Shorter reads that go deeper into one part of this guide.
The short answer
Gambling redirects, a Google warning or strange pages in search results are the common signs.
Change every password and find your last clean backup — but don’t delete everything.
A proper clean-up closes the hole they used, or the site gets re-hacked within weeks.
Signs your site has been hacked
Not every hack is obvious — many are built to hide from the owner. These are the signs Malaysian businesses report most.
Redirects to gambling or scam sites
Visitors land on online judi, betting or fake prize pages — often only on mobile, or only when they arrive from Google. Typing your address directly may look fine.
“This site may be hacked” in Google
The warning appears under your listing, or Chrome shows a full red “Dangerous site” page. Clicks usually drop sharply within days.
Strange pages in search results
Hundreds or thousands of Japanese, Chinese, pharmacy or slot pages under your domain that you never created. This is the “Japanese keyword hack” and its cousins.
Hosting suspended or email bouncing
Your host blocks the account for sending spam or using too much CPU, or your emails start landing in customers’ junk folders.
Users and plugins you did not add
A new administrator in WordPress, a plugin with a generic name you do not recognise, or files in the site folder dated last week when nobody touched it.
It only looks wrong for others
Many hacks hide from logged-in admins and from your own IP address. If a customer says something is wrong but you cannot see it, believe them.
Check it yourself in ten minutes
Before you call anyone, these checks tell you whether it is a real hack and how far it has spread.
Search site:yourdomain.com
Type it into Google. Scroll a few pages. Titles in Japanese, judi, casino or pharmacy words mean spam pages have been injected.
Open it as a stranger would
On your phone, switch off Wi-Fi, open a private tab, search for your business on Google and tap your own result. Redirects often only show this way.
Google Safe Browsing status
Check your domain at transparencyreport.google.com/safe-browsing/search. It tells you whether Google currently flags it as unsafe.
Search Console Security issues
If you have Search Console, open Security & Manual Actions → Security issues. Google lists what it found and sample URLs.
WordPress Users and Plugins
Log in and look at Users (filter by Administrator) and Plugins. Note anything you did not add — do not delete it yet.
Ask your host what they see
Most Malaysian hosts can run a malware scan on request and tell you which files are infected. Ask for the scan result in writing.
The first hour
What to do — and not do — before anyone starts cleaning. The order matters.
Don’t delete everything
Wiping the site destroys the evidence of how they got in and the clean content you need to keep. Download a full copy, infected or not.
Change passwords in the right order
From a clean device: email first (it resets everything else), then hosting, then WordPress admin, FTP/SFTP and the database. Use a password manager and a new password for each — if your own computer is infected, new passwords get stolen too.
Turn on two-factor login
For email and hosting today, and WordPress admin as part of the clean-up. A stolen password alone then stops being enough.
Tell your host
They can confirm the infection, share access logs and restore a backup from before it started. Some will suspend the site until it is clean — that is normal.
Find your last clean backup
Note its date. Restoring alone is not enough — the hole they used is still open, and the site will be re-infected within days.
Take screenshots
Of the redirect, the Google warning and any strange pages. You will want them for the host, for Google’s review and for anyone you hire.
How a proper clean-up works
Skipping steps is why sites get re-hacked a week later. A clean-up done properly follows this order.
Back up the infected site
A full copy of files and database before anything changes, so nothing clean is lost and the infection can be studied.
Replace, don’t patch, the core
WordPress core, themes and plugins are reinstalled from official sources rather than edited file by file. Hidden code survives patching.
Clean the database
Injected scripts often sit in posts, widgets and settings tables, not in files. Security plugins regularly miss these.
Remove backdoors and fake admins
Unknown administrator accounts, rogue PHP files in uploads folders and scheduled tasks that re-infect the site are removed.
Close the hole
Usually an outdated plugin or theme, a nulled (pirated) premium plugin, or a weak or reused password. It is updated, replaced or removed.
Reset every key
All passwords again, WordPress security keys (salts) in wp-config, and any API keys for payment gateways or email services.
Getting Google to trust it again
Cleaning the site does not remove the warning by itself. Google has to be told, and the spam pages have to go.
Make spam URLs return “gone”
The injected pages should return a 404 or 410 so Google drops them. Redirecting them to your home page keeps them alive.
Check Search Console owners and sitemaps
Japanese keyword hacks often verify the hacker as a Search Console owner and submit their own sitemap. Remove unknown owners and sitemaps.
Request a review
In Search Console → Security issues, tick “I have fixed these issues” and request a review, saying briefly what was cleaned and how the hole was closed.
Expect days, sometimes weeks
Malware reviews are usually processed within a few days. Reviews for spam hacks can take a few weeks. Rankings recover gradually after that.
Keeping it clean afterwards
Most re-infections come from the same few gaps. Closing them costs far less than a second clean-up.
Update weekly
WordPress, plugins and themes. Most hacks on Malaysian small business sites use a plugin flaw that was already fixed months earlier.
Delete what you do not use
Deactivated plugins and old themes can still be exploited. If it is not active, remove it.
Never use nulled plugins
Pirated premium plugins and themes from free download sites very often come with a backdoor already installed.
Daily off-site backups
Stored away from the hosting account and kept for at least 30 days, so you can go back to before a hack you only notice later.
Firewall and login limits
A web application firewall, limited login attempts and two-factor login for every admin account.
Monitoring that tells you first
Uptime alerts, weekly malware scans and Search Console email alerts mean you hear about a problem before your customers do.
Quick answers.
01Why do Malaysian sites get gambling redirect hacks?
Online gambling spammers target sites with outdated plugins to borrow their Google ranking and reach Malaysian searchers. Small business sites with no updates are easy targets.
02Will restoring a backup fix it?
Only temporarily if the vulnerability is still there. The hole has to be found and closed, or the site will be re-infected — often within days.
03Can I clean it myself with a security plugin?
A security plugin is good at finding obvious infected files. It often misses code injected into the database, hidden admin accounts and backdoors in upload folders — which is why plugin-only clean-ups often come back.
04Is my customers’ data at risk?
If the site stores customer details — orders, enquiry forms, accounts — assume they may have been seen. Under Malaysia’s PDPA, as amended in 2024, a data breach may need to be reported to the Personal Data Protection Commissioner. Get advice early.
05How long until Google removes the warning?
After the clean-up and a review request in Search Console, malware warnings are usually cleared within a few days. Spam-hack reviews can take a few weeks.
06Is it my hosting company’s fault?
Rarely. Most small business hacks come through an outdated plugin, a pirated theme or a reused password — things on your side of the account. A good host still helps, with malware scans, logs and backups.
07Where can I report a hack in Malaysia?
CyberSecurity Malaysia’s Cyber999 service takes incident reports from businesses and the public. If money or customer data was stolen, make a police report too — your bank and insurer will ask for it.
08What does CST charge?
Speed & security recovery is RM 1,200 fixed — malware removed, Google warning cleared, speed fixed and the site locked down, usually within a week. Care plans from RM 100 a month keep it updated, backed up and monitored afterwards.
Related guides
“We had been hacked before. Since the redesign, security and care plan started, clean scans every month.”