Is my WordPress site hacked? 10 signs to check
Most hacks are built to go unnoticed. The people behind them want your site’s reputation, its visitors or its server, and they get more of all three the longer nobody spots them. So a hacked site often looks perfectly normal to its owner, especially when you’re logged in, while customers see something else entirely.
Here are the signs worth checking, in the order most people come across them.
What Google and your visitors see
1. A warning in Google or the browser. Google may show “This site may be hacked” under your listing, and Chrome may show a full-page red warning before anyone reaches you. You can check whether Google has flagged your domain on Google’s Safe Browsing site status page.
2. Spam in your search results. Search Google for site:yourdomain.com and scroll. Pages selling medicine, fake designer goods or gambling, or whole results in Japanese that you never wrote, mean someone has been publishing on your site. The Japanese keyword hack is common enough that Google has a guide for it.
3. Visitors being sent somewhere else. A customer mentions landing on a scam page, an advert or a fake prize draw. These redirects are often set to fire only for visitors on phones, only for people arriving from Google, or only once per visitor, which is why they rarely happen to the site owner. Test from your phone, on mobile data, by searching for your business and clicking through.
4. Pop-ups and adverts you didn’t add. Anything flashing, sliding in or opening new tabs that isn’t yours is someone else’s code running on your pages.
What you’ll find inside WordPress
5. Admin users you don’t recognise. In Users → All Users, filter by Administrator. An extra account with a dull, believable name, like wpadmin2 or support, is one of the most common things left behind after a break-in, so the attacker can get back in later.
6. Plugins and files that shouldn’t be there. Look for plugins you didn’t install, especially ones with vague names, and ask your host or developer to check wp-content/uploads for files ending in .php. That folder is for images and documents; code in it is a red flag.
7. Core files that have been changed. WordPress can check its own files against the official copies. With WP-CLI on the server:
wp core verify-checksums
wp plugin verify-checksums --allAnything reported as modified needs a closer look. The plugin check only covers plugins from WordPress.org, so premium plugins need checking another way.
8. You can’t log in. A password that suddenly stops working, or a login page that looks slightly different, can mean an attacker has changed your account or replaced the login page itself.
What your host and Google tell you
9. A message from your host. Hosts suspend accounts that send spam, run malware or suddenly use far more resources than usual. If your website’s emails have started landing in spam at the same time, your server may be sending spam for someone else.
10. A security issue in Search Console. Google reports hacked content, malware and deceptive pages under Security & Manual Actions → Security issues, and emails the site’s owners when it finds something. If you check nothing else each month, check this.
A 10-minute monthly check in Google Search ConsoleHow sites get in this state
Most WordPress hacks don’t involve anyone targeting you in particular. Automated tools scan millions of sites for known weaknesses and break into whichever ones they find. The usual ways in are an outdated plugin or theme with a published vulnerability, a reused or weak admin password, a nulled (pirated) premium plugin with a backdoor already inside, or hosting shared with a site that was compromised first.
That’s also why the fix is never just deleting the file you found. If the way in stays open, or the attacker’s hidden admin account stays, the site is reinfected within days.
If you’ve found one of these signs
Don’t panic, and don’t start deleting things yet. Take a copy of the site as it is, change your passwords from a clean device, and work out how far it goes before cleaning anything. We’ve written a step-by-step plan for exactly this moment.
What to do in the first hour after a hackIf the site is hacked right now and you’d rather hand it over, our emergency page has what to do this minute and how to reach us fast. We handle malware removal and hardening: cleaning the site, closing the way in and making it much harder to break into next time, and if a site we cleaned is reinfected within 30 days, we clean it again for free.