Checking if a website is hacked: Is it just a buggy plugin or is someone inside?

Redirecting on mobile but not desktop is a classic user-agent sniffing trick. Attackers write rules to exclude IP addresses logged into the admin dashboard or standard desktop browsers. Open the mobile device emulator in your browser's developer tools and watch the initial redirects in the network tab—the filename doing the redirect will show up right there.

when a plugin breaks your site whitescreens or throws fatal errors it doesn't just shoot out 1500 emails on its own. i mean they're blatantly using your server as a spam relay right now. change your ftp and db passwords immediately imo, don't wait.

When our spare parts store in Stuttgart had a similar breach, we noticed too late and our hosting account got completely suspended. A local security specialist charged 650 euros to clean it up, and because our domain ended up on spam blacklists, it took us 3 months to recover our Google rankings. I'd strongly suggest taking urgent action before your host shuts down the account.

Do you have SSH access in your hosting panel, or are you on a shared dashboard? Also, when that plugin update failed halfway through, did you manually change any file permissions? Those two details are critical for figuring out how the filesystem was accessed.

Follow these three steps immediately: 1) Regenerate the security keys in your config file via FTP to invalidate all active sessions. 2) Search for PHP files inside your uploads folder, don't delete what you find, just rename them to quarantine. 3) Flush the outgoing mail queue from your hosting panel and change your email account passwords right away.

Before jumping straight to worst-case scenarios, you should also look at the plugin logs. On some form plugins if the submission logic gets abused by spam bots, it can generate entries every second and blast out notifications back to back. That said, the mobile redirect makes it super suspicious; you might be dealing with two separate issues happening at once.

We went through something similar last year. Customers called saying sketchy ads were popping up on the site and at first we didn't believe them because everything looked completely normal on our office PCs. Turned out they only injected the redirect for people coming in from Google on mobile; typing the URL directly didn't trigger it at all. It had reached deep into the database tables, took us two full days to clean up.

In the German market, the biggest risk with these incidents is data protection compliance. If the customer database was accessed or customer emails were abused in outgoing blasts, you might trigger mandatory reporting requirements. Before panicking, make a backup copy of your server access logs so you don't destroy evidence before starting the cleanup.

I'm curious too. Hasty decisions become decisions you have to fix six months later.

Mistakes made on the website hack check side are usually reversible but expensive. If you post the result here, it will help others too.

The opposite happened to me, that's why I'm writing. When you try to change everything at once, nothing settles.

you're right I've been down that road too then most time waste accumulates in tasks waiting for approval.

if I were you, Id go this route.

This approach has a cost, which isn't discussed. Mistakes made on the website hack check side are usually reversible but expensive.

This is my opinion, I'm not claiming it's absolute truth.

I'll argue the opposite, don't get mad. If you scold false alarms, nobody will report again.

Hope this helps.

There's a part I don't understand. Trying to do this alone is the most expensive way.

If you get three different answers on a topic the question was asked wrong. If you post the result here, it will help others too.

yore right.

The discussion got scattered, let me summarize. If you scold false alarms, nobody will report again.

Taking measures without an inventory leaves doors you haven't seen open.

Same here. When making decisions, write down the worst-case scenario too, not just the best.

Good luck with that.