Has Your Website
Been Hacked?
6 Warning Signs

A Hacked Website Rarely Announces Itself

There's a version of getting hacked that lives in people's heads: a defaced homepage, a ransom note, something you'd notice the second you opened the browser. That version is rare. The version that actually happens to South African small business sites is quieter — the homepage looks completely normal, the contact form still works, and underneath it, a script is quietly serving spam links to Google's crawler or redirecting one visitor in twenty to a gambling site in another country.

That's what makes it dangerous. Most business owners only find out when a customer mentions something odd, or when Google removes the site from search results entirely — by which point the damage has usually been sitting there for weeks. The six signs below are the same ones we check for on every audit, in the order that actually catches a compromise fastest.

The 6 Warning Signs, Checked in Order

1. Strange redirects to sites you don't recognise

Load your homepage on your phone, on mobile data, in a private/incognito window. If you land somewhere other than your own site — a pharmacy ad, a gambling page, or a foreign-language storefront — that's an injected redirect script, and it's usually the single most obvious sign of the six. Hackers often make it "cloaked" so it only triggers for mobile visitors coming from Google, not for you browsing normally on desktop, which is exactly why business owners miss it for so long.

2. A "This site may be hacked" label, or a Search Console alert

Search your business name on Google and look directly under your listing for a small red warning. Then check Google Search Console (free, and every business should have it connected) under Security & Manual Actions — a real compromise almost always triggers an alert there days before it shows up anywhere else, because Google's crawler finds the injected code before a human visitor ever does.

3. Spam pages indexed under your own domain

Type site:yourdomain.co.za into Google and scroll through every result. On a clean site, you'll see only the pages you built. On a compromised one, you'll often find dozens of pages you never created — usually pharmaceutical, gambling, or counterfeit-goods spam, generated automatically to piggyback on your domain's existing trust with Google. This is one of the fastest checks on the list and one of the most reliable.

4. A sudden, unexplained drop in traffic or rankings

If Google Analytics or Search Console shows a sharp, unexplained fall in organic traffic — not a slow decline, but a cliff — check the date against any of the other five signs on this list. Google actively de-prioritises and can fully remove compromised sites from its index while a security issue is unresolved, and that traffic doesn't recover until the site is cleaned and a reconsideration request is approved.

5. Admin users or files you don't recognise

Log into your CMS or hosting control panel and check the full list of admin and FTP users — not just the ones you use day to day. A single unfamiliar account with admin rights, or a batch of files with recent timestamps you didn't create, is a direct sign of unauthorised access, and it's the one most business owners never think to check until something else has already gone wrong.

6. A browser or antivirus "deceptive site" warning

If Chrome, Safari, or a visitor's antivirus software shows a red "Deceptive site ahead" or "This site may harm your device" screen before the page even loads, that's Google Safe Browsing or the antivirus vendor independently flagging malware they've already detected on your server. By the time this warning appears, the compromise has usually been active long enough to be picked up by multiple independent scanners — which means it's the loudest sign, but also often the last one to appear.

What to Do If You Recognise Any of These

Finding one of the six signs above doesn't mean your business is finished — it means you caught it, which most owners don't do until Google forces the issue. The recovery sequence matters more than speed alone:

1. Back up the site exactly as it is now. Before cleaning anything, take a full backup — you may need it for forensics, and a rushed cleanup can destroy the evidence of how the attacker got in.
2. Scan for malware. Most hosts offer a scan through the control panel, or use a dedicated service like Sucuri or Wordfence if you're on WordPress — the scan will usually point directly to the injected files.
3. Change every password tied to the site. Hosting, CMS admin, FTP, and any connected email — from a device you're confident is clean, not the one that may have been compromised in the first place.
4. Request a Google security review. Once the site is genuinely clean, submit a reconsideration request through Search Console — this is what actually lifts the "may be hacked" label and restores your rankings.

Every one of these steps is a one-time fix once it's done properly — the real cost isn't the cleanup, it's the weeks of lost search visibility while the compromise sat there unnoticed.

Why Small SA Businesses Get Targeted at All

Almost nobody hacks a small business website for the data sitting behind it. What they're after is your domain's existing reputation with Google — a legitimate, aged, reasonably-trusted domain is valuable real estate for injecting spam links or quietly redirecting traffic, and it's cheaper to compromise than to build that trust from scratch. Automated bots scan thousands of sites a day looking for one specific thing: outdated plugin versions and reused, weak passwords. They don't care how big your business is. They care whether the door was left open.

What CJX Studios Does Differently

Every CJX Studios site is hand-built rather than assembled from a stack of third-party plugins and themes — which removes the single biggest entry point small business sites carry. Hosting runs on monitored, data-centre infrastructure with automatic security patching, admin access is locked down and logged, and uptime and file integrity are checked continuously. None of this is an upsell added later; it's the baseline every site launches with, checked before you ever see your free 48-hour demo.

Go Deeper: Related Guides

Frequently Asked Questions