Is my site hacked? Cloaking, spam links and conditional redirects
A hacked site often looks fine to its owner and shows spam only to Googlebot or to visitors from Google. Compare the three fetches, find the injection, clean and request a review.
Step by step, with screenshots: What is cloaking in SEO? Why hacked sites show Google a different page →
Check your own site
Runs these 4 checks and the other 189, free, in about 45 seconds.
Or run only this check with the free Hacked site & SEO spam checker.
What it is
A hacked website is one where an attacker has added code or content without the owner's knowledge, most often spam links, spam pages or redirects that profit from your domain's reputation in Google. Many hacks are deliberately hidden: they show the spam only to Googlebot or to visitors arriving from Google, so the site looks normal when you type its address.
getReport fetches your page three ways, as a normal visitor, as Googlebot and as a visitor coming from Google, and compares them. It flags text or links that only bots see (cloaking), spam vocabulary in links, redirects that happen only for Google traffic, and links hidden with CSS. A clean page gives the same content to all three. Check any of these findings straight away, because Google demotes hacked sites and may warn searchers.
What a passing site looks like
- Visitors and Googlebot see the same page textfail · −15 ptseffort L
- No redirect that fires only for Googlebot or Google visitorsfail · −15 ptseffort L
- No spam links and no links served only to botsfail · −15 ptseffort L
- No hidden outbound linkswarning · −2.5 ptseffort M
1. Cloaked content
Why it matters. The page was fetched as a normal visitor, as Googlebot and as a visitor arriving from Google. The bot or Google-referrer copies contain text that visitors never see. That is the pattern of a hacked site that hides spam from its owner, and Google treats cloaking as a violation. Some sites vary content by user agent on purpose; check the evidence.
- Open the page as Googlebot (Search Console URL Inspection → View crawled page, or curl with a Googlebot user agent) and compare it with a normal visit.
- If the extra content is not yours: change every password, update WordPress, themes and plugins, scan the file system for modified core files and unknown PHP files (wp-content/uploads, mu-plugins), restore from a clean backup if in doubt, then request a review in Search Console under Security Issues.
2. Redirects only for Google
Why it matters. The page sends visitors who come from Google, or Googlebot itself, to another site, while direct visitors see the normal page. Owners rarely notice because they never arrive from Google. Search results show the spam target and the site loses its rankings.
- Look for the redirect in .htaccess or the nginx config, in wp-config.php and index.php, in theme header and footer files, in the database (wp_options siteurl/home and injected scripts in posts), and in inline scripts that read document.referrer.
- Remove it, update and clean the site, rotate passwords, and request a review in Search Console.
3. Spam links
Why it matters. Links with pharma, gambling, loan or replica vocabulary, or links that only Googlebot and Google visitors receive, are the fingerprint of an injection: someone is using your domain's reputation to rank their pages. Google demotes sites that carry them.
- Search the database and theme files for the linked domains (wp_posts, wp_options, header.php, footer.php, functions.php) and remove the injection; look for an unknown plugin or a modified core file that re-adds it.
- Update everything, rotate passwords and keys, then request a review in Search Console.
Questions people ask
What are the signs a website has been hacked?
Common signs are search results for your site with foreign-language, pharmacy, casino or loan titles, visitors from Google landing on another site, admin users or files you did not create, unexpected pages in your sitemap, a Security issues message in Google Search Console, and warnings from your host. A site: search in Google often reveals spam pages you never see in your CMS.
How do I know if my website has been hacked?
Check it the way outsiders see it. Search Google for site:yourdomain and look for pages you did not create, open the Security issues report in Search Console, and run a getReport check, which compares what Googlebot and Google visitors receive with what you see. Also review recently changed files, admin users and scheduled tasks on the server.
Why does my website redirect to spam only when I come from Google?
That is a conditional redirect, a common hack. Injected code checks the visitor's referrer or user agent and redirects only people arriving from search engines, often only once per visitor, so you rarely notice when you type your own address. The code usually sits in .htaccess, a theme's functions file, a fake plugin or the database. Remove it, then change all passwords.
What should I do if my website has been hacked?
Keep a copy of the hacked state for investigation, then restore a clean backup or remove the injected code, update core, plugins and themes, delete unknown admin users and change every password and API key. Find out how the attacker got in, often through an outdated plugin, or the hack will return. Finally, request a review in Search Console's Security issues report.