How to tell a site is compromised before a customer complains

A compromise rarely looks like a black screen with a skull. More often the site still opens, and the harm already goes around it: a foreign redirect on mobile, a burst of mail from your domain, a new account nobody asked for. While that is blamed on "a hosting glitch", the traces get wiped by the repair attempts themselves.

Signs worth checking the same day

• New users with administrator rights, and unfamiliar plugins or files in the root.
• A redirect only on a phone, or only for a visitor from search. From the office IP the page can look clean.
• Mail you did not send, and replies asking to be removed from a list.
• A warning in Search Console or from an antivirus, even though "everything opens for us".
• A sharp rise in outbound traffic, or night load with no ads running.

What not to do as the first move

Do not roll the site back over an infected copy, and do not delete logs before it is clear which door was used. Otherwise the same thing returns a day later, now without a history. It makes sense to keep a copy as evidence, change panel and mail passwords, and look at neighbouring sites in the same hosting account.

After that it is response work: contain, find the entry, bring up a clean copy, close access. Lexora joins at that step if you have no one on duty, and does not start with "reinstall everything".