7 signs your WordPress site has been hacked

Most compromised WordPress sites look completely normal to their owner. The attacker is not trying to deface your homepage — they want to send spam, sell fake pharmaceuticals through your domain, or mine your visitors' traffic for as long as possible without being noticed.

So the signs are usually indirect. Here are the seven that matter, roughly in order of how often they turn out to be the real thing.

1. Visitors get redirected somewhere else

You load your site and it is fine. A customer loads it on their phone and lands on a betting site.

That asymmetry is the signature of a redirect hack. The injected code deliberately skips logged-in users and often skips desktop visitors, because the owner is the person most likely to notice and fix it. Check in a private window on a phone, ideally from mobile data rather than your own wifi.

2. Google shows a warning before your page

"This site may be harmed" or "Deceptive site ahead" means Google has crawled something it does not like. It is never a false positive in the sense of appearing at random — something on the site triggered it.

Open Google Search Console and look under Security & Manual Actions. If there is a listing there, Google will usually name the type of issue and sometimes a sample URL.

3. Pages you never wrote, appearing in search

Search site:yourdomain.com in Google and scroll. If you find pages selling medication, luxury goods or essay-writing services — often in Japanese, Chinese or Russian — you have a spam injection.

These pages frequently do not appear anywhere in your WordPress admin. They are generated on the fly by injected code, which is why the Pages list looks clean while Google has indexed hundreds of them.

4. Administrator accounts you do not recognise

Users → All Users, filter by Administrator. Anyone you cannot account for is a problem, and attackers pick innocuous names — "admin2", "support", "wpuser", or something that looks like a plugin.

Check the registration dates too. An account created at 3am on a day you were not working is worth investigating even if the name looks plausible.

5. Your host emails you about malicious files

Hosts scan their own servers, and they act on what they find. An email about malware, a suspension notice, or an account limited for "abusive resource usage" is usually a real detection rather than an overcautious filter.

Do not ignore it because the site still looks fine. By the time a host writes to you, the files have usually been there a while.

6. Unexplained slowness or resource spikes

A compromised site is usually doing work for someone else — sending spam, running crypto miners, or serving as a redirect node. That work shows up as CPU usage, memory usage or bandwidth that does not match your traffic.

If your host's resource graphs jumped and your visitor numbers did not, something else is running.

7. Files changed when nobody changed anything

The most technical sign, and the most conclusive. If you have SFTP access, look at modification dates on wp-config.php, .htaccess, index.php and anything inside wp-content/uploads.

Two rules of thumb: uploads should contain no PHP files at all, and core files should not have been modified after the last time you updated WordPress.

What is usually not a hack

• A white screen after an update. Almost always a PHP error or a plugin conflict.
• A sudden traffic drop. Check Search Console before assuming the worst; algorithm updates and tracking breakages are far more common.
• Spam in your comments. Annoying, not a compromise. That is just the internet.
• Login attempts in your security log. Every WordPress site on earth gets these constantly. Blocked attempts mean the defence is working.

How to check in ten minutes

1. Open your site in a private window, on a phone, on mobile data
2. Search site:yourdomain.com in Google and scan for pages you do not recognise
3. Check Search Console → Security & Manual Actions
4. Check Users → All Users for unfamiliar administrators
5. Run your domain through Sucuri SiteCheck and Google Safe Browsing
6. Look at your host's resource graphs for a spike that does not match traffic

If you would rather not deal with it

Our malware cleanup is a flat $249, done within 24 hours, with a 30-day re-infection guarantee — and we will tell you honestly if what you have is a broken site rather than a hacked one, in which case it is a different and usually cheaper job.

If you just want to know where you stand, our free plugin checks your site against the live vulnerability database and tells you what it finds, with no account and no obligation.