> **How to Check If Your Website Is Hacked: 7 Signs Scans Miss** > Four checks said an art gallery's site was clean. Nine pages were gambling doorways. The 7 signs that gave it away, and how to check your own site. [Field notes](https://seoeliteagency.com/blog/)[Technical SEO](https://seoeliteagency.com/blog/#technical) # Four Checks Said Clean, Nine Pages Were Not: How to Tell If Your Website Is Hacked An art gallery we work with had nine of its pages quietly replaced by gambling pages built to rank in another country. Four separate checks called the site clean. What gave it away was a page that weighed three times what it should, and one strange day in Search Console. [Jamie Kloncz](https://seoeliteagency.com/jamie-kloncz/) Founder, SEO Elite Agency, Naples FL Published October 23, 2026 13 min read [9 sources](https://seoeliteagency.com/signs-your-website-is-hacked/#sources) One strange day in Search Console was the clearest sign of the hack. AI-generated illustration. In one paragraph A **hacked website** is one where someone has placed content or code on it without the owner's permission. Google describes hacked content as "any content placed on your site without your permission because of security vulnerabilities in your site" ([Google Security issues help, 2026](https://support.google.com/webmasters/answer/9044101?hl=en)). The hard part is that a well-built hack is designed to look clean to the owner. Check the terms ## Seven questions that catch what a scan misses Answer each one from your own Search Console and website. Every answer explains what it means. It does not scan your site and sends nothing anywhere. - Did your Search Console impressions jump on one day and then fall straight back? Yes No Worth a look. The gallery's impressions hit 48 times normal on one day, then returned to normal. Open that day and check the queries and countries. Good. Keep an eye on single-day spikes, because a hack can come and go in a day. - Are you getting clicks from a country you do not serve, on searches you never targeted? Yes No A strong warning sign. Gambling and adult searches made up most of the gallery's clicks for the whole quarter, and one foreign country drove the spike. Good. Filter the Performance report by country once a month to keep it that way. - Is any page much heavier than the rest, or does its browser-tab title differ from the one you wrote? Yes No Treat it as suspect. The gallery's About page weighed 639 KB against a 185 KB norm, under a title the gallery never wrote. Good. A rewritten title is the one thing a ranking spam page cannot hide. - Does Google's URL Inspection live test show different content from what you see in your browser? Yes No That is how cloaking looks. Google's guide says to check for cloaking by entering your URLs in the URL Inspection tool. Good. Run the live test on your home page and your top pages every few months. - Is there a Search Console owner you do not recognize? Yes No Google says you might have been hacked. Remove the owner and delete all of that owner's verification tokens, or they can re-verify. Good. Check Settings, then Users and permissions, after any agency or staff change. - Are there admins, plugins or application passwords on your site that you did not add? Yes No Remove nothing yet; record it first. The gallery had two attacker admins, a fake plugin and two application passwords that survive a password change. Good. Check from the database or with your host, because a fake plugin can hide an admin from the Users screen. - Has your contact form gone quiet for weeks? Yes No Test it now. The gallery's site email had been failing since May, 389 failed sends, and nobody knew. A site that cannot email you cannot warn you. Good. Send yourself a test submission once a month. Based on one client cleanup in September 2026 and the Google, WordPress and Apache pages cited below, read October 23, 2026. A yes is a reason to look closer, not proof of a hack. 60-SECOND SELF-CHECK ## Where does your visibility actually stand? Three quick questions. You will get an honest read on where you are winning, where you are losing the customer, and the one gap to close first. Self-check 3 questions 01 When someone Googles your main service in your city, where do you land? Top of page one Page one, not the top Page two+ or not sure 02 Do you show up in the Google map pack, the top three with the map? Yes, consistently Sometimes No or not sure 03 Ask ChatGPT or Gemini for the best in your category and city. Are you named? Yes No Never checked YOUR READ Answer the three above and your visibility read appears here. VISIBILITY READ 0% ### [Measure it for real, free](https://seoeliteagency.com/free-seo-audit/) Indicative self-check, not a diagnosis On this page - [01Why can a hacked website still look clean?](https://seoeliteagency.com/signs-your-website-is-hacked/#why-can-a-hacked-website-still-look-clean) - [02What happened on the art gallery's website?](https://seoeliteagency.com/signs-your-website-is-hacked/#what-happened-on-the-art-gallerys-website) - [03Why did four separate checks say the site was clean?](https://seoeliteagency.com/signs-your-website-is-hacked/#why-did-four-separate-checks-say-the-site-was-clean) - [04What finally gave the hack away?](https://seoeliteagency.com/signs-your-website-is-hacked/#what-finally-gave-the-hack-away) - [05What did Search Console show, and when?](https://seoeliteagency.com/signs-your-website-is-hacked/#what-did-search-console-show-and-when) - [06What else was hiding on the site?](https://seoeliteagency.com/signs-your-website-is-hacked/#what-else-was-hiding-on-the-site) - [07Why does a quiet contact form matter?](https://seoeliteagency.com/signs-your-website-is-hacked/#why-does-a-quiet-contact-form-matter) - [08What should you check on your own site this week?](https://seoeliteagency.com/signs-your-website-is-hacked/#what-should-you-check-on-your-own-site-this-week) 01 / 08 ## Why can a hacked website still look clean? Because most quick checks ask the website about itself. On the art gallery's site, nine pages had been replaced by gambling doorways, but the database was untouched, so WordPress's own search, its API, a Google site: search and the Wayback Machine all reported nothing wrong. The attack lived outside the part of the site those checks look at. This is the second guide in our series on hacked websites. The first, on [a hidden plugin the owner never saw](https://seoeliteagency.com/hidden-wordpress-malware-plugin/), covered malware that hides from a logged-in owner. This one covers pages that hide from the tools owners usually trust. The client is a Naples art gallery. We are not naming it. Nine of the 39 pages in its sitemap, including its About, Contact and Gallery pages, were serving gambling pages written for searchers in Indonesia. Each one had a new title, a new main heading and an instruction telling Google to index it. They were built to rank. When we checked, four different ways, the site looked fine. The WordPress API showed only the gallery's own pages. WordPress search found nothing. A Google site: search showed no spam. The Wayback Machine had 676 archived URLs going back to 2021, with no spam in any of them. All four answers were wrong, and they were wrong for the same reason: each one asked WordPress, or a record of WordPress, what was on the site. 02 / 08 ## What happened on the art gallery's website? On September 2, 2026, two administrator accounts were created four seconds apart. Early on September 3, a hidden file was planted, then nine doorway folders went in over nine minutes, then a Google Search Console verification file one minute later. The speed says a script did it, not a person typing. The attack on the gallery's site, in UTC ([First-party incident records, 2026](https://seoeliteagency.com/hacked-website-case-files/)) When What was added Sep 2, 14:57 Two administrator accounts, created 4 seconds apart Sep 3, 04:17 An 80 KB hidden file with a name made to look like part of WordPress Sep 3, 05:12 to 05:21 Nine folders, each holding a gambling page that replaced a real page Sep 3, 05:22 A Google Search Console verification file, to claim the site in Google's tools Nine folders in nine minutes is not someone working by hand. It is a toolkit running down a list. The verification file a minute later shows what the toolkit was for: with ownership of the site in Search Console, the attacker could submit those pages to Google for indexing. The names were chosen to blend in. Every file the attacker added was named like an ordinary WordPress file. Of the two administrator accounts, one was noisy, with a junk email address, the kind of account a cleanup finds and deletes. The other was quiet, with a name chosen to survive that cleanup. How the attacker got the access to create those accounts is unknown, and will stay that way. The host keeps access logs only briefly, and the logs we could get did not cover September 2, the day the accounts were created. We will not guess at it in print. 03 / 08 ## Why did four separate checks say the site was clean? The gambling pages were plain folders on the server, and WordPress only handles a web address when no real file or folder exists at that path. So the server sent the planted page directly, and WordPress never knew. Every check that asked WordPress, or relied on a record of what WordPress served, saw only the real site. WordPress decides which page to show using a short set of server rules. The standard rules pass a request to WordPress only when the address is not an existing file and not an existing folder ([WordPress Apache guide, 2026](https://developer.wordpress.org/advanced-administration/server/web-server/httpd/)). The server checks for a folder with a test that asks "whether or not it exists, and is a directory" ([Apache mod_rewrite, 2026](https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html)). The attacker used that. A folder named like a real page, holding its own index file, is served before WordPress is ever asked. The WordPress database still held the real About page. It just never got the chance to show it. The other two checks failed for timing and layering reasons. A Google site: search "will show you the pages that Google has indexed for your site, including the hacked pages" ([web.dev, 2015](https://web.dev/articles/fix-the-gibberish-hack)), but only the ones indexed at that moment, and by the time it was run the traffic spike was over. And a plain text fetch of a doorway showed only its spam text; the gambling site itself was drawn in by scripts in a real browser. None of these checks is bad. Each one answers a narrower question than "is my site hacked?" The useful question is different: does what the server sends match what you expect it to send? Before you read on Want to see how your own site answers these questions? Run the free audit. About 60 seconds, no email, and you get named findings, not a score. [Run myfree audit](https://seoeliteagency.com/free-seo-audit/) [Booka call](https://seoeliteagency.hbportal.co/public/69bccfccf61f1d002932ebbe) 04 / 08 ## What finally gave the hack away? A page that was far too heavy, with a title the gallery never wrote. The About page weighed 639 KB when the site's typical page weighed 185 KB, and its browser-tab title did not match the title stored in WordPress. A doorway has to rewrite the title to rank, so a title mismatch is the one thing it cannot hide. Doorway pages exist to rank for someone else's searches. To do that, they have to change what Google reads first: the title, the main heading and the indexing instructions. That is their business model, and it leaves a mark that you can check without any special tools. We compared every page in the sitemap on two things: its size in bytes and its title. Most pages sat close to a median of 185 KB. The About page was 639 KB. Its title was not the title the gallery had written. Neither number proves a hack alone, but together they point straight at the page to open. This is the check we recommend most, because it does not depend on the site telling the truth about itself. Fetch your own pages the way a stranger would, logged out, and compare what comes back with what you expect. Google's URL Inspection tool can do part of this for you: its live test "fetches and examines the URL in real time", while the default view "is not a live test" ([Google URL Inspection help, 2026](https://support.google.com/webmasters/answer/9012289?hl=en)). 05 / 08 ## What did Search Console show, and when? One day that did not fit. On September 3, the gallery's site got 112 clicks and 3,103 impressions, against a normal 1.4 clicks and 64.3 impressions a day, then went straight back to normal. Gambling and adult searches made up 79.5% of the quarter's clicks, and Indonesia drove the spike ([First-party incident records, 2026](https://seoeliteagency.com/hacked-website-case-files/)). The gallery's Search Console data around the attack ([First-party incident records, 2026](https://seoeliteagency.com/hacked-website-case-files/)) Measure Result September 3 clicks 112, against a normal 1.4 a day (about 82 times normal) September 3 impressions 3,103, against a normal 64.3 a day (about 48 times normal) Gambling and adult search terms 107 of 426 terms in the quarter Their share of the quarter's clicks 79.5% of all clicks, 49.8% of all impressions ([First-party incident records, 2026](https://seoeliteagency.com/hacked-website-case-files/)) Indonesia 103 clicks and 3,014 impressions at an average position of 4.79 United States, the real market Average position 15.77 Read that last pair again. For a few hours, the gallery ranked better in Indonesia, for gambling, than it did in its own country for art. That is what a doorway hack looks like from the owner's side: not a drop, but a strange spike in traffic the business can never use. You can look for the same shape in your own account. In the Performance report, compare countries and filter queries; Google's help even uses comparing two countries as its example ([Google Performance report help, 2026](https://support.google.com/webmasters/answer/17011165?hl=en)). Any single day far above your normal, from a country you do not serve, is worth opening. One caution. A spike can have innocent causes, such as a news mention or a rank-tracking tool. The test is what the queries are. Searches for your services are good news. Searches for things you have never sold are not. 06 / 08 ## What else was hiding on the site? A Search Console owner the gallery never added, two attacker admin accounts, a fake plugin that hid one of them and two application passwords that survive a password change. Google says an owner you do not recognize means "you might have been hacked" ([Google Search Console owners help, 2026](https://support.google.com/webmasters/answer/7687615?hl=en)). Each one had to be found and removed separately. Start with Search Console, because it is the one most owners never check. Google's help is blunt: "If you've found an owner that you don't recognize, you might have been hacked" ([Google Search Console owners help, 2026](https://support.google.com/webmasters/answer/7687615?hl=en)). Removing the owner is not enough on its own. Google says to "delete all verification tokens for this user in this property", or the removed owner can verify again. Then the admin accounts. The gallery's Users screen said "All (4)" before and after one admin was added, because a fake plugin hid exactly one administrator and lowered the count to match. The plugin had copied the header of a well-known, legitimate WordPress plugin, so it looked familiar in the file list. Then the application passwords, a WordPress feature that lets an app sign in without the main password. Two were attached to an admin account, last used from a server overseas. They matter because changing the WordPress password does not revoke them. WordPress says they are managed "from the Edit User page, you can generate new, and view or revoke existing application passwords" ([WordPress application passwords guide, 2020](https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/)). Revoke them first, then change passwords. We found no proof that these were how the attacker got in, and we do not claim it. For more on plugins that hide from the owner, see our guide to [hidden WordPress malware](https://seoeliteagency.com/hidden-wordpress-malware-plugin/). 07 / 08 ## Why does a quiet contact form matter? Because a site that cannot send email cannot warn you. The gallery's website had been failing to send email since May 25, 2026, with 389 failed sends logged, and nobody had noticed. It was not part of the hack, but it meant form messages and any site alerts had nowhere to go. We found the broken email while investigating the hack, and it is a sign worth adding to any owner's monthly checks. The site's mail log showed 389 failed sends, starting May 25, 2026. Contact form messages from that period were not delivered. There is no evidence the attacker broke the email. It is on this list for a different reason. Many security tools, plugins and hosts warn you by email. If the site cannot send, those warnings never arrive, and the first sign of trouble is whatever a customer or Google notices. The fix is simple: send yourself a test from your own contact form once a month, and check that it arrives. The gallery's mail was repaired on September 20, 2026. 08 / 08 ## What should you check on your own site this week? Check the seven signs in the questions above, starting with the two that need no technical help: open Search Console and look for a one-day spike from a strange country, and check Settings for owners you did not add. Then compare your pages' size and titles with what you expect, logged out. Here is how the gallery's cleanup was measured, so you know what "clean" can look like. The nine doorway folders and four hidden files were removed, along with the attacker's admin accounts, the fake plugin, the verification file and some old backup files that held database passwords. The cache was cleared. The About page went from 639,164 bytes back to 180,649, and its title matched WordPress again. The home page and the main page the gallery sells from were byte-for-byte identical to their measurements before the cleanup. Some items take longer. Changing every password and turning on two-step login, and removing the unknown Search Console owner, are steps the owner has to complete with the people who hold those accounts. Until they are done, a cleaned site is not a closed one. Watching from outside is also what an edge does all day. It sees every request before your site does, so traffic aimed at a planted page, a fake login or a stray file shows up before anyone visits it. RankShield, our founder's security company, runs that kind of layer on Cloudflare, which it describes as "a managed filtering layer on Cloudflare's global network that sits in front of your whole site". It is $39 a month, added on top of a RankShield plan; details are on the [RankShield edge](https://rankshield.co/edge/) page. It is an option we offer, never a condition of working with us. If the checks turn something up, our guide to [what a hacked-site cleanup misses](https://seoeliteagency.com/hacked-website-cleanup-what-gets-missed/) covers the steps after the obvious ones. If you want a second set of eyes first, start with our [free SEO audit](https://seoeliteagency.com/free-seo-audit/). Watch it work ## Turn on what makes AI *recommend you*. AI recommends the businesses it can read, trust and quote. Flip on the four signals we engineer, and watch your visibility climb and the answer rewrite itself. THE FOUR SIGNALS WE ENGINEER **Entity graph***schema · knowledge graph* **Answer content***quotable, answer-first pages* **Trust & reviews***authority the engines verify* **Technical delivery***fast, crawlable, AI-readable* 9:41 AI VISIBILITY 6% THE AI ANSWER not recommending you [◆ You're the answer, build this for real →](https://seoeliteagency.com/free-seo-audit/) Illustrative · the four signals are the real system we build Questions ## This article, *answered*. - How can I check if my website is hacked? - Can a website be hacked even if Google site: search shows nothing? - What is a doorway page hack? - What does an unknown owner in Google Search Console mean? - Does changing my WordPress password lock out a hacker? - Why did my Search Console traffic spike from another country? Jamie Kloncz · SEO Elite Agency, Naples Start outside the website. In Search Console, look for a single day of impressions far above normal and for clicks from a country you do not serve on searches you never targeted. Check Settings, then Users and permissions, for owners you did not add. Then load your pages logged out and compare their size and their browser-tab titles with what you expect. A page much heavier than the rest, or a title you never wrote, deserves a closer look. Google's URL Inspection live test also shows what Google receives, which helps catch cloaking. Quick checks that ask the website about itself can miss a hack entirely. Jamie Kloncz · SEO Elite Agency, Naples Yes. Google says a site: search shows "the pages that Google has indexed for your site, including the hacked pages" ([web.dev, 2015](https://web.dev/articles/fix-the-gibberish-hack)), but only pages indexed at that moment. On the gallery's site, the gambling pages had a one-day spike in Search Console, and a site: search run days later showed no spam. The pages were still on the server. A site: search is a useful check, not a clean bill of health. Pair it with a look at the Search Console Performance report and a logged-out look at your own pages. Jamie Kloncz · SEO Elite Agency, Naples A doorway page hack replaces or adds pages on your site that are built to rank for someone else's searches, often gambling, pharmacy or adult terms in another country. The pages carry a new title, a new heading and instructions telling Google to index them. On the gallery's site, nine real pages were replaced this way, and for one day the site ranked in Indonesia for gambling searches. The attacker benefits from your site's trust with Google. You get traffic you cannot use and a risk to your reputation if the pages stay up. Jamie Kloncz · SEO Elite Agency, Naples Google says it plainly: "If you've found an owner that you don't recognize, you might have been hacked" ([Google Search Console owners help, 2026](https://support.google.com/webmasters/answer/7687615?hl=en)). An attacker who can add a verification file to your site can claim it in Search Console and submit pages for indexing. On the gallery's site, a verification file went in one minute after the spam pages. To remove an unknown verified owner, follow Google's steps and delete all of that owner's verification tokens. If you do not, Google says the removed owner can re-verify. Then find out how the file got onto your site. Jamie Kloncz · SEO Elite Agency, Naples Not on its own. WordPress application passwords let apps sign in without the main password, and changing the main password does not revoke them. On the gallery's site, two application passwords were attached to an admin account. WordPress manages them on the Edit User page, where you can "view or revoke existing application passwords" ([WordPress application passwords guide, 2020](https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/)). Revoke them first, remove any admin accounts you did not create, then change every password and turn on two-step login for every admin. Include the hosting account and any file manager login. Jamie Kloncz · SEO Elite Agency, Naples Often for an innocent reason, such as a news mention, a directory listing or a rank-tracking tool. The test is which searches drove it. If the queries are for your services, it is likely good news. If they are for gambling, adult content, pharmacy or other things you have never sold, treat it as a warning sign. On the gallery's site, gambling and adult searches made up 79.5% of the quarter's clicks, and one day accounted for the spike ([First-party incident records, 2026](https://seoeliteagency.com/hacked-website-case-files/)). Filter the Performance report by that day and that country, then look at the pages that got the clicks. Sources - 1 [Google Search Console owners help: Managing owners, users, and permissions - if you find an owner you do not recognize, you might have been hacked; delete all verification tokens for a removed owner](https://support.google.com/webmasters/answer/7687615?hl=en) - 2 [Google URL Inspection help: URL Inspection tool - "This is not a live test"; the live test "fetches and examines the URL in real time"](https://support.google.com/webmasters/answer/9012289?hl=en) - 3 [web.dev: Fix the gibberish hack, last updated 2015-01-01 - a site: search shows indexed pages including hacked pages; check for cloaking with the URL Inspection tool](https://web.dev/articles/fix-the-gibberish-hack) - 4 [WordPress Apache guide: Apache HTTPD /.htaccess, WordPress Advanced Administration Handbook - the standard rewrite rules pass a request to WordPress only when no file or folder exists at the path](https://developer.wordpress.org/advanced-administration/server/web-server/httpd/) - 5 [Apache mod_rewrite: Apache Module mod_rewrite, HTTP Server 2.4 documentation - the -d test checks whether the path exists and is a directory](https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html) - 6 [WordPress application passwords guide: Application Passwords: Integration Guide, George Stephanis, November 5, 2020 - view or revoke application passwords from the Edit User page](https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/) - 7 [Google Security issues help: Security issues report - hacked content is any content placed on your site without your permission](https://support.google.com/webmasters/answer/9044101?hl=en) - 8 [Google Performance report help: Performance report advanced filtering and comparison - compare between two countries](https://support.google.com/webmasters/answer/17011165?hl=en) - 9 [First-party incident records: SEO Elite Agency cleanup records for client sites, 2026 (clients anonymized; summarized in this series) - timelines, Search Console exports and cleanup measurements](https://seoeliteagency.com/hacked-website-case-files/) Written by [Jamie Kloncz](https://seoeliteagency.com/jamie-kloncz/), founder SEO Elite Agency, Naples FL. Published October 23, 2026. Check this page has not changed Every article is hashed when the site is built. This recomputes the hash of its text in your browser and compares it with the published record. Verify this article ## Keep reading [All 115 articles →](https://seoeliteagency.com/blog/) [Technical SEO14 min read The Plugin the Owner Never Saw: How Hidden WordPress Malware Ran for Months on Two Sites We Cleaned Up](https://seoeliteagency.com/hidden-wordpress-malware-plugin/) [Technical SEO12 min read The Site Was Cleaned. Then the Spam Came Back: What a Hacked Website Cleanup Misses](https://seoeliteagency.com/hacked-website-cleanup-what-gets-missed/) [Technical SEO7 min read What Happens When Google Decides Your Site Is Dangerous](https://seoeliteagency.com/google-flagged-your-site/) ## Start with *the audit*. About 60 seconds, no email, and you get named findings for your own site, not a score out of a hundred. [Run myfree audit](https://seoeliteagency.com/free-seo-audit/) [Book a callinstead](https://seoeliteagency.hbportal.co/public/69bccfccf61f1d002932ebbe)