Start with what visitors can see
A website can be compromised without going offline. For a small organization, the first clue may be a customer reporting a strange page or a staff member noticing that the site looks different. Treat an unexpected change as something to check, not immediate proof of an attack: a forgotten update, broken plugin or publishing mistake can produce similar symptoms.
Look for unfamiliar text, links or images, especially on pages your team rarely edits. A service page might suddenly contain unrelated product links, or a contact button might lead somewhere other than your contact form. Check the destination of important links before clicking through, and avoid entering information on a page that appears suspicious. If visitors report a warning from their browser, ask for the exact message and the page address so you can investigate the right place.
Also check the site on a phone and in a private browser window. Some unwanted changes appear only to logged-out visitors or on particular devices, so an administrator's usual view may miss them. Record what you find with page addresses, screenshots and approximate times.
Watch for unexpected redirects and search results
A redirect sends someone from one page to another. Redirects are often legitimate, but a visitor landing on an unrelated shop, download page or imitation sign-in screen after opening your site is a serious warning sign. Note the original address, the destination and whether it happens consistently. Do not ask colleagues to test a suspicious destination by signing in or downloading anything.
Search results can reveal problems that are easy to miss while browsing the site directly. An unfamiliar page title, description or indexed page about an unrelated topic may suggest that unwanted content has been added. Search listings can also be outdated, so compare the result with the live page and your publishing records before drawing a conclusion. If you manage a search-console account, review any available notices about security issues or unusual indexed pages.
Check accounts and changes behind the scenes
The website's administration area may show clues before the public site changes. Examples include a new administrator account no one recognizes, a plugin or theme your team did not install, altered contact-form settings, or posts marked as edited when no one recalls editing them. Check with the people who have access before assuming an unfamiliar name or change is malicious; contractors and automated updates can account for some surprises.
Other signals include a sudden increase in failed sign-in attempts, unexpected password-reset emails, or notices from your hosting provider about suspicious activity. No single signal establishes what happened. Together, they can help you decide whether the issue needs urgent attention. Keep a short list of who has access to the site, hosting account and domain settings so you can quickly verify authorized changes.
Notice unusual performance or visitor complaints
A website that becomes unusually slow, displays repeated errors or goes offline may have a routine technical problem. It can also be affected by unwanted files or activity. Compare the timing with planned updates, traffic campaigns and hosting notices. If you have basic site monitoring, look for a change from the site's normal pattern rather than treating one brief outage as evidence of compromise.
Pay particular attention to reports that forms are sending visitors somewhere unexpected, confirmation messages have changed, or people received messages that appear to come from your organization but were not sent by your team. These reports may involve the website, an email account or a separate service. Collect examples without asking visitors to forward passwords or sensitive personal information.
Respond carefully when signs add up
If you suspect a compromise, write down what you observed before changing the site. Preserve screenshots, relevant notifications and a timeline of recent updates. Contact your website administrator or hosting provider through a contact method you already trust, rather than a link in a suspicious message. Ask them to help determine what changed, secure affected accounts and assess whether visitors are at risk.
Avoid deleting unfamiliar files or restoring a backup at random: either action can remove useful evidence or leave the original weakness in place. From a trusted device, change passwords for affected accounts, review who has access and enable multifactor authentication where available. If a visitor-facing page may be unsafe, ask your technical support person about temporarily taking that page offline while it is checked.
Once the issue is resolved, document its cause if known, what was repaired and what should be monitored. A simple monthly routine—checking key pages, account access, available security notices and backups—makes unusual changes easier to recognize next time.
