Article -> Article Details

Website security is the set of steps that keep your site free from malware, spam links, and unauthorised access. Signs of a hack include odd redirects, unknown admin users, strange pages in Google, and warning screens. To fix it, isolate the site, clean the files, change every password, and update all software.

This guide walks through each step for a South African business site, with WordPress examples throughout.

What is website security and why it matters

Website security means protecting your site from three things: malware, spam injected into your pages, and anyone logging in who should not be there.

Most small business sites are not hacked by a person who picked them out. Bots scan thousands of sites a day looking for outdated plugins, weak logins, and known gaps. If yours has one, it gets used. The usual goals are boring and profitable for the attacker: sending spam email from your server, adding hidden links that sell casino or pharma products, redirecting your visitors somewhere else, or stealing customer details.

For you, the cost is real. Visitors see a red warning screen instead of your homepage. Google can drop your pages from search. Customers who submitted a quote request or an order may have had their details exposed, and that brings legal duties under POPIA, which we cover further down.

Security is one part of looking after a site over time. If you want the full picture of routine care, see our guide to website maintenance services in South Africa. This article covers the other side: spotting a hack, cleaning it up, and making sure it does not come back.

How to tell if your website is hacked

Your website is probably hacked if it redirects visitors to other sites, shows a browser warning, has admin users you did not create, or lists pages in Google that you never published. Some hacks are loud. Many are built to stay hidden from you while still working against you.

Visible signs

These are the ones you or your customers can see:

• Your site redirects to another website, often only on mobile or only when people arrive from Google.

• A red browser warning appears, such as "Deceptive site ahead" or "This site may be hacked".

• Your homepage is replaced, defaced, or shows a message from the attacker.

• You find admin users in WordPress that nobody on your team created.

• The site is suddenly slow, or your host suspends it for high resource use or spam sending.

• Plugins or themes you did not install appear, or files change when nobody has edited anything.

• Customers report spam emails that appear to come from your domain.

• You cannot log in, and your password reset email never arrives.

A sudden jump or collapse in traffic is also worth a look. Open your website analytics and check for unusual spikes from countries you do not serve, or a sharp drop that does not match anything you changed.

Hidden signs in Google results

The nastiest hacks never show up on your own screen. They inject spam pages or links that only search engines see, a trick called cloaking. You find them in Google, not on your site.

Search Google for site:yourdomain.co.za and scroll through the results. Look for page titles about casinos, loans, pills, replica goods, or text in a language you do not use. Then try site:yourdomain.co.za casino, site:yourdomain.co.za viagra and similar. Any hit means pages exist that you did not make.

Two more checks:

• Search for your brand name. If your own listing shows a strange title or description, your pages have been altered.

• Right-click your site, choose View Source, and search for display:none, left:-9999px, and links to domains you do not recognise. Spam links are often hidden in the footer or header with CSS so they do not appear on screen.

Checking Safe Browsing and Search Console

Two free Google tools will tell you what Google thinks of your site.

First, paste your address into the Google Safe Browsing site status checker. It reports whether Google has flagged your site for malware or deceptive content.

Second, open Google Search Console and go to the Security Issues report (under Security & Manual Actions). If Google found hacked content, malware, or social engineering on your site, it lists the problem there with example URLs. You will also get an email if the site is verified. If you have not used the tool before, our guide on how to read Search Console reports and fix issues walks through it.

In Search Console you can also use URL Inspection on a suspicious page and run a live test. The screenshot shows you what Googlebot sees, which can differ from what you see.

For a second opinion, run your address through a remote scanner such as Sucuri SiteCheck. It cannot see everything, so a clean result does not prove you are safe, but a flagged result is a clear signal.

Common causes of a hacked website

Most hacked WordPress sites were broken into through an outdated plugin, a weak or reused password, or a pirated theme. Fixing the cause matters as much as removing the damage, because an attacker who got in once will get in again the same way.

Old plugins

Plugins and themes are where most known WordPress vulnerabilities turn up, far more often than in WordPress itself. When a flaw is found, the developer releases a patch and the flaw becomes public. Bots then scan the web for sites that have not installed the patch yet.

Abandoned plugins are the worst case. If a plugin has not been updated in a year or two, no one is fixing its holes. Deactivated plugins are not safe either: the files still sit on your server and can still be attacked. Delete what you do not use.

Weak passwords

Automated login attacks try thousands of password combinations against wp-login.php. Short passwords, the username admin, and passwords reused from other sites are what they hit first. If one of your staff used the same password on a site that was breached years ago, attackers already have it.

This includes accounts outside WordPress: your hosting control panel, FTP, your domain registrar, and the email address that receives password resets. Break into any of those and the attacker does not need WordPress at all.

Pirated themes

"Nulled" themes and plugins are paid products shared for free on download sites. They are popular because they cost nothing, and popular with attackers because they are an easy way to deliver a backdoor. The code is modified before you ever install it, and the backdoor often survives a normal cleanup.

If you have one on your site, replace it with a licensed copy or a free alternative from the official WordPress theme directory. Saving a few hundred rand on a licence is a bad trade against a cleanup bill and a damaged reputation.

How to fix a hacked website

To fix a hacked website, take it offline, remove the malicious files and users, change every password, update all software, and then ask Google to review the site. Do the steps in this order. Changing your WordPress passwords before the cleanup is a common mistake: if a backdoor is still in place, it can capture your new ones.

Step 1: Isolate the site

Stop the damage spreading before you touch anything.

1. Put the site into maintenance mode, or ask your host to suspend it. This stops visitors seeing warnings and stops the site infecting them or sending spam.

2. Tell your host. If you are with a South African hosting provider, report the hack to their support team straight away. They can often see the infected files in their own logs and may have server-level backups you can restore from.

3. Change your hosting control panel password right now. This one is worth doing before the cleanup.

4. Take a full copy of the infected site, files and database, and keep it. You may need it to work out how the attacker got in, and it is your fallback if the cleanup removes something it should not have.

5. Check what else is on the same hosting account. A hack on one site can spread to others sharing the account.

Step 2: Clean the files

You have two routes. The fastest is to restore a backup taken before the hack. Work out the infection date first, using file modified times and your host's logs, then pick a backup from before it. Restore it, and move straight to updating everything, because the old backup still contains the vulnerable plugin that let the attacker in.

If you have no clean backup, clean by hand:

1. Replace WordPress core files with a fresh download from wordpress.org. Leave wp-content and wp-config.php alone for now. If you have WP-CLI, wp core verify-checksums shows which core files were modified.

2. Delete every plugin and theme, then reinstall each one from its official source. Do not copy them back from the infected site.

3. Open wp-content/uploads and look for .php files. There should be none, because that folder is for images and documents.

4. Check wp-config.php, .htaccess, and the mu-plugins folder for code you do not recognise.

5. Delete any unknown admin users from the WordPress Users screen.

6. Search your database for injected scripts and spam. Look for <script tags in posts, display:none blocks, base64_decode, and posts or pages you never wrote.

7. Run a scan with Wordfence or the free scanner from Sucuri to catch what you missed. Scanners are a check on your work, not a replacement for it.

If this feels like more than you want to handle, or the infection keeps returning, this is the point to bring in someone who does cleanups regularly. A missed backdoor means starting over.

Step 3: Reset credentials

Once the files are clean, change everything that could have been exposed:

• All WordPress user passwords, starting with administrators.

• The database password (then update wp-config.php to match).

• Hosting control panel, FTP, SFTP, and SSH logins.

• The email accounts tied to the site and your domain registrar.

• Any API keys used by payment gateways, email tools, or other integrations.

• The security keys and salts in wp-config.php. Replacing them logs everyone out of the site, including the attacker.

Use a password manager and generate long, random passwords. Then update WordPress core, every plugin, and every theme to the latest version before you bring the site back online.

Step 4: Request a Google review

If Google flagged your site, the warning will not clear by itself. Go to Search Console, open the Security Issues report, and select Request Review. Describe what you found and what you did to fix it. Reviews for malware warnings can be quick, while reviews for hacked-content or spam issues can take longer, so build in a few days.

For spam pages you removed, make sure those URLs now return a 404 or 410 status, not a blank page or a redirect to your homepage. If they are showing in search results and doing damage, use the Removals tool in Search Console to hide them while Google recrawls. Submit your sitemap again so Google rediscovers your real pages.

You can also recheck the site in the Safe Browsing status checker to confirm the flag is gone.

How to stop it happening again

To keep a site from being hacked again, keep everything updated, turn on two-factor authentication, take regular off-site backups, and put a firewall in front of the site. None of these is hard. The problem is that they are easy to put off, and a site that is checked once a year gets attacked in the other 364 days.

Updates

Update WordPress core, plugins, and themes as soon as security releases come out. Turn on automatic updates for minor WordPress releases and for plugins you trust. For anything that runs your shop or forms, test updates on a staging copy first so a bad release does not break checkout.

Also remove what you do not use: old plugins, spare themes, and test installs sitting on the same hosting account. Less code means fewer places to attack.

If nobody in your business has the time to do this every week, that is exactly what a website maintenance service is for. Ours covers software updates, backups, and security protection, so the routine work gets done without you having to remember it.

2FA

Two-factor authentication (2FA) asks for a second proof of identity, usually a six-digit code from an authenticator app, in addition to the password. A stolen password alone is no longer enough to get in.

Turn it on for:

• WordPress administrators and editors.

• Your hosting control panel.

• Your domain registrar.

• The email account that receives password resets.

An authenticator app is safer than codes sent by SMS. Pair it with a limit on login attempts, a username that is not admin, and accounts that only have the access each person needs. A content writer does not need administrator rights.

Backups

A backup is the thing that turns a disaster into an annoying afternoon. A good backup setup has four parts:

• It runs automatically, so it does not depend on someone remembering.

• It is stored off the server. A backup that lives on the same server as the site can be deleted or infected along with it.

• It keeps several versions, at least 30 days of them. Some hacks sit quietly for weeks, and you want a copy from before that.

• You have tested a restore. A backup you have never restored is a hope, not a plan.

Back up both files and the database. How often depends on how often your site changes, and we cover that in the FAQs below.

Firewall

A web application firewall (WAF) filters traffic before it reaches your site. It blocks known malicious requests, bad bots, and repeated login attempts. Plugin-based options such as Wordfence run on your own server, while cloud services such as Sucuri sit in front of the site and filter traffic before it arrives. Both can also scan for malware and alert you when files change.

A firewall does not replace updates. It buys you time between a vulnerability being published and you patching it, which is useful, but not a licence to leave plugins out of date.

An SSL certificate is a separate layer. It encrypts the connection between your visitor and your site, which you should have on every page, but it does not scan for malware or stop attackers who already have a valid password.

What a hack does to SEO and trust

A hack hurts your search visibility and your reputation at the same time, and the second is usually slower to repair. Rankings can recover within weeks of a proper cleanup. A customer who saw a malware warning on your site may not come back.

Search rankings. Google can flag your pages with a security warning, remove them from results, or bury your real pages under thousands of injected spam URLs. Spam pages also water down what Google knows about your site, so the keywords you actually want to rank for lose ground. Malicious scripts and hidden content slow pages down, which hurts the loading and stability measures covered in our post on Core Web Vitals.

Browser warnings. Chrome and other browsers can show a full-screen red warning before your site loads. Most visitors will not click past it. Every day that warning stays up is lost enquiries.

Email. If attackers sent spam from your server or domain, your genuine emails can start landing in junk folders or get blocked outright. This often outlasts the hack itself.

Customer trust and POPIA. If your site collects personal information, such as contact form submissions, orders, or account details, a hack may count as a security compromise under the Protection of Personal Information Act. Where personal information may have been accessed by an unauthorised person, POPIA expects you to notify the Information Regulator and the people affected as soon as reasonably possible. Speak to a legal adviser about your specific case. Our post on POPIA and your website explains what the Act asks of a business site.

After a cleanup, give recovery some attention. Check that the removed spam URLs have dropped out of Google, that your real pages are indexed again, and that your rankings are heading back up. If they are not, an SEO team can audit what is still missing and help you recover lost ground faster than waiting.

FAQs

Can a hacked site hurt Google rankings?

Yes. A hacked site can lose rankings, show security warnings in search and in the browser, and have pages removed from results until the problem is fixed.

The damage depends on how fast you act. Spam pages and malware warnings are the biggest causes. Once the site is clean and Google has reviewed it through Search Console, rankings usually recover, though it can take a few weeks.

How do I find spam links on my site?

Search Google for a site:yourdomain.co.za plus words like casino or loans, view your page source for hidden links, and scan your files and database for injected code.

In the page source, look for links wrapped in display:none or positioned far off screen, especially in the footer and header. In WordPress, check footer.php, header.php, and your active theme's functions.php. If you have WP-CLI, wp db search can look through the database for suspicious words. Do not forget the Security Issues and Pages reports in Search Console, which can list URLs you never created.

Is HTTPS enough?

No. HTTPS encrypts the connection between your visitor and your server, but it does not stop malware, outdated plugins, or someone logging in with a stolen password.

Hacked sites very often have a valid SSL certificate. The padlock tells visitors the connection is private. It says nothing about whether the site itself is clean. You still need updates, strong logins, backups, and monitoring.

How often should I back up?

Back up as often as your site changes: daily for a busy site or online store, weekly for a brochure site that rarely changes.

If you run an e-commerce website, orders and customer records land in your database constantly, so daily is the minimum and some shops need more. Whatever the schedule, store copies off the server, keep at least 30 days of versions, and test a restore at least once.

Should I rebuild or clean?

Clean the site if the hack is limited, you have a clean backup, and the site is otherwise healthy. Rebuild if the theme or plugins are abandoned, the site keeps getting reinfected, or you cannot tell what is safe.

Cleaning is faster and cheaper, but only if it is thorough. A site running an old theme that nobody supports will keep attracting attacks, and a clean on top of rotten foundations is a short-term fix. If a rebuild makes sense, our website design and development team can move your content onto a current, maintained build.

Not sure whether your site is clean? Book a consultation and we will run a website security check against the signs covered in this guide. If you would rather talk first, you can contact the team directly.