It was a weird couple of weeks. An extremely popular component used by over a million websites was exploited on 13 June and spread like wildfire. Are you safe? Here is how to check, and what you can do to protect yourself and your organisation.
Why would someone want to hack my website?
Attackers love a soft target. In the JCE hack, compromised sites redirected visitors so the attackers could collect affiliate credits. That is almost silly, but many attacks are far worse: fake banking pages for phishing, malware served to your visitors, or a foothold to attack your organisation.
How would I know if my website is hacked?
In most cases owners do not know until it is too late. Telltale signs in this attack included pages abruptly redirecting elsewhere, new user profiles appearing, and warnings in Google Search or Google Search Console. See our full list of signs your website is compromised.
An ounce of prevention
Remediating this attack often took a couple of days. With recent, tested backups, rolling back and patching could take a couple of hours. Best practice is to back up, test the backup somewhere else, update the system and extensions, then push tested updates to the live site. Untested updates on a live site break a percentage of the time. Our website security and maintenance plans do exactly this.
The real cost
Beyond lost functionality and sales, the biggest damage is reputational. Imagine your Google listing showing “This site may harm your computer”. In the worst case, a website compromise can spread to visitors or become the entry point for ransomware.
If you are not sure where you stand, get in touch for a website security check. I personally oversee all of our security work, and we explain everything in plain English (or Japanese if you prefer).
Written and reviewed by Noah Greenstone, Founder and Principal Consultant. Last reviewed 24 June 2026.
