Your site looks fine to you, but customers end up on spam. Here is what is going on and what to do.
A customer tells you your website sent them to a casino or a pills page. You check, and it looks normal. This is one of the most common hacks on small business websites.
Why you can’t see it
The malicious code is clever. It often only redirects visitors on phones, people coming from Google, or first-time visitors. Logged-in owners are skipped on purpose, so the problem can run for months.
How it gets in
Almost always through outdated software: an old plugin or theme, or WordPress itself. Weak or reused passwords are the second most common way in.
What to do
- Do not just delete the files you think look strange. The hack usually has backups of itself.
- Change your hosting, WordPress and FTP passwords.
- Get the site properly cleaned, updated and secured.
- Ask Google to review the site if it shows a warning.
If you want, send me your address and I will tell you what I find.
