser is a second warning system. If Chrome or another browser shows a red full-page warning when you visit your own site, treat it as urgent. Visitors will see it too, and most will leave.

What should I look for in a weekly check?

Set a recurring reminder and run through this list. It takes about ten minutes.

1. Visit your site on your phone and on a computer. Open it in a private or incognito window so you're seeing what a stranger sees. Look for pop-ups, odd banners, or a redirect to a different site.
2. Click your main buttons and forms. Hackers sometimes change where a contact form sends its messages or where a button leads. Send yourself a test message and confirm it arrives.
3. Check who has access. If your site has user accounts or an admin area, look at the list of people who can log in. Remove anyone you don't recognize.
4. Read the emails from your hosting or website provider. Security notices often land in a folder nobody opens.
5. Look at your traffic. A sudden jump in visitors you can't explain, especially from countries you don't serve, can mean spam pages are pulling people in.

If you want a quick outside opinion on how your site is doing overall, the free website grader will score an existing site. It isn't a security scanner, but it's a useful regular check-up on the basics.

What do I do if I find something?

Stay calm and go in this order:

1. Don't just delete the strange pages. If the way in is still open, they'll come back. Take a screenshot first so you have a record.
2. Change your passwords. Start with your website login, your email, and your hosting account. Use a different, long password for each.
3. Contact whoever runs your site's hosting or platform. They can see things you can't, such as server logs, and can often restore a clean copy from a backup dated before the problem began.
4. Update everything. Out-of-date software and plugins are the most common way in.
5. Ask Google to review the site once it's clean. In Search Console's Security Issues section, there's a button to request a review. Warnings usually go away after Google confirms the problem is gone.

How much of this you handle yourself depends on how your site is built. On a traditional setup where you install plugins and manage updates, most of the list above falls to you. With a builder like SimplePath, where you describe the site you want and it builds it for you, there's less machinery to keep patched. You should still run the checks above, because passwords and stray access are your side of the job on any platform. The frequently asked questions are a good place to see how SimplePath handles the running of your site.

Your next step

Do the site: search right now, then set up Search Console this week. That's the whole habit: one search, one free alert, one ten-minute check. If you spot something odd and aren't sure what it means, get in touch with us and we'll help you figure out what you're looking at.