How to tell if your website has malware

What you'll achieve

• recognize the usual signs of an infected website;
• check in a few minutes what Google sees about your website;
• know what to do next, without destroying the evidence.

The usual signs

• Strange redirects: visitors end up on betting sites, pill sites or “you've won a phone” pages, especially on phones or when coming from Google.
• Foreign pages in Google: when you search for the website, titles in Japanese or Chinese, or ads for medicines, show up that you didn't write.
• The red warning in the browser: “The site ahead contains harmful programs” or “Deceptive site ahead”.
• Emails sent on their own: customers receive spam from your addresses, or your messages suddenly land in spam everywhere.
• New things you didn't do: an unknown WordPress administrator, plugins you didn't install, .php files with meaningless names, files modified overnight.
• The website suddenly slows down or uses far more resources than usual, without more visitors.

The steps

A. Check what Google sees

1. Search Google for site:domeniul-tau.ro. Browse a few pages of results: any title you don't recognize is a warning sign.
2. Check the domain in the Google Safe Browsing report: https://transparencyreport.google.com/safe-browsing/search. It tells you whether Google considers it unsafe.
3. If you have Search Console (see Google Search Console: connect your website to Google), open Security & Manual Actions » Security issues. Google writes exactly what it found there, with example addresses.

B. Check the website the way a visitor sees it

4. Open the website in a private window, on your computer and separately on your phone, using mobile data.
5. Search for the website on Google and open it from the results, not by typing the address: some infections are only triggered that way.
6. On your computer, right-click » View page source. Look for scripts pointing to domains you don't recognize, or long chunks of meaningless text (for example with eval(, base64_decode or String.fromCharCode).

C. Check the files and accounts

7. In Enhance, on the website page, the “Files” tab: look at the modification dates in public_html, in wp-content and of the .htaccess file. A .htaccess with hundreds of lines of redirects that you didn't add is a clear sign.
8. There should be no .php files in wp-content/uploads.
9. In WordPress, under Users, filter by Administrator and check every account.
10. Under Plugins, look for plugins you didn't install.

D. What to do if you find something

11. Don't rush to delete everything. First take a backup of the current state (the “Backups” tab » “Create backup”): it helps us find out how the attacker got in.
12. Write to us as soon as possible: restoring from a backup from the last 7 days is free, and the sooner we catch it, the more likely there is a clean backup.
13. For WordPress, the cleanup steps are in Your WordPress website was hacked: what to do, step by step. For a website without WordPress, restore from the clean backup (see Backup and restore from Enhance), then change all passwords (see Strong passwords and two-factor authentication, everywhere).

How to keep it away

• Keep everything up to date: WordPress, plugins, themes, the PHP version (see WordPress updates and security in Enhance and The PHP version and PHP settings).
• Unique passwords and two-factor authentication (see Strong passwords and two-factor authentication, everywhere).
• Correct permissions and no PHP in the image folder (see File permissions: 644, 755 and what you never set).
• No pirated plugins or themes (see The plugins a WordPress website needs).
• Search Console connected to the website: Google notifies you by email when it finds a security issue.

If something doesn't work

• Google shows the warning, but you can't find anything. The infection may only show to some visitors. Look in Search Console at the example addresses Google gives and send them to us.
• The antivirus on your computer blocks the website. Take it seriously: go through steps A and B. If everything is clean, it may be a false alarm from the antivirus; send us the name it reports.
• Your emails are rejected with messages about spam. It could be an address with a stolen password, or a script on the website that sends mail. Change the passwords of your email addresses and write to us: we'll check where the messages are coming from.