How to Check if Your Website Has Been Hacked (2026)

⚠️ Warning Signs Your Site May Be Compromised

Unexpected redirects to spam or malware sites
New admin accounts you didn't create
Google Search Console showing "Site has been hacked"
Unusual traffic spikes or server CPU usage
New <iframe> tags or eval() calls injected in HTML
Modified files with recent timestamps you didn't edit
Visitors reporting antivirus warnings when visiting your site

Step 1: Check for Malicious Redirects

🛠 Try Our Tool: URL Safety Checker → — Checks your URL against URLhaus and PhishTank instantly.

Run these commands from your terminal to check for suspicious HTTP redirects:

# Check HTTP response headers for redirects
curl -I https://yourdomain.com
curl -I https://www.yourdomain.com

# Follow redirects and show each hop
curl -L -v https://yourdomain.com 2>&1 | grep "Location:"

# Check for injected iframes (common malware payload)
curl -s https://yourdomain.com | grep -i "iframe"

# Check for obfuscated JavaScript
curl -s https://yourdomain.com | grep -i "eval("
curl -s https://yourdomain.com | grep -i "document.write"

# Check for suspicious base64 encoding (common in PHP malware)
curl -s https://yourdomain.com | grep -oP "base64_decode\(|atob\("

Step 2: Find Web Shells on Your Server

⚠️ Note: Run these commands on your server via SSH or in your hosting control panel's terminal.

# Find PHP files modified more recently than your index file
find /var/www -name "*.php" -newer /var/www/index.html 2>/dev/null

# Look for common web shell filenames
find /var/www -name "shell.php" -o -name "cmd.php" -o -name "backdoor.php" -o -name "c99.php"

# Search for suspicious PHP functions in all files
grep -rl "eval(" /var/www/ 2>/dev/null
grep -rl "base64_decode" /var/www/ 2>/dev/null
grep -rl "system(" /var/www/ 2>/dev/null
grep -rl "exec(" /var/www/ 2>/dev/null
grep -rl "passthru(" /var/www/ 2>/dev/null

# Find recently modified files (last 7 days)
find /var/www -name "*.php" -mtime -7 2>/dev/null

Step 3: Check Google Safe Browsing Status

Google flags websites known to distribute malware. Check your site's status:

Visit Google Transparency Report and enter your domain
Check Google Search Console → Security Issues
Use Sucuri SiteCheck for a free malware scan

# API check (requires a free Google API key)
curl -s "https://safebrowsing.googleapis.com/v4/threatMatches:find?key=YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"threatTypes":["MALWARE","SOCIAL_ENGINEERING"],"platformTypes":["ANY_PLATFORM"],"threatEntryTypes":["URL"],"threatEntries":[{"url":"https://yourdomain.com"}]}'

Step 4: Check Your SSL Certificate

🛠 Try Our Tool: Certificate Decoder →

# View full certificate details
openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -text -noout

# Check certificate expiry (exit 0 = valid, exit 1 = expires within 24h)
echo | openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -checkend 86400

# Check who issued the certificate
openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -issuer -noout

# Check the certificate's Subject (should match your domain)
openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -subject -noout

Step 5: Check for Suspicious Outbound Connections

Malware often establishes reverse shells or C2 (command-and-control) connections to attacker servers:

# See all established outbound connections from your server
netstat -anp | grep ESTABLISHED
ss -tnp | grep ESTABLISHED

# Look for reverse shells (common attacker ports)
netstat -anp | grep -E ":(4444|31337|1337|6666|9001|8888)"

# Check which processes are making network connections
lsof -i -n -P | grep ESTABLISHED

# Look for unusual listening ports
netstat -tlnp | grep -v -E "(80|443|22|25|3306)"
ss -tlnp | grep -v -E "(80|443|22|25|3306)"

✅ Prevention Checklist

Keep your CMS (WordPress, Drupal, etc.) and all plugins updated
Use strong unique passwords — generate one: Password Generator →
Enable 2FA on all admin accounts using our TOTP Generator
Use a Web Application Firewall (WAF) — check yours with our WAF Detector
Set up file integrity monitoring (inotifywait, OSSEC, or Wordfence)
Take daily automated off-site backups
Run find /var/www -name "*.php" -mtime -1 daily via cron
Review your Google Search Console weekly