How can you tell if your business website has been hacked, and what do you do first?

Ascent Vision · Published October 18, 2026

The usual signs are visible ones: the site sends visitors somewhere else, pages or links appear that you never created, browsers show a security warning before the site loads, customers report strange messages that look like they came from you, or your own login stops working. First steps: take the site offline or have your host do it, change every password, keep the evidence rather than deleting things, and restore a clean backup only after the way in is closed.

Signs an owner can see

Visitors are sent to an unrelated site, sometimes only on phones.
Pages, posts or products appear that you never created, often in another language or selling things you do not.
Browsers show a warning, such as a deceptive-site notice, before your site loads.
Customers mention spam or odd messages that look like they came from you.
Your login no longer works, or your hosting company writes about a suspension.
Inquiries suddenly stop for no seasonal reason.

What to do first

The Federal Trade Commission's breach-response guide for businesses gives a sensible order: stop further damage by taking affected systems offline, but do not destroy anything, because the evidence is how the way in gets found. Change the passwords of every account that touches the site, since stolen logins keep working until they are changed.

Call your hosting company early. Many hosts can take the site offline for you, say what changed and when, and help restore a clean backup. Restoring before the entry point is fixed usually means getting hacked again.

If customer information was exposed

If the attacker reached customer details, the FTC's guide says to remove any personal information that was posted where it should not be, bring in help to find and fix the weakness, notify law enforcement, and tell the people affected so they can protect themselves. This is a plain summary of that agency's guidance, not legal advice.

Lowering the odds next time

CISA's Cyber Essentials guide for leaders of small businesses recommends automatic software updates, multi-factor authentication wherever possible, backups that run automatically and continuously, and an incident response plan that gets tested, not just written. Day-to-day prevention for a website is covered in the related answer on what website maintenance involves.

Sources

Websites, upgraded or built

Most businesses do not need a new website. They need the one they have to load fast, say clearly what they do and ask the visitor to take one step.

See the service Work with us