What a hacked website means for your business
A hacked website means a stranger is running code on a machine that carries your business's name. Modern hacks are not defaced homepages. They hide: visitors get redirected to scam pages, search engines index spam under your domain, and the malware shows a clean site to you and to your security scanner. So the working rule is this: a hacked site stays compromised until a scan on the server itself, files and database both, proves otherwise.
We traced one of these infections end to end on a client's WordPress site. The full story is in our field note on a real cleanup: What a hacked WordPress site actually looks like. This article is the set of rules that came out of it.
What compromise actually means
A compromised site typically does 3 things at once. First, a conditional redirect: certain visitors get bounced to a spam or scam page. Second, spam hosting: your server quietly serves pages advertising gambling or counterfeit goods, indexed under your domain. Third, cloaking.
Cloaking means the malware answers differently depending on who asks. Google's crawler gets the spam. You, your customers on a normal day, and most scanners get the ordinary site. The site can look healthy from your own desk while spam pages pile up in search results under your name.
Why it matters operationally
The damage lands on assets you spent years building. Search rankings absorb the spam and sink. Browsers and search engines can flag the domain, which turns your listings and ads into warning screens. Customers who got bounced to a scam page once do not come back to find out whether you fixed it.
If the site takes payments or collects personal information, a compromise also becomes a legal and financial exposure, not just a marketing problem.
Common failure modes
The quick fix. Someone removes the visible redirect and declares the site fixed. The redirect was the symptom. These campaigns plant backdoors (a hidden route back into the server) precisely so they can reinfect after a surface cleanup. Painting over the water stain does not fix the roof.
Trusting an outside scanner. An external scanner asks your site the same way a visitor does, and attackers build cloaking to defeat exactly that. A clean external scan of a cloaked site proves nothing. Only tools running on the server can read the files and database where the infection actually lives.
The forgotten dev copy. A full development copy of the site on a public web address is a second front door, usually unpatched and unwatched. On the site we traced, the public dev copy was the likely way in.
Abandoned plugins. A plugin nobody has updated in years is a standing invitation. The one we found handled payments.
Old passwords surviving the cleanup. If you do not rotate credentials, the attacker logs back in the normal way and the cycle restarts.
What a real cleanup covers
Ask for each item by name. A real cleanup includes:
- A scan of every file on the server, not just the pages a visitor sees
- A scan of the database, where malware stores settings, scheduled tasks, and injected content
- A hunt for code in the wrong place: recently changed files, executable code inside upload folders, fake plugins
- Rotation of every credential: hosting account, admin logins, database password, file-transfer access
- Fresh security salts (random secret values that keep logins valid; regenerating them forces every session, including any the attacker stole, to log in again)
- A follow-up scan weeks later, because reinfection is the whole point of a backdoor
Prevention basics
- Apply software updates on a schedule, not when you happen to remember
- Delete plugins you no longer use, and replace any the developer has abandoned
- Keep development copies of the site off the public internet
- Give each admin their own account with a strong, unique password
When professional help is warranted
If your developer says the site is fixed, ask one question: what did the server-side scan cover? An honest answer names files and the database on the live server, plus credential rotation and fresh salts. If the answer is "the redirect is gone and the site scans clean," bring in help.
Professional territory also includes any site that takes payments, any site that reinfects after a cleanup, and any case where you cannot get server access yourself.
Red Eye's recommendation
Treat a hack as a server problem, not a page problem. Pay for one thorough cleanup with a written scope instead of a string of quick fixes that each buy a few weeks. Then put the site on a maintenance schedule, because every open door we found on that client's site (stale software, an abandoned plugin, a public dev copy) is the kind of thing routine upkeep closes before anyone walks through it.