Has My WordPress Site Been Hacked? 10 Warning Signs and What to Do

Has my WordPress site been hacked? If you see strange redirects, spam pages in Google, unknown admin users, a browser security warning or a sudden drop in traffic, there is a good chance it has. Most hacks are quiet, so the signs are easy to miss.

Hackers rarely want to deface your homepage. They want your site’s reputation, your server and your visitors, so they hide.

Here are the warning signs I look for, how to confirm a hack, and what to do next.

10 signs your WordPress site has been hacked

1. Visitors are redirected to another site

The classic sign. Someone opens your site from Google on their phone and lands on a gambling, pharmacy or fake prize page.

These redirects often target only mobile visitors, or only people arriving from search engines. Logged-in admins usually see nothing, which is why owners hear about it from customers first.

2. Google shows spam pages under your domain

Search for site:yourdomain.com in Google. If you see pages selling things you have never sold, often in Japanese or with odd product names, someone has injected spam pages into your site.

3. A red warning screen in the browser

Chrome and other browsers use Google Safe Browsing. If your site is flagged, visitors see a full-page “Dangerous site” or “Deceptive site ahead” warning. Almost nobody clicks past it.

4. Search Console sends a security issue alert

If your site is connected to Google Search Console, check Security & Manual Actions > Security issues. Google often spots a hack before you do. If you haven’t connected it yet, my Search Console setup guide takes about ten minutes.

5. Unknown administrator accounts

Go to Users in the dashboard and filter by Administrator. Any account you don’t recognise is a serious red flag, especially with a random name or an email address you have never seen.

6. Files you didn’t add

Hacked sites often have PHP files with random names inside wp-content/uploads, or extra files in the site’s main folder. The uploads folder should hold images and documents, not PHP.

7. Your host suspended the site or sent a warning

Hosts scan for malware and for servers sending spam. A suspension notice or an email about “abuse” is often the first official sign.

8. Your emails start landing in spam

If the server has been used to send spam, its reputation drops and your genuine emails suffer too.

9. The site is suddenly slow or the server is maxed out

Malware that mines cryptocurrency, sends spam or attacks other sites uses your server’s resources. A sudden spike in CPU usage with no rise in visitors is suspicious.

10. Changed content, links or settings

Hidden links in your footer, a changed site address in Settings > General, or posts you didn’t write are all signs that someone else has access.

How to confirm the hack

Don’t rely on a feeling. Check properly:

• Run your site through Sucuri SiteCheck, a free external scanner.
• Install a reputable security plugin and run a full malware scan.
• Check the Security issues report in Search Console.
• Ask your host to scan the account. Many will do it free.
• Compare core files against a fresh copy of WordPress. Changed core files are never a good sign.

An external scan can only see what the public sees. A clean result does not prove the server is clean, so always combine it with a scan from inside the site.

What to do if your site has been hacked

Stay calm and work in this order.

1. Take a backup of the hacked site. It sounds odd, but you need a copy before you change anything, in case the clean-up breaks something.
2. Change every password. WordPress admins, hosting, FTP or SFTP, the database and your email. Do this from a clean computer.
3. Remove unknown admin users and check that the remaining accounts use your real email addresses.
4. Restore a clean backup if you have one from before the hack. Then update everything immediately, or the same hole lets them back in.
5. If there is no clean backup, clean the site. Replace WordPress core files with a fresh copy, reinstall every plugin and theme from the official source, and remove unknown files. Check the database for injected scripts.
6. Find how they got in. Usually an outdated plugin, a nulled (pirated) theme, or a reused password. If you skip this step, the hack comes back.
7. Ask Google to review the site in Search Console once it is clean, so the warnings are removed.

For a business site, I recommend getting help with steps 5 and 6. Malware often leaves backdoors that let attackers return, and a half-clean site gets reinfected within days.

How to stop it happening again

Most hacks I clean up come down to the same few causes. Close them and your risk drops sharply:

• Keep WordPress, plugins and themes updated. See how to update plugins safely.
• Delete plugins and themes you don’t use, including deactivated ones.
• Never install nulled or pirated plugins. Many come with malware already inside.
• Use strong, unique passwords and turn on two-factor authentication for admins.
• Give people the lowest role they need. Not everyone needs to be an Administrator.
• Keep automatic off-site backups. My WordPress backup guide explains how.

Regular updates, monitoring and backups are the core of my WordPress support and maintenance work, because prevention costs far less than a clean-up. If you’re comparing providers, here’s what a WordPress maintenance plan should include.

Frequently asked questions

Featured photo by Towfiqu barbhuiya on Unsplash.