How to check if your website has been hacked in 10 seconds

I just searched for the company name, but a flood of unfamiliar pages came up.

The sites featured in this episode appeared to have no problems on the surface. The website opened normally, and the administrator screen was the same as usual. However, when I searched by company name, a Japanese gambling page came up mixed in among the normal pages. The indexed pages are 3,127And most of them were pages that the company had never created.

This situation should not be interpreted as “many pages are captured in searches.” This means that the search engine has even collected the infringed pages, and those pages are already being exposed under the name of the company's domain.

10-second self-diagnosis: just one line in the search bar

Just paste the line below into the Google search bar and enter it without spaces.

site:my domain

For example, if the domain example.co.krIf so site:example.co.krEnter . site:If there is a space between and domain, the operator will not work, so you must add it.

The deciding factor is not the number of pages. If there is even one title unrelated to the company mixed in, it is not a normal search result. Please share the two below.

• normal — All pages that appear in the results are pages created by the company.
• suspected infringement — Unknown titles, foreign language strings, and gambling or adult keywords are mixed in.

Second digit: upload folder on server

It's not just the search results that are strange. Compromised sites also leave traces on servers. /wp-content/uploads/Please open the upload folder, which should contain only the original images and attachments, and sort them by modification date.

If multiple HTML files with the same modification date are created in one day, the files are not uploaded one by one by a person. This is an automatically planted file. In this case, k-8812.htmlFiles including were created consecutively at the same time.

When I find a file that I didn't upload, blocking the cause comes first rather than deleting it. If you just delete the file, it will be replanted in the same path a few days later.

Third digit: Security Issues menu in Search Console

Google usually knows before site operators do. If you have registered in Search Console, a record remains in the path below.

Search Console → Security and Manual Actions → Security Issues

This will retain the type of issue, the date it was first detected, and the number of pages affected. In this case, the issue type was "Hacked content — spam page insertion" and the date of first detection was: September 26, 2025, the affected pages are 3,127It was. As of the time the video was made, six months had passed since the warning was posted.

If you haven't registered your site in Search Console, we recommend that you do so now. Registration itself is free, but you must register so you don't miss the next alert.

What to do after checking

1. Deletes infected pages and webshells together. If you just delete spam pages, the files that create them remain.
2. Blocks the entry path. Update vulnerable plugins and remove execute permission from upload folder.
3. All new account information will be issued. Admin passwords, FTP, databases, and API keys are all eligible.
4. Then request a review in Search Console. If you change the order, the same warning will appear again after it is approved.

Why should the recovery order be set this way? How to recover when Google puts a ‘dangerous’ mark on your siteThis is covered in detail with examples. The starting point for intrusions is usually the administrator page. If the administrator address is /admin, how many times will it be attacked per day?If you look at the diagram below, the flows are connected as one.