WEBSITE PROBLEMS: HOSTING AND SECURITY
Website Slow, Hacked or Down? What to Check and What to Do First
A slow, hacked or offline website can look like an SEO problem when the real cause sits with your hosting, your domain or your plugins. Here is how to tell the difference and what to do in the first hour.
Galleria 713-703-3030 | Kingwood 281-852-8253
Home › Digital Marketing › Website Problems › Website Slow, Hacked or Down
Your rankings dropped. Your phone stopped ringing. Before you blame your SEO, check the foundation your website sits on. A website that is slow, hacked or down often looks like an SEO problem on the surface, but the cause is your hosting, your domain, your security certificate or a bad update.
We have hosted websites since 1998, and we see these problems from both sides because we are a hosting company and a web design and SEO company. This page is part of our guide to common website problems. It walks you through the warning signs, the first steps, and what not to do.
Watch: So Who Owns your Domain?
THE HIDDEN CAUSE
Why does a hosting problem look like an SEO problem?
Google grades your website on how fast it loads. Even if you do everything else right, speed can hold you back if you do not have it. Your hosting company plays a big part in that speed.
A low-cost hosting package buys you a piece of property, not a fast website. Some hosts limit how much processing power your site gets and how fast pages are sent back out. When Googlebot visits a throttled site, it can pull less data. That limits how much of your website Google understands.
Bad technical setup also causes lower rankings that mimic a penalty. You did nothing wrong with your content, yet your pages slide. That is why we look at hosting, security and setup first when a client asks why rankings fell. If the drop came right after a rebuild, start with our guide on website traffic dropped after redesign instead.
- Pages that sit for 10, 20 or 30 seconds before they load
- An over capacity or try again later message
- Rankings that fall with no content change
- Google showing fewer of your pages than you know you have
WEBSITE HACKED
How do I know if my website has been hacked?
Most owners find out last. A customer calls, or Google flags it before you notice. Watch for these signs.
- Pages you never made. Open Google Search Console and look at your indexed pages. If you see URLs you did not create and do not recognize, check right away to see if your website was hacked.
- A warning in Chrome or in Google results. Messages like “this site may be hacked” or “this site may harm your computer” stop visitors cold.
- Your site sends people somewhere else. If a click from Google lands on a pharmacy or other strange site, someone either hacked your website or took control of your domain.
- Spam email from your domain. Some hacks get in and use your server to send mail. You may see bounce messages or customers telling you they got junk from you.
- Fake users, posts or comments. Bots walk the internet trying to add users and stuff spam into forms and comments.
Google does not want hacked websites in its search results. Once it decides your site is hacked, it posts a security issue in Search Console. You have to fix the problem, then report back to Google before the warning comes off.
WEBSITE DOWN
Why is my website down?
When your website will not load at all, the cause is usually one of 5 things. Each one has a different fix, so it pays to know which one you have.
- An expired domain. Your domain belongs to you only as long as you pay the renewal. If the renewal notice goes to an old email address, it can lapse without warning.
- A DNS change. If someone changes where your domain points, your site and sometimes your email stop working.
- An expired or broken SSL certificate. Browsers show “not secure” or block the page. Most hosts issue SSL certificates for free now, so you should not be paying extra for a basic one.
- A bad plugin or core update. We have seen a single WordPress core change break millions of websites at once. A plugin conflict can take your site down in seconds.
- Your hosting account. The server is overloaded, the account was suspended, or a past web designer turned the site off.
That last one happens more than you would think. As a hosting company, we get calls from owners whose web designer shut their website off. If you are not sure who controls your accounts, read the next section before anything else.
Check it yourself
Check it yourself in 20 minutes
OWNERSHIP
Who owns my domain and hosting account?
Treat your domain like a piece of property. You should know who owns it, and the right name, address and email address should be on it. If you lose control of it, getting it back can be a very costly mistake.
We often see a web design company or a past designer listed as the domain owner. That makes it hard to regain control when you need to move or fix something. To check, log in where you registered the domain and look at the name and contact details on the account.
Beth teaches it this way: having your own logins is not a question, it is a demand. You need your own username and password for each of these.
- Your website (WordPress admin)
- Your website hosting control panel
- Your domain name registrar
- Your Google Business Profile
- Google Analytics
- Google Search Console
If you give someone your login, go right behind them and make sure your name is still on the account. Use an email address you can always get into, not an old personal account you can no longer reset. We renew our own domains for 10 years at a time so a lapse is never a worry. Our domain management service keeps your domain in your name.
WEBSITE SLOW
Why is my website so slow, and how do I check it?
Speed is part of how Google ranks you. If a searcher clicks your link and it sits there, Google has not given that person a good result. Google uses Core Web Vitals to measure how fast your page loads, how soon a visitor can use it, and how stable it stays while loading.
To check it, go to Google PageSpeed Insights and enter your address. Look at both desktop and mobile. Know how your own visitors arrive. Some businesses get most of their traffic on desktop, and others are almost all mobile.
Slow sites usually come down to 3 things.
- The host. A server not set up for speed, with no caching or compression, slows every page.
- How the site is built. Heavy themes and bloated installs drag. WordPress does not optimize itself out of the box. Someone has to set that up.
- Third-party add-ons. Chat boxes, embedded feeds and outside scripts make the browser fetch data from another server. Our own chat box lowers our page speed score, so we weigh every add-on against what it costs in speed.
Speed also ties to leads. If your site is fast enough but visitors still do not call, see our guide on website traffic but no leads.
THE FIRST HOUR
My website is hacked or down. What do I do right now?
Stay calm and work in order. Fast, random changes can make a hacked site harder to clean.
- Confirm the problem. Load your site on your phone with Wi-Fi turned off. That tells you whether it is down for everyone or just your office.
- Call your host. If we host your website, call us at 713-703-3030. Tell us what you see and when it started.
- Check your domain and SSL. Log in to your registrar and look at the expiration date. Check whether the browser shows a lock or a “not secure” warning.
- Think about what changed. A plugin update, a new theme, a DNS edit or a new person with a login is often the cause.
- Check Search Console. Look at the Security Issues and Manual Actions reports, and scan your indexed pages for URLs you did not create.
- Change your passwords. Reset your WordPress, hosting, registrar and email passwords. Remove any users you do not recognize.
- Find your clean backup. You will need a copy of the site from before the problem started.
Our hosting knowledge base walks through common hosting tasks like checking DNS and resetting control panel access.
PREVENTION
How do I keep my website from getting hacked or going down?
Updates sound scary because things can break. It is still worse not to update than to put it off and never come back to it. Old plugins and themes are how many hacks get in. Follow this routine and most of these problems never reach your customers.
- Back up before every major change. Before you add a plugin, change your theme or update WordPress, run a backup so you can roll it back.
- Store backups off your server. If your backup lives on the same machine as your website and that machine fails, your backup fails with it. Keep backups in remote cloud storage you can reach on short notice.
- Keep a clean database copy. Some hacks inject bad code into the database that spreads and cannot be cleaned. A clean backup may be the only way back.
- Test on a staging site. Try changes on a copy first. If it breaks there, your live site stays up.
- Check after every update. Click through your forms, pages and checkout to make sure nothing conflicts.
- Pick a theme that is still updated and use a spam filter on your forms and comments.
- Keep private files off your website. Never store financial files or password lists in your site folders. If they are not secured, Google can find and index them.
What not to do:
- Do not make big changes during your busiest time. We have watched an owner change a site in the middle of a Black Friday sale and knock the whole store offline.
- Do not ask Google to remove a warning until the site is truly clean. If the warning keeps coming back, something is still hacked. Have someone who knows what they are doing look at the files, the database and the server.
- Do not buy hosting on price alone. Hosting is not gas at the gas station. A host built to sell other services may not care whether your site is fast.
- Do not let anyone else put their name on your domain. Not your designer, not your IT person, not a relative.
If Google stopped showing your site after a hack or outage, our guide on website not showing up on Google covers getting your pages back in the index.
WHY VERTICAL WEB
Who can fix a hacked or slow website in Houston?
We started our own Houston web hosting company because our web design and SEO clients kept running into problems with other hosts. That has been in place since 1998, and our original 1998 client is still with us.
- We teach this. Beth Guide has taught SEO since 2003 for the SBA, the University of Houston SBDC, Lone Star College and HCC, and in our Internet Marketing Clinic.
- One in-house team. Hosting, security, web design and SEO sit under one roof, so nobody points fingers at another vendor.
- We build hosting for SEO. We do not cap bandwidth, and every plan is set up so Google can crawl your site. Our WordPress hosting includes backups, security and spam controls.
- We tell you what not to buy. If a free SSL certificate does the job, we say so.
Not sure whether your problem is hosting or SEO? Request a free website analysis and we will tell you where the trouble starts.
Cleaning up a hack
How do you clean a hacked WordPress website, step by step?
A hacker almost never breaks in by guessing your name. Most website attacks come through a known vulnerability: an old plugin, an outdated theme, an old version of PHP on the server, or a password that was reused somewhere else. The content management system itself is usually fine. The pieces bolted onto it are not. That is why updates matter so much.
When a site is hacked, work in this order:
- Take a copy before you touch anything. Download the files and the database from cPanel or your hosting provider, even if they are infected. You may need them to see what changed.
- Change every password. WordPress admins, hosting and cPanel, FTP or SFTP, the database and the email accounts on the domain. Use a strong password for each one and keep them in a password manager, not a sticky note.
- Find the malicious code. A security scanner on the server or a security plugin will flag files that do not belong, such as PHP files in the uploads folder or new admin users you did not create. Remove them, then reinstall WordPress core, the theme and every plugin from clean copies.
- Restore from a clean backup if the damage is deep. If the malware is inside the database, a clean restore is often faster and safer than cleaning by hand. This is why backups need to live off the server.
- Close the door. Update everything, delete plugins you do not use, and add a web application firewall so future attacks get stopped before they reach WordPress.
- Tell Google. If Chrome shows a red warning, Google Safe Browsing has flagged the site. Once it is clean, request a review in Google Search Console. The warning will not lift on its own.
Watch for suspicious activity after the cleanup. Turn on two-factor authentication for every admin login, check the user list each month, and act right away if new files or users appear. If the site is serving malware to visitors, taking the site offline for a few hours is better than infecting customers. The same steps apply to other content management systems such as Joomla or Drupal; only the tools change.
The damage from a hack is not only technical. Customers who see a warning screen or spam pages under your name lose trust, and that reputation takes longer to repair than the code. Website security is cheaper as protection than as cleanup, which is why our managed hosting includes updates, backups and monitoring.
Questions
Website slow, hacked or down: common questions
Look for pages in Google Search Console that you never created, warnings in Chrome or in Google results, visitors sent to a strange website, or spam email coming from your domain. Any one of these is reason to check your site right away. A security issue notice in Search Console confirms Google has spotted it too.
Yes. Google grades your website on how fast it loads, and Core Web Vitals are part of that. A slow host, a heavy theme or too many third-party scripts can hold your rankings back even when your content is strong.
The most common causes are an expired domain, an expired SSL certificate, a DNS change, a bad plugin or WordPress update, or a problem with your hosting account. Start by checking your domain renewal date and calling your host. If we host your site, call 713-703-3030.
First clean the site completely, including the files, the database and any users you did not add. Then request a review in Google Search Console. If the warning comes back, something is still infected and needs a deeper look.
You should. The domain should be in your name, with your address and an email address you can always access. Your web designer or developer should never be listed as the owner.
Back up on a regular schedule and always before a major change, like a plugin install, theme change or WordPress update. Store backups off your web server in remote cloud storage so a server failure does not take your backup with it.
Not sure which problem you have?
Request the free website analysis and we will tell you what is actually wrong, in plain English, before anyone touches your site.
Galleria 713-703-3030 | Kingwood 281-852-8253 | info@verticalweb.com