How to know if your website has been hacked when your own screen says it is fine: five checks from outside, tried on Google's test pages and two clean sites.

A customer says Chrome went red when they opened your site. A friend saw a line under your name in Google’s results. Or you searched for your own business and found a page you never wrote. So you opened your homepage yourself, and it looked exactly as it always has.

That is the point Google’s own guide for hacked sites, on web.dev, is clearest about:

Google’s web.dev guide, “Help, I think I’ve been hacked”

Every day, cybercriminals compromise thousands of websites. Hacks are often invisible to users, yet remain harmful to anyone viewing the page, including the site owner.

On 25 September 2026 I read nine pages that answer this question. Four of the nine are by two companies that sell a website scanner. One is from that Google series, dated 2015 on the page and last edited in 2022 according to its archived source file. Then I ran the checks myself: on Google’s own test pages, built to trigger Chrome’s warning and harm nobody, and on two of my sites, kovalseo.com and cryptowl.io, so you can see clean results next to Google’s test domain, which it flags on purpose.

The answer first. You cannot settle this from your own screen, so the five checks below look from outside. Google’s spam policies, updated 28 August 2026, list the shapes a hack takes: code injected into pages you already have, new pages you never wrote, text and links hidden with styling, and redirects — a visitor asks for one page and is sent to another — where, in Google’s words, “The kind of redirect sometimes depends on the referrer, user agent, or device”: where the visitor came from, what their browser calls itself, whether they are on a phone. Of the warning visitors get, Google’s FAQ for hacked sites says “you might not be able to reproduce the warnings in your own browsing.” Three checks are yours and need no account: Google’s public Safe Browsing page, what a visitor saw in Chrome, and a site: search with spam words. Two more load your pages, so they go through Google’s side, or to whoever looks after the site with a tool that does not run the page — not a browser, which Google’s malware guide says to avoid.

Look your site up on Google’s public Safe Browsing page

Open https://transparencyreport.google.com/safe-browsing/search?url=yoursite.com with your own domain at the end. It needs no login. On 25 September I looked up kovalseo.com, then Google’s own test domain, testsafebrowsing.appspot.com, which Google flags on purpose:

	kovalseo.com	Google’s test domain
“Current status”	kovalseo.com“No unsafe content found”, with a green tick	Google’s test domain“Some pages on this site are unsafe”
Reasons	kovalseo.comnone	Google’s test domainthree lines, the first “Install unwanted or malicious software on visitors’ computers”
“Site info”	kovalseo.com“This info was last updated on Jul 22, 2026.”	Google’s test domain“This info was last updated on Sep 25, 2026.”

Under the flagged domain the page adds: “Unsafe content might only appear on some pages of a website.” So look up any single address you suspect as well, and look up www.yoursite.com separately: Google’s Safe Browsing FAQ, fetched 25 September, says that in this data ‘a “website” refers to the hostname or fully qualified domain name of a URL’.

Three things this page does not tell you. The date may be old: my site showed 22 July when I looked on 25 September, and Google does not say what the date marks, so I cannot tell you either. “No available data” is not a verdict: once, when the page’s own lookup did not go through, it showed that for kovalseo.com, and moments later the same address returned “No unsafe content found”. Try again. And the reason lines under a flagged site are Google’s categories, not a diagnosis of what is on your pages.

What visitors see in Chrome: “Dangerous site”

“Chrome went red” can mean two pages. One is the certificate stop, “Your connection is not private”, with “Not Secure” in red in the address bar; that is about the certificate, not a hack. The other is this one, worth knowing by sight because you may never see it on your own site — Google says so above. The safe place to look at it on purpose is Google’s test pages. On 25 September, in Chrome 154.0.8037.57 on my Mac, in my usual profile, which has Safe Browsing’s Enhanced protection on, I opened testsafebrowsing.appspot.com/s/malware.html. The address bar showed a red chip with a circled cross and the word “Dangerous”. The page was red from edge to edge:

Chrome’s full page on Google’s malware test page

Dangerous site Attackers on the site that you tried visiting might install harmful software that steals or deletes things like your passwords, photos, messages or credit card numbers. Chrome strongly recommends going back to safety. Learn more about this warning

Two buttons: “Details” and “Back to safety”. The phishing and the unwanted-software test pages showed the same chip and the same heading, and a different first sentence — “might trick you into installing software or revealing things like your passwords, phone or credit card numbers” on one, “might trick you into installing harmful software that affects the way you browse” on the other, whose closing sentence also adds “to avoid harm”. (Quoted as my UK-English Chrome shows it.) Chrome’s help page on these warnings, fetched 25 September, matches: ‘When you encounter phishing, malware, unwanted software, or social engineering sites, you may get a red warning that says “Dangerous site.”’

One heading for all three, and not every page has caught up: two of the nine still tell you to expect “Deceptive site ahead”, and so does one of Google’s own pages, on social engineering, dated 10 December 2025. Chrome’s public source code removed that heading in a change dated 5 April 2024 — a code date, not the day every Chrome got it. Ask the visitor for the heading and the first sentence; the sentence says which of the three Google found.

Search Google for your own site

Google’s own guide to the Japanese keyword hack gives the check I would run next: type site:yoursite.com into Google.

Google’s web.dev guide on the Japanese keyword hack

Flip through a couple of pages of search results to see if you spot any unusual URLs. If you don’t see any hacked content in Google Search, use the same search terms with a different search engine.

Then add words you would never use. Google’s page on the site: operator, dated 10 December 2025, offers the example itself: “site:example.com viagra casino — Helps with identifying and monitoring spam problems on your site.” Its help page on sites labelled dangerous, fetched 25 September, widens the list: ‘pharmaceutical or luxury brand names that you don’t carry, porn terms, or other spammy terms such as “loans”’.

What you are looking for, from Google’s descriptions of the hacks it names: pages you never wrote; addresses in folders of random letters — its gibberish-hack guide gives www.example.com/jfwoea/cheap-hair-styles-cool.html; titles in a language your site is not in; and links to shops selling brands you do not carry. Google’s guide to the cloaked keywords hack warns that such pages “sometimes contain basic template elements from the original site”, so a result that looks like yours at a glance still needs its title and text read in the results list, without opening it.

On 25 September, site:kovalseo.com listed my pages, starting with the homepage, the privacy page, the blog and the terms, each a page I wrote; I read the first screen only. site:kovalseo.com viagra casino returned: “Your search - site:kovalseo.com viagra casino - did not match any documents.” I was signed in to Google, and the page’s footer said “Results are personalised”; I did not repeat it signed out.

Two lines Google can put under a result are signs too; I have not seen either, so here they are from Google’s documents. Its Search help: ‘You’ll see the message “This site may be hacked” when we believe a hacker might have changed some of the existing pages on the site or added new spam pages.’ And another page: “This site may harm your computer” appears “when we think the site you’re about to visit might allow programs to install malicious software on your computer.” Both pages say the line stays until the site owner takes action.

One limit, from Google against Google. Its page How do I know if my site was hacked? says a site: search “shows you all the pages on your site”; the operator’s own page says “The list of URLs returned is not always exhaustive.” Take the second: an empty spam search is a good sign, not a proof.

If a result looks wrong, do not click it

Google’s malware guide is blunt about this step:

Google’s web.dev guide, “Hacked with malware”

Avoid using a browser to view pages on your site. Because malware often spreads by exploiting browser vulnerabilities, opening a malware-infected page in a browser may damage your computer.

And if someone opens the strange address and gets your own site’s “page not found”, the Japanese-keyword guide has a line for that:

Google’s web.dev guide on the Japanese keyword hack

Don’t be fooled! Hackers will try to trick you into thinking the page is gone or fixed when it’s still hacked. They do this by cloaking content.

Cloaking is showing one page to Google and another to you. So the two checks that load your pages do not run in your browser: one goes through Google’s side, the other to whoever looks after the site, with the tools Google’s guide names, “cURL or Wget”, which fetch a page without running it.

See the page from Google’s side

Google’s Rich Results Test is built to check a page’s markup, and none of the Google pages I read recommends it for this. I include it because Google’s page about the tool, fetched 25 September, says how it fetches — “This tool accesses the page as Google-InspectionTool (that is, not using your credentials, but as Google)” — and its page on JavaScript problems, dated 18 December 2025, says you can see the “rendered DOM”: the page as Google built it. On 25 September I gave it https://kovalseo.com/. The result read “No items detected” — that is about rich results, the markup it looks for, and says nothing either way about a hack — with a button under it, “VIEW TESTED PAGE”; lower down, under “Details”, it said “Crawled successfully on Sep 25, 2026, 4:31:31 PM”. I did not open that view; what it shows is Google’s description. Two limits: by default it fetches as a phone; and its name is not Googlebot, the program Google sends to read your pages — Google’s list of the names its programs use gives Google-InspectionTool/1.0 — so a hack aimed only at the name Googlebot may not show here.

For whoever looks after your site

Google’s malware guide gives the method: ‘We recommend fetching a page with and without –referer “https://www.google.com”, because some malware is only activated when users come from Google Search results.’ The same tools can send Googlebot’s name or a phone browser’s name. On 25 September I asked the homepages of kovalseo.com and cryptowl.io under seven names — two for a desktop browser, two for Googlebot, one for Googlebot on phones, an Android and an iPhone browser — from one home connection, without a referrer; then, as a desktop and as a phone browser, with and without the Google referrer. Every answer was the same bytes, with no forward: 34,057 of them for kovalseo.com, 144,786 for cryptowl.io. A site with a desktop copy and a mobile copy differs by device, so compare phone with phone before calling a difference cloaking. One thing this cannot see: a hack keyed to Google’s own network addresses, not just the name, would not show from a home connection.

The same guide adds: “Request a page on your site that doesn’t exist” and “examine the response to see if it comes from another site or otherwise contains malware.” I asked both sites for /this-page-does-not-exist-7f3k2q. Each answered with its own “page not found”, in its own design — the same bytes with and without the Google referrer, with the words iframe, eval and unescape appearing zero times. An error page from another site, or one loading scripts from a site nobody can account for, is a sign; the check covers error pages only.

In the fetched page, the malware guide names the words to search for: ‘It might be helpful to search for words like “iframe” to find iframe code. Other helpful keywords are “script”, “eval”, and “unescape.”’ For hidden text, the spam policies list the tricks — “Using CSS to position text off-screen”, “Setting the font size or opacity to 0” — which in code can read as font-size:0, opacity:0 or offsets like -9999; display:none hides text outright. On kovalseo.com I used Chrome’s view-source: and its find box — on a site you suspect, search the fetched copy instead — and saw 0/0, no match, for display:none and for <iframe. A scripted search of both homepages for opacity: 0, with the space, found it twice, both on cryptowl.io and both part of a fade-in as the page loads. That is the rule for this check: a hit is not a verdict. Google’s spam policies exempt “Accordion or tabbed content”, sliders, tooltips and text meant for screen readers, and those use the same words. A sign is a link to a site you do not know, or a script loading from one that nobody can account for: the homepage of kovalseo.com carries fifteen links, none to another domain, and loads one script from elsewhere, static.cloudflareinsights.com, Cloudflare’s analytics. Unfamiliar is a question for whoever runs the site, not a verdict. One limit: what styles and scripts kept in separate files contain does not appear in the fetched page, only the line that loads them.

The same checks without a web person

If nobody looks after your site, an AI assistant that runs commands on your own computer can run the letter’s first three checks, the ones from outside; the fourth, on the server, needs someone with access. Copy the prompt below and paste it; then type a space, your site’s address, and press Enter.

I tested it in three rounds. The first missed kovalseo.com’s one outside script, Cloudflare’s, because it did not ask like a browser; that is why the Accept line is there. The later rounds found all five signs from Google’s guides that I had planted on a small test site on my own computer, three times out of three, without running the planted code, and raised no false alarm on kovalseo.com or cryptowl.io: they listed that script and asked whether I had added it. None of those runs called a site clean, safe or hacked.

It borrows Google’s name, not Google’s addresses; it checks only the homepage and pages you list; no answer is proof. Run it on your own computer. The prompt asks it only to read public pages, a request rather than a lock: if it asks for a password or to install anything, say no, and never give it server access or a logged-in session. I tested Claude Code on a Mac, not other assistants or chat windows.

Signs away from the page, and two that are not signs

Google’s FAQ for hacked sites lists four: “Unusual traffic spikes, especially from unrelated search terms. Visitors reporting malware. Newly created accounts with administrator privileges. Suspicious new pages added to your site.” Spikes, not drops: a fall in traffic has many causes, and Google’s page does not list it. The Japanese-keyword guide adds one: a notice that someone you do not know has verified your site with Google. And two things that look like signs and are not: a grey or red “Not Secure” in the address bar, which is about the connection or the certificate, not a hack; and log lines of programs asking for password files, which are attempts, not entry as long as each one was refused or not found — one that was served is a different matter.

How to know it is really gone

Run the same checks again after the cleanup, because the warnings do not clear on your say-so. Google’s help page on labelled sites: “There is often a slight delay in updates to the warning system”, which it puts at a few days, and, for a flag Google’s systems placed on their own, “the next time Google crawls your site, the fix will be detected, and your site will be unflagged.” The two search lines stay, in Google’s words, until the owner “takes action”: once the site is clean, whoever holds its Search Console account asks Google for a review there, which Google puts at “a few days” for malware and “up to several weeks” for spam. So gone looks like this: the status page reads “No unsafe content found” when you look it up after the cleanup; no line sits under your result in Google; site:yoursite.com lists only pages you wrote; the spam searches did “not match any documents”; and the visitor who reported the red page, asked again, gets your page. Then it is gone for what these checks cover. Whoever looks after the site can look further, at its files, its database and its accounts, which no check from outside reaches.

Written by Oleh Koval at Specia1ne, who reads these reports for a living.