Your Website Got Hacked and Google Told You First

Nobody is holding your website for ransom

When owners picture a hacked website they picture a skull on the homepage and a demand for Bitcoin. That almost never happens to a small business site. What actually happens is much quieter and much more expensive.

Somebody gets into your site, adds a few hundred pages you can’t see, and starts using your domain to rank spam. Your homepage looks completely normal. Your contact form still works. And Google is slowly deciding your site is a pharmacy.

How you find out

Usually one of four ways, and all of them are late.

A customer calls and says their browser blocked your site with a red warning page. Your Google Ads account gets suspended for "compromised site." Your web host emails you about suspicious activity or suspends the account. Or you search your own business name and see results with Japanese characters or drug names under your domain.

By the time any of those happen, the attacker has usually been in for weeks.

What the hack actually looks like

The most common version is SEO spam with cloaking. The site serves normal pages to you, because you’re logged in and coming from a normal browser in Florida. It serves spam pages to Google’s crawler. And it redirects visitors who arrive from a Google search on a phone to something you’d never want your name near.

That’s why so many owners insist the site is fine. Their own experience of it is fine. That’s the design.

The other common version is a hidden admin account and a backdoor file, kept quiet so the site can be used later for phishing pages or to send email blasts that get your domain blacklisted.

How they get in

• The abandoned plugin. A contact form or slider plugin that hasn’t been updated by its developer since 2021. A vulnerability gets published, automated scanners find every site running it within days, and yours is one of thousands. Nothing personal.
• The theme you bought once. Premium themes bundle other plugins inside them. Those bundled copies often don’t update with the rest of your site.
• A nulled or pirated theme. Whoever cracked it added something. That’s the business model.
• Weak admin logins. A username of admin and a password your developer set in 2019. Bots try thousands of these a day against every WordPress site on the internet, including yours, right now.
• Shared hosting neighbors. On cheap plans, one compromised site on the same server can spread sideways into yours.
• The freelancer’s laptop. Your credentials are saved in an FTP client on a computer that got infected. The attacker doesn’t need to guess anything.

What it costs

This is why it matters more than the dead simple fix would suggest. Getting flagged by Google Safe Browsing means Chrome shows a red interstitial to everyone who clicks your link. Your organic traffic goes to roughly zero the same day. Getting reinstated requires cleaning the site and requesting a review, and reviews take days.

Rankings you built over years can take months to come back, because Google now has a history of spam on the domain. Your Google Ads account may be suspended the whole time. If your domain also sends your business email, being blacklisted for spam means your quotes start landing in junk folders.

For a service business that gets most of its calls from search, that’s not an IT problem. That’s a revenue problem.

How to not be an easy target

Update on a schedule, not on a whim. Core, plugins, and themes. Enable automatic updates for security releases at minimum. The "I’ll do it later" gap is where most of these live.

Delete what you don’t use. An inactive plugin is still code sitting on your server, and inactive plugins can still be exploited. Same for old themes. If you’re not using it, remove it, don’t just deactivate it.

Put MFA on wp-admin. Every admin user, no exceptions. This alone kills the majority of brute force attempts.

Give people the access they need, not admin. Your content person writing blog posts is an editor, not an administrator.

Limit login attempts and use a firewall plugin. Wordfence and similar tools block the noisy stuff automatically and tell you when something’s off.

Back up off the host. If your only backups live on the same server as the site, a compromise takes both. Get copies somewhere separate, and test that one actually restores.

Consider managed hosting. Managed WordPress hosts handle updates, scanning, and cleanup as part of the plan. For most small businesses, the extra $15 a month is cheaper than one bad week.

If it already happened, do not just delete the file

Finding the spam page and removing it feels like a fix. It isn’t. The way in is still open, and the backdoor is usually somewhere else entirely.

Do it properly. Take the site offline or put it in maintenance mode. Change every password involved, including hosting, database, FTP, and every admin user. Look at the user list and remove accounts you don’t recognize. Restore from a backup taken before the compromise if you have a clean one, and if you don’t, get a professional cleanup rather than guessing. Then request a review through Google Search Console and watch your search results for a couple weeks to be sure it’s actually gone.

Then fix the thing that let them in, or you’ll be doing this again in a month.

If you’re not sure whether your site is clean, that uncertainty is worth resolving today. We help small businesses from Delray Beach to West Palm keep their sites and email out of trouble, and we’re always happy to troubleshoot.