Knowing what you are looking at helps you judge the severity.
SEO SPAM
Hidden links or entire pages selling unrelated products, usually visible only to search engines or only to visitors arriving from Google. Damages your rankings and is often the longest-running, least noticed type.
REDIRECT MALWARE
Visitors are sent to another site, frequently only on mobile devices or only on a first visit, so the owner never sees it themselves. Always test your own site from a phone and from a private browsing window.
PHISHING PAGES
A fake bank or webmail login page uploaded into a folder on your account. This is the most urgent type. It will get your account suspended and your domain blacklisted quickly, and it harms third parties.
MAIL SPAM SCRIPTS
Scripts that send bulk spam through your account. These consume resources, blacklist your domain's sending reputation, and usually lead to suspension.
CARD SKIMMERS
JavaScript injected into a checkout page that copies card details as customers type. Designed to be invisible and extremely damaging.
CRYPTOCURRENCY MINERS
Scripts that consume your CPU allowance, or your visitors', to mine currency for someone else.
WEB SHELLS
Not a payload in themselves but a control panel for the attacker. See our backdoor article.
