Ask most business owners what a hacked website looks like and they will describe a black page with a skull on it, or a message from somebody claiming credit. That does happen. It is also the rarest outcome, and in a strange way the luckiest one, because you find out immediately.
The hacks that cost money are the ones that leave your site looking completely normal. You log in, everything is where you left it, the home page loads, the contact form works. Nothing tells you anything is wrong. Meanwhile the site has been quietly working for somebody else for weeks.
Why defacement is rare now
Defacing a site announces the intrusion. The moment the owner sees it, the hosting company gets a call, the site comes down, and whatever access was gained is gone. There is no money in that.
Almost everything targeting small business sites now is commercial. The attacker wants to use your site: your domain, your hosting, your search reputation, your visitors. All of that is worth more while you remain unaware of it. Staying invisible is the entire business model.
Where it actually shows up
In Google, not on your site
The most common sign is one you will never see by looking at your own website. Search your business name, or search site: followed by your domain, and you find pages you did not write. Often they are in another language, frequently Japanese, selling counterfeit goods or pharmaceuticals.
Those pages exist only for search engines. Visit the URL yourself and you may get a normal page or a not found error. The injected content is served based on who is asking, so the owner sees a clean site and Google sees a pharmacy.
Only for some visitors
Redirects are often conditional. A common pattern fires only for visitors arriving from a search result, on a mobile device, who have not visited before. That describes almost none of your own visits and most of your customers.
This is why the phone call so often comes from a customer rather than from your own testing. You are logged in, on a desktop, typing the address directly. You are the one visitor the redirect is written to ignore.
In the mail logs
A compromised site is a free mail server with a real domain attached. Spam sent through your hosting will get that domain blacklisted, and the first thing most owners notice is that their own quotes and invoices have stopped arriving at customers.
Email deliverability problems that appear out of nowhere are worth taking seriously as a security question, not just a mail configuration one.
In the admin user list
Look at Users in your dashboard. An account you do not recognise with the administrator role is close to conclusive. So is an account with a plausible name that nobody at your business has ever heard of.
Some intrusions skip this and simply add a second administrator with a name similar to an existing one, which is easy to skim past on a list you rarely look at.
The signs that are easy to explain away
Most of what a compromise does looks like an ordinary technical problem, which is exactly why it survives so long.
- The site got slower, which reads as a hosting problem rather than something running on your server that should not be
- Traffic dropped, which reads as a Google update rather than visitors being redirected before they arrive
- Bandwidth or CPU usage climbed, which reads as growth rather than someone else using the account
- A page or two started loading strangely, which reads as a plugin conflict
Any one of these has an innocent explanation. Two or three at once, appearing around the same time, deserve a proper look rather than a plugin update and a hope.
How long it usually runs
The gap between the intrusion and the discovery is the part that does the damage. In that window the search spam gets indexed, the domain reputation degrades, and the entry point stays open.
Discovery usually arrives from outside: a customer mentions being sent somewhere odd, Google Search Console sends a security warning, the hosting company suspends the account, or a browser starts showing a warning to anyone visiting.
By the time any of those happen, the cleanup is no longer just removing files. It is also requesting a review from Google, repairing whatever the spam did to your search results, and dealing with a domain reputation that takes longer to recover than the site does.
Cleaning it up is not deleting the bad file
The most common mistake after finding a compromise is removing the obvious thing and declaring it finished. Re-infection within days is normal, because the file that was found was the payload rather than the door.
- Find the entry point, not just the damage, or it happens again the same way
- Assume every credential is known: WordPress logins, hosting, FTP, database
- Check for scheduled tasks and extra administrator accounts left behind as a way back in
- Restore from a backup taken before the intrusion, which means knowing when that was
- Ask Google to review the site once it is genuinely clean
That last point is where the timing matters. A backup only helps if one exists from before the compromise, and if the compromise ran for six weeks, a two week retention window is not a recovery plan.
The honest summary
A hacked WordPress site rarely looks hacked. It looks like a site with a hosting problem, a Google problem and an email problem, all at once, none of which seem related. The cost is not the cleanup, it is the weeks before anyone realises there is something to clean up. If you want that watched continuously rather than discovered late, that is what our WordPress security and maintenance service is for.
