Most compromised websites do not announce themselves. There is no ransom note and no defacement — just a slow bleed of traffic, a rising bounce rate, and customers who quietly stop converting. By the time the owner notices, the site has often been serving spam or malware to visitors for weeks. This guide walks through the signs your website is hacked, how to confirm a compromise rather than guess at it, and what UAE businesses specifically need to do once they find one.
Quick Answer
The most common signs your website is hacked are a Google “this site may be harmful” warning, a sudden collapse in organic traffic, unfamiliar administrator accounts, pages or redirects you did not create, unexpected changes to file modification dates, and outbound spam sent from your domain. Confirm the compromise by checking Google Search Console’s Security Issues report, reviewing recently modified files on the server, and auditing your user list — then preserve the logs before you clean anything.
The Signs, Ranked by How Often They Appear First
1. A Browser or Search Warning
The clearest signal is also the most damaging: Chrome, Safari, or Firefox showing a red interstitial before your homepage loads, or a “This site may be hacked” label under your listing in Google results. Both come from Google Safe Browsing, which flags sites distributing malware or hosting phishing content.
Check Google Search Console under **Security & Manual Actions → Security Issues**. If Google has detected something, it names the category and usually lists sample affected URLs. This is the fastest confirmation available, and it costs nothing.
2. Organic Traffic Falls Off a Cliff
A steady decline usually means an algorithm update or a competitor outranking you. A vertical drop over two or three days is different. When a site is blacklisted or when injected spam causes Google to reclassify it, traffic collapses rather than drifts.
Compare the drop date against your server’s file modification dates. If files changed shortly before the traffic fell, you have a strong lead.
3. Administrator Accounts You Do Not Recognise
Attackers who gain access almost always create a persistence mechanism, and the simplest one is a second administrator account. Review your CMS user list and look for accounts created recently, accounts with role “administrator” that should not have it, and accounts whose email address is on a domain you do not control.
Also check the hosting control panel and FTP/SSH users — a rogue account at the server level survives a full CMS reinstall.
4. Redirects That Only Fire for Some Visitors
This one fools owners constantly. Malicious redirect code is often conditional: it sends mobile visitors or visitors arriving from Google to a spam destination, while leaving direct desktop visits — the way an owner checks their own site — completely untouched.
Test it properly. Open your site on mobile data rather than office Wi-Fi, and reach it by clicking a Google result instead of typing the URL. If clients report redirects you cannot reproduce, believe the clients.
5. Pages and Content You Did Not Publish
Search `site:yourdomain.ae` in Google and page through the results. Injected spam pages — typically pharmaceutical, gambling, or counterfeit-goods content — frequently sit in directories you have never created. They are often hidden from your CMS admin entirely because they exist as raw files on disk.
6. Unexpected File Changes on the Server
A legitimate site’s core files do not change on their own. Sort your file manager by modification date, or run a recursive listing over the web root. Files modified at 03:00 on a day you deployed nothing deserve scrutiny — especially in `wp-content/uploads`, which should contain media, never PHP.
7. Your Domain Starts Sending Spam
Bounce messages for emails you never sent, a sudden spike in outbound mail volume, or your domain appearing on an email blacklist all point to a compromised script being used as a mail relay. This damages email deliverability for the whole business, not just the website.
8. The Site Slows Down Without Explanation
Cryptominers, spam relays, and botnet scripts consume CPU. If server load climbed without a corresponding rise in genuine traffic, something is running that you did not install.
How to Confirm It — Five Checks in Order
| # | Check | Where | What a positive result looks like |
|---|---|---|---|
| 1 | Security Issues report | Google Search Console | A named issue with sample URLs |
| 2 | User audit | CMS users + control panel + FTP/SSH | Accounts you cannot account for |
| 3 | Recently modified files | File manager or SSH, sorted by date | Core or upload files changed unexpectedly |
| 4 | Access and error logs | Hosting control panel | Repeated POSTs to odd paths, one IP dominating |
| 5 | External malware scan | A reputable third-party scanner | Injected scripts or blacklist status |
A note on scanners: an external scan sees only what a visitor sees. A clean external result does not prove a clean server, because backdoors sitting in PHP files produce no visible output. Treat scanners as confirmation, never as clearance.
What to Do in the First Hour
The order matters more than the speed.
**Preserve evidence before you clean.** Take a full copy of the site and database, and download the access and error logs. The moment you start deleting files you destroy the record of how entry was gained — and under UAE law, that record is what makes an incident reportable.
**Put the site into maintenance mode.** This stops the site harming visitors and stops further indexing of injected pages while you work.
**Rotate every credential.** CMS administrators, database users, FTP and SSH accounts, the hosting control panel, and — critically — the domain registrar login. A compromised registrar account allows DNS hijacking, which is far worse than a defaced page.
**Restore from a backup predating the compromise.** Use your file-modification evidence to pick the date. If your retention window is shorter than the time the attacker was present, every backup you hold is already contaminated — which is exactly why versioned, off-site backup solutions matter.
**Patch the entry point, then republish.** Restoring without fixing the vulnerability simply resets the clock. Update the CMS, plugins, themes, and PHP version, then remove anything abandoned or unused.
**Request a review.** In Search Console, submit a reconsideration request once the site is clean. Delisting usually takes a few days.
Reporting a Website Compromise in the UAE
Cyber offences in the UAE fall under Federal Decree-Law No. 34 of 2021, in force since 2 January 2022, which criminalises unauthorised access, system tampering, electronic fraud, and data theft. If customer data was exposed, obligations under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) also apply — see our guide to UAE website security requirements.
Report through the channel for your emirate: the Ministry of Interior’s eCrimes platform, Dubai Police’s eCrime service, Abu Dhabi Police’s Aman service, or the Federal Public Prosecution’s My Safe Society app. Bring your preserved logs — a report without evidence rarely progresses.
How to Make the Next Attempt Fail
Nearly every compromise we clean traces back to one of four causes: an outdated plugin or theme with a published exploit, a reused administrator password, a missing web application firewall, or an abandoned account nobody removed.
The countermeasures are unglamorous and they work. Enable two-factor authentication on every administrative login. Keep software patched, or move to managed WordPress hosting where patching is handled for you. Put a web application firewall and DDoS protection in front of the site. Enforce HTTPS with a valid SSL certificate. And delete accounts the moment someone leaves the project.
Frequently Asked Questions
Can a website be hacked without any visible change?
Yes, and it is the normal case. Backdoors, spam relays, and cryptominers are all designed to stay invisible, because a quiet compromise lasts longer than a loud one. Absence of visible damage proves nothing.
Will reinstalling WordPress remove the hack?
Not reliably. Reinstalling replaces core files, but backdoors commonly hide in the uploads directory, in plugin or theme folders, in the database, or in `.htaccess` — none of which a core reinstall touches.
How long does it take Google to remove a hacked-site warning?
Usually a few days after you submit a review request in Search Console, provided the site is genuinely clean. Submitting while infected restarts the process and can extend the penalty.
My host says the server is fine. Does that settle it?
No. Shared-hosting providers monitor server-level health, not the security of your application. A vulnerable plugin on your site is your responsibility, and the server can be perfectly healthy while your site serves malware.
Is a security plugin enough on its own?
It helps but it is not sufficient. Plugins run inside the application they are protecting, so an attacker with file-level access can disable them. Layer protection: firewall at the edge, patching at the application, backups off-site, and MFA on every login.
Need Help Right Now?
BIGBANG ITS has been supporting UAE businesses since 2003 across hosting, email, domains, and security. If your site is showing any of the signs above, our hacked website recovery service covers forensic review, malware removal, hardening, and blacklist delisting — and our website security services keep it from happening again.
Talk to our Dubai team for an assessment of your current setup.
