Unexpected redirects or pop-ups
A visitor may report arriving at an unrelated website or seeing content that you do not see yourself. Record the original page address and how they reached it. Differences between visitors are useful clues, not a reason to dismiss the report. Do not ask anyone to click a suspicious download or continue past a browser warning just to reproduce the problem.
Spam pages and unfamiliar search results
Search results may display pages, wording or titles you did not create. Take note of the exact result and destination. An old snippet can persist after a legitimate change, so a search result alone does not establish the current state of the website. Compare the report with the site’s content and any findings available through Search Console.
Accounts or settings you cannot explain
An unfamiliar administrator, changed contact details or altered permissions should be checked with everyone responsible for the website. There may be an authorised explanation, such as an agency handover. If there is not, preserve the account details and ask for an access review. Do not publish screenshots that expose private contact details or access information.
A warning from your host or browser
Keep the wording, affected URLs and time of the warning. Ask the host what evidence is available and what action they have already taken. A generic suspension notice can cover different problems, so request the specific reason rather than guessing. Treat a browser warning seriously and use administrative or hosting channels to investigate.
Why a normal-looking homepage is not enough
A website contains more than the page you normally visit. A concern might relate to another URL or an account change rather than the homepage design. This is why a recovery investigation needs a defined scope. WebWasp’s public audit is deliberately narrower and does not inspect the private installation.
Problems that can have other explanations
Downtime, slow pages and failed logins can also result from hosting faults, configuration changes, updates or ordinary account problems. Describe the observed behaviour without labelling it too early. For example, ‘the contact page redirects to this address on my phone’ is more useful than ‘everything is infected’.
Turn the symptoms into a useful enquiry
Collect the website address, affected pages, dates, exact messages and recent authorised changes. Say who has already investigated and what they changed. WebWasp can then clarify the next step. You do not need to provide a theory about the attacker, and you should not send credentials through a general enquiry email.