A WordPress site rarely announces that it’s been hacked. There’s no popup that says “you’ve been compromised,” unless the attacker wants you to see it. Most of the time, the signs your WordPress site is hacked are quiet: a strange redirect on mobile, a login that stops behaving normally, or a Google warning that shows up with no obvious cause. Catching those signs early is usually the difference between a 20-minute cleanup and a site that stays blacklisted for weeks.
How Do You Know If Your WordPress Site Has Been Hacked?
The clearest signs a WordPress site has been hacked are unexpected redirects to unfamiliar URLs, unknown administrator accounts in the Users list, a sudden drop in search rankings, and browser or Google Search Console warnings about malicious content. Any single one of these is worth investigating immediately rather than waiting to see if it happens again.
Most WordPress hacks are built to stay invisible for as long as possible. Spam injection attacks, for example, add hidden links and pages designed to boost someone else’s SEO without changing anything a site owner would notice on a normal visit. That’s exactly why checking for the signs below matters, rather than waiting for the site to visibly break.
The Warning Signs to Check First
A compromised WordPress site usually shows a combination of these signs, not just one. Working through this list takes a few minutes and covers the most common indicators of a hack:
- Unknown administrator accounts under Users > All Users
- The site redirects visitors to spam, gambling, or adult content, especially on mobile devices
- Google Search Console shows a “Security Issues” warning or search results display “This site may be hacked”
- Browsers show a red “Deceptive site ahead” warning when visitors try to load the site
- Unexplained spikes in server resource usage, outgoing email, or bandwidth
- New pages or posts that nobody on the team created, often stuffed with spam links or foreign-language text
- PHP files sitting inside
wp-content/uploads/, a folder that should only ever contain media, never executable code
According to Sucuri’s 2023 Hacked Website Report, WordPress accounted for 95.5% of the CMS infections Sucuri cleaned that year, despite powering only around 62.8% of CMS-driven websites. That gap comes almost entirely from outdated plugins and themes, not a flaw in WordPress core itself, which is one reason plugin hygiene matters as much as the WordPress version number.
Is It a Hack or Just a Broken Plugin?
A hack usually adds something to a WordPress site, such as new files, new admin accounts, spam content, or redirects, while a plugin conflict usually breaks something, like a blank white screen, a fatal error, or a layout falling apart. If a site is generating unfamiliar content or sending traffic somewhere it shouldn’t, that points to a security issue rather than a compatibility bug.
It’s worth ruling out a simpler cause before assuming the worst. A WordPress plugin conflict after an update can look alarming, but it’s a much faster fix than an actual infection, and the two problems require completely different responses.
What to Do the Moment You Suspect a Hack
The first moves after finding a hacked WordPress site are to take it offline or into maintenance mode, change every password connected to it, and back up the site in its current infected state before making any changes, so there’s a reference copy to compare against later.
- Put the site into maintenance mode or take it offline temporarily to stop it from spreading spam or malware to visitors
- Change every password connected to the site: WordPress admin, hosting account, FTP/SFTP, and the database
- Take a full backup of the site as-is, infection included, for reference during cleanup
- Check Users > All Users for unfamiliar administrator accounts and remove any that weren’t created intentionally
- Contact hosting support, since many hosts detect and quarantine hacked accounts automatically and can confirm when the infection started
How to Actually Remove WordPress Malware
Removing WordPress malware means scanning every file and database table for injected code, replacing core WordPress files with fresh copies, deleting unrecognized plugins and themes, and restoring content from a backup taken before the infection started. Reinstalling WordPress core on its own won’t fix an infected plugin or theme file, so all three layers, core, plugins, and uploads, need to be checked separately.
From Dashboard > Updates, WordPress can re-install the currently installed version, which overwrites core files without touching the database or content. For sites with WP-CLI access, checking file integrity directly is faster than reviewing files by hand:
wp core verify-checksums
wp plugin verify-checksums --allThese commands compare installed core and plugin files against the official checksums and flag anything that’s been modified, which is usually where injected code hides. A dedicated security plugin such as Wordfence or Sucuri can run the same kind of scan on hosts without command-line access.
Having a clean backup from before the infection makes this entire step faster, since restoring known-good files beats manually auditing every line of code. For sites without reliable backups already in place, comparing WordPress backup plugins is worth doing once the site is stable, not during the emergency itself.
How to Stop It From Happening Again
Preventing another WordPress hack comes down to keeping everything updated, removing unused plugins and themes, using strong unique passwords with two-factor authentication, and limiting login attempts. None of these are exotic security measures, they’re the basics that get skipped once a site has been running fine for a while.
- Update WordPress core, plugins, and themes on a regular schedule, not just when something visibly breaks
- Delete plugins and themes that aren’t active, inactive code can still be exploited even when it isn’t running
- Run ongoing scans with a security plugin such as Wordfence or Sucuri
- Enable two-factor authentication on every administrator account
- Keep offsite backups running automatically instead of relying on occasional manual ones
Adding two-factor authentication closes off the most common way a stolen or guessed password turns into a full site takeover, and it takes a fraction of the time a malware cleanup does.
A hacked WordPress site is rarely random. It’s almost always an outdated plugin, a weak password, or a theme that hasn’t been touched in years. Catching the warning signs early, then covering the basics above, closes the door most attacks actually walk through.
Frequently Asked Questions
Check for unknown administrator accounts, unexpected redirects, a Google Search Console security warning, or new pages and posts nobody on the team created. Any one of these on its own signals a likely compromise worth investigating right away.
Yes, in most cases. Malware removal targets injected code and rogue files rather than actual posts, pages, and media, so a proper cleanup restores security without erasing content, especially when a clean backup or careful manual review is used.
No. Google typically applies a temporary “This site may be hacked” warning that’s removed once the malware is cleaned and a review is requested through Search Console, usually within a few days of a successful review.
Not always. Site owners comfortable working with files and a database can often clean a straightforward infection using a security plugin, though deeply embedded or repeat infections usually justify bringing in professional help.
Restoring a clean backup taken before the infection is almost always faster than manually removing malware line by line, provided the backup predates the hack and hosting logs confirm roughly when the infection started.
Leave a Reply