Is My Wix or Squarespace Site Hacked?

By Glenn Lyvers · Updated September 21, 2026 · 4 min read

Something looks wrong with your site and the internet has told you it is hacked. On a hosted builder that is possible but genuinely uncommon, and a good proportion of the people who arrive at this conclusion are actually looking at something else entirely. Working out which you have takes about ten minutes and saves a lot of unnecessary alarm.

Why these platforms are different

You do not have a server, a database or files in any sense you can reach. The platform runs everything centrally, patches it centrally, and does not give anyone a route to upload a script to your site. The entire category of attack that dominates self-hosted sites — vulnerable plugin, uploaded backdoor, injected PHP — simply does not apply.

What is left is your account and the content in it. That narrows the diagnosis enormously, and it means a genuine compromise on these platforms is nearly always somebody logging in as you.

Things that look like a hack and are not

Spam traffic in your analytics, which is bots hitting your address and has nothing to do with your site's contents. Spam form submissions, which are automated and annoying rather than evidence of access. A browser warning about an expired or misconfigured certificate, which is a configuration issue. Search results showing old content, which is a caching delay.

Also: a site that suddenly looks broken after an editor change, a third-party embed or widget that started showing adverts because its provider changed, and email that stopped delivering because of a DNS or authentication problem rather than anything on the site. Each of those has caused somebody to conclude they were hacked this week.

What a real compromise looks like

Content you did not write, appearing on your pages. Pages you did not create. Your own login no longer working. Contributor accounts you did not add. Changes to the email address or billing details on the account. Your domain pointing somewhere unexpected.

Those are account-level symptoms, and they point at somebody having your credentials rather than at any weakness in the platform. The exception worth knowing is your domain: if your site itself is fine but visitors reach something else entirely, the problem may be your domain settings rather than your site, which my guide on DNS versus site hacks covers.

Checking properly

Review your account's contributor or user list and remove anyone who should not be there. Check the login or activity history if the platform provides one. Confirm the email address and billing details on the account are still yours. Look at your site's pages for content you did not create.

Then check your domain separately, since it is often managed elsewhere: confirm it still points at your site and that nobody has changed your registrar contact details. Check any third-party code you have embedded, because a compromised or repurposed widget from somebody else can inject adverts and redirects into an otherwise perfectly healthy site.

Fixing it

Change your password from a device you trust and enable two-factor authentication. Remove contributors you do not recognize, restore the correct account email, and revoke active sessions if the platform allows it. Then remove any content that was added and check your domain and registrar settings.

Because the platform holds everything, their support team can see account activity you cannot and can help with recovery if you are locked out entirely. Contacting them early is genuinely the right move here, unlike on a self-hosted site where you can do most of the work yourself.

Keeping it secure

The whole security model comes down to your account, so protect that: a unique password from a password manager, two-factor authentication, and no shared logins. Remove contributor access for people who no longer need it, particularly former designers and agencies.

Then extend the same care to your domain registrar, which is a separate account with separate credentials and is the thing that can take your whole site away regardless of how secure the builder is — my guide on domain hijacking covers why. And scan the computer you administer from, since a stolen password from a device is the most likely explanation of all, as covered in when the breach was your own computer.

Common questions

Can a Wix or Squarespace site be hacked?

The platform itself is not realistically compromised by an outside attacker, and you have no server for anyone to upload code to. What can happen is someone getting into your account with your password, which lets them change content, add pages and lock you out. That is the scenario to check for.

I am getting spam traffic in my analytics. Am I hacked?

Almost certainly not. Spam traffic is bots hitting your address, and it appears in analytics regardless of whether your site is healthy. It is irritating and it distorts your numbers, but it involves no access to your account or your content.

My site suddenly shows adverts I did not add. What is happening?

Most often a third-party embed or widget whose provider changed their terms and started injecting advertising. Check what external code you have embedded before assuming a compromise. If nothing explains it, then look at your account's contributor list and activity history.

Someone changed my pages. How did they get in?

With your password, or a contributor's. Reused passwords, stealer malware on a computer used to log in, and phishing pages imitating the platform login are the three usual sources. Change the password from a trusted device, enable two-factor authentication, and audit who else has access.

Should I contact the platform's support?

Yes, earlier than you would on a self-hosted site. They can see account activity and login history that is not exposed to you, they can help if you are locked out, and they can confirm whether changes came from your account. There is no server-side investigation for you to do yourself.