How to Tell If Your WordPress Site Has Been Hacked

Most compromised WordPress sites do not look compromised. There is no skull on the homepage and no ransom note. The site keeps serving pages normally to you while quietly doing something else entirely for search engines, for mobile visitors, or for people arriving from Google.

That gap is deliberate. Modern web malware is written to stay hidden from the site owner for as long as possible, because a compromise that goes unnoticed for six months is worth far more than one caught in an afternoon.

Here are the signs that actually matter, roughly in the order they tend to surface.

1. Google shows pages you never created

Search site:yourdomain.com in Google. You are looking for results that are not yours — pharmaceutical listings, replica goods, essay-writing services, casino pages, or listings in a language your business does not operate in.

This is the single most reliable indicator of a spam injection, and it is often the first thing a client notices. The pages are usually served only to search engine crawlers, which is why you can browse your own site all day and never see them.

2. Visitors get redirected, but you do not

A common complaint: a customer says they were sent to a sketchy site, you click the same link, and everything is fine.

Redirect malware routinely filters on user agent, referrer, and whether the visitor is logged in. If you are an administrator with an active session, coming from a bookmark, on a desktop browser, you are exactly the profile the malware is written to leave alone.

Test it properly: open the site in a private window, on mobile data, arriving from a Google search result rather than a direct URL.

3. A browser or search warning appears

“Deceptive site ahead” from Google Safe Browsing, a Chrome interstitial, or an email from your host about abuse. By the time these fire the compromise is usually well established, and the warning itself is now doing real commercial damage.

Check Google Search Console under Security Issues for specifics on what was flagged and where.

4. Administrator accounts you do not recognise

Go to Users → All Users and set the filter to Administrator. Every account there should be a person you can name.

Attackers create backup administrator accounts early, precisely so that cleaning the malware does not lock them out. Also worth checking: existing accounts whose email address has quietly changed.

5. Files with modification dates that do not match your last deploy

Sort by modification time in your file manager or over SSH:

find /path/to/webroot -type f -name "*.php" -mtime -14 -ls

Anything in wp-includes/ or wp-admin/ that changed recently, when you have not updated WordPress core recently, deserves scrutiny. Those directories should be identical to the official release.

6. Unexplained traffic or bandwidth spikes

A compromised site is a useful asset. It gets used to send spam, host phishing pages, or serve as a redirect hop for other campaigns. That activity shows up as bandwidth you cannot account for, or as a hosting bill that jumped for no obvious reason.

7. Plugins you did not install — or one that vanished

Some malware installs a plugin to maintain access. Some hides itself by removing its entry from the plugin list while leaving the files in place. Compare what wp-content/plugins/ actually contains on disk against what the admin screen shows you. A directory present on disk but missing from the list is a strong signal.

What to do before you start deleting things

The instinct is to start removing suspicious files immediately. Resist it for an hour, because cleanup without root cause almost always leads to reinfection within days.

1. Take a full backup first, compromised state and all. It is your evidence, and you cannot recover something you deleted in a panic.
2. Do not restore an old backup and stop there. If the entry point was an outdated plugin, the restored site has the same hole and will be reinfected.
3. Rotate credentials — WordPress administrators, database, hosting panel, FTP/SFTP, and any API keys stored in wp-config.php.
4. Find the entry point. Check access logs around the date of the earliest modified file. The initial request is usually still there.
5. Patch what let them in, then clean, then validate.

When to get help

If the site handles payments or customer data, if it has been reinfected after a previous cleanup, or if you cannot determine the entry point, it is worth bringing in someone who does this regularly. A compromise that keeps coming back is nearly always a missed backdoor or an unpatched entry point rather than bad luck.

If your site is actively compromised right now, get in touch and mark the request as critical — active incidents are triaged first.