How to tell if your WordPress site is hacked

In short

The clearest signs of a hacked WordPress site are redirects that only other people see (on mobile or coming from Google), Google or Chrome warnings, spam pages indexed under your domain, admin users nobody created and PHP files where they don't belong. The owner rarely notices, because a lot of malware hides from logged-in users. If you find any of these, take a backup before you delete anything; a WebIntacta cleanup costs €219.

A hacked WordPress site rarely looks hacked. Attackers don't want to break your site: they want to use it to send your visitors elsewhere, slip in spam links or steal data, and for that they need it to keep working. These are the ten signs I see most often, ordered from the most visible to the best hidden.

By Jose SorianoLast updated: October 24, 20265 min read

This guide is specific to WordPress. If your site runs on another CMS (PrestaShop, Joomla, a custom-built store), start with how to tell if your website is hacked, which applies to any CMS.

Why you don't see it

A good share of WordPress malware is written to hide from the administrator: it stays quiet if you're logged in, only fires on mobile, only for visitors coming from Google, or only the first time someone visits. That way it can go unnoticed for weeks. So "it works fine for me" rules out nothing.

The 10 signs

1. Your visitors end up on another site

Gambling, pharmacy, prize giveaways, fake virus alerts or push notifications. If a customer mentions it and you can't see it, test from your phone on mobile data (not your Wi-Fi), arriving from a Google result. I go into detail in the guide on redirects.

2. Google or Chrome shows a warning

"This site may be hacked" under your Google result, or Chrome's red "Deceptive site ahead" screen. It's the clearest sign, and it has its own guide to removing the warning.

3. Pages in Google that aren't yours

Search Google for site:yourdomain.com and go through the results. If you see pages in Japanese, products you don't sell or casino titles, someone has created content on your site to rank their own. It's known as the "Japanese keyword hack" and it's very common.

4. Administrators nobody created

In Users → All Users, filter by "Administrator". Any account you don't recognize is a bad sign, especially one with a generic name (admin2, wpadmin, support) or an email address on an unknown domain. Careful: some attacks hide their user from the list, so not seeing one doesn't rule it out.

5. Plugins you didn't install

Check Plugins for names you don't recognize. Also look at the wp-content/mu-plugins/ folder from your hosting file manager: must-use plugins always load and don't appear in the normal list, which is exactly why attackers use them.

6. .php files where they don't belong

The wp-content/uploads/ folder is for images and documents. A .php file in there (or in its year and month subfolders) is almost always a backdoor. Also look for files with random names in the root, next to wp-config.php.

7. Changes to .htaccess or wp-config.php

Open the .htaccess file in the root. A normal WordPress site has a short block between # BEGIN WordPress and # END WordPress. Rules with RewriteCond %{HTTP_REFERER} or %{HTTP_USER_AGENT} that send visitors to an external domain are a malicious redirect. In wp-config.php, any line with eval, base64_decode or an odd URL at the top of the file is suspicious.

8. Your host warns you or suspends the site

Mass email sending, CPU usage through the roof or a "malware detected" notice. Hosting providers scan their servers and are sometimes the first to notice. Don't ignore it, even if the site looks normal.

9. Your emails land in spam or bounce

If your site is used to send spam, your domain or the server's IP ends up on blocklists, and your legitimate email stops arriving. The free scan checks blocklists and your domain's email setup (SPF, DKIM and DMARC).

10. Core files that don't match the originals

It's the most reliable sign and the least visible one. Every WordPress release publishes checksums for its files; if any file in wp-admin or wp-includes doesn't match, someone has modified it. With SSH access and WP-CLI, you check it like this:

wp core verify-checksums
wp plugin verify-checksums --all

Without SSH, the read-only connector runs the same comparison from the WordPress dashboard, without giving me FTP access.

What to do if you find one

Don't delete files blindly. The infected files show how they got in. If you only delete what's visible, the door stays open and the infection comes back.
Take a full backup (files and database) as it is, infected or not. It serves as evidence and as a way back.
Change the passwords for hosting, FTP, the database and the administrators, from a clean computer.
Update everything you can: core, plugins and theme. Most infections get in through an outdated plugin; how to find the ones with known flaws even when the dashboard says nothing is in vulnerable WordPress plugins.
Find the way in before you call it done. If you don't know how they got in, the cleanup is just a patch.

The full sequence, from the first hour to the Google review, is in how to recover a hacked website. And if you're choosing a security plugin, which WordPress security plugin to choose explains what each one does and what none of them do.

If you'd rather I handle it

Cleaning up a hacked WordPress site costs €219 excluding VAT, with a 90-day guarantee and a report of what was there and what I did. The details are in WordPress malware removal.

Sources

WordPress: FAQ “My site was hacked” (signs of compromise such as Google warnings, hosting suspension or new users, and .htaccess as one of the most frequently modified files).
WP-CLI: wp core verify-checksums and wp plugin verify-checksums (compare core and plugin files against the WordPress.org checksums).
WordPress: must-use plugins (they are enabled automatically and don't appear in the normal plugin list).
WordPress: the basic .htaccess (the block between # BEGIN WordPress and # END WordPress).
web.dev: fix the Japanese keyword hack (spam pages created on your domain).

Frequently asked questions

Will a security plugin catch all of this?

It's good at known signatures and some file changes, but it doesn't check the database thoroughly or tell you how they got in. It helps; it isn't a diagnosis.

Can my site be hacked if Google shows no warning?

Yes. Google warns when it detects malware or spam in what it crawls; many infections (backdoors, email spam, data theft) leave no trace in the search results.

How often should I check?

Updates, every week. A full review of files and users, at least once a year or after any major change.