# How to tell if your WordPress site is hacked

> Ten signs your WordPress site is hacked, why the owner almost never sees them and how to check each one, with WP-CLI commands if you use the command line.

URL: https://webintacta.com/en/guides/how-to-tell-if-wordpress-is-hacked
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** The clearest signs of a hacked WordPress site are redirects that only other people see (on mobile or coming from Google), Google or Chrome warnings, spam pages indexed under your domain, admin users nobody created and PHP files where they don't belong. The owner rarely notices, because a lot of malware hides from logged-in users. If you find any of these, take a backup before you delete anything; a WebIntacta cleanup costs €219.


By Jose Soriano (WebIntacta) · published 2026-10-24

A hacked WordPress site rarely looks hacked. Attackers don't want to break your site: they want to use it to send your visitors elsewhere, slip in spam links or steal data, and for that they need it to keep working. These are the ten signs I see most often, ordered from the most visible to the best hidden.

This guide is specific to WordPress. If your site runs on another CMS (PrestaShop, Joomla, a custom-built store), start with [how to tell if your website is hacked](https://webintacta.com/en/guides/how-to-tell-if-website-is-hacked), which applies to any CMS.

## Why you don't see it

A good share of WordPress malware is written to **hide from the administrator**: it stays quiet if you're logged in, only fires on mobile, only for visitors coming from Google, or only the first time someone visits. That way it can go unnoticed for weeks. So "it works fine for me" rules out nothing.

## The 10 signs

### 1. Your visitors end up on another site

Gambling, pharmacy, prize giveaways, fake virus alerts or push notifications. If a customer mentions it and you can't see it, test from your phone on mobile data (not your Wi-Fi), arriving from a Google result. I go into detail in the [guide on redirects](https://webintacta.com/en/guides/website-redirects-to-another-site).

### 2. Google or Chrome shows a warning

"This site may be hacked" under your Google result, or Chrome's red "Deceptive site ahead" screen. It's the clearest sign, and it has its own [guide to removing the warning](https://webintacta.com/en/guides/google-says-site-is-dangerous).

### 3. Pages in Google that aren't yours

Search Google for `site:yourdomain.com` and go through the results. If you see pages in Japanese, products you don't sell or casino titles, someone has created content on your site to rank their own. It's known as the "Japanese keyword hack" and it's very common.

### 4. Administrators nobody created

In **Users → All Users**, filter by "Administrator". Any account you don't recognize is a bad sign, especially one with a generic name (admin2, wpadmin, support) or an email address on an unknown domain. Careful: some attacks hide their user from the list, so not seeing one doesn't rule it out.

### 5. Plugins you didn't install

Check **Plugins** for names you don't recognize. Also look at the `wp-content/mu-plugins/` folder from your hosting file manager: must-use plugins always load and don't appear in the normal list, which is exactly why attackers use them.

### 6. .php files where they don't belong

The `wp-content/uploads/` folder is for images and documents. A `.php` file in there (or in its year and month subfolders) is almost always a backdoor. Also look for files with random names in the root, next to `wp-config.php`.

### 7. Changes to .htaccess or wp-config.php

Open the `.htaccess` file in the root. A normal WordPress site has a short block between `# BEGIN WordPress` and `# END WordPress`. Rules with `RewriteCond %{HTTP_REFERER}` or `%{HTTP_USER_AGENT}` that send visitors to an external domain are a malicious redirect. In `wp-config.php`, any line with `eval`, `base64_decode` or an odd URL at the top of the file is suspicious.

### 8. Your host warns you or suspends the site

Mass email sending, CPU usage through the roof or a "malware detected" notice. Hosting providers scan their servers and are sometimes the first to notice. Don't ignore it, even if the site looks normal.

### 9. Your emails land in spam or bounce

If your site is used to send spam, your domain or the server's IP ends up on blocklists, and your legitimate email stops arriving. The [free scan](https://webintacta.com/en/free-website-security-scan) checks blocklists and your domain's email setup (SPF, DKIM and DMARC).

### 10. Core files that don't match the originals

It's the most reliable sign and the least visible one. Every WordPress release publishes checksums for its files; if any file in `wp-admin` or `wp-includes` doesn't match, someone has modified it. With SSH access and WP-CLI, you check it like this:

```
wp core verify-checksums
wp plugin verify-checksums --all
```

Without SSH, the [read-only connector](https://webintacta.com/en/read-only-connector) runs the same comparison from the WordPress dashboard, without giving me FTP access.

## What to do if you find one

1. **Don't delete files blindly.** The infected files show how they got in. If you only delete what's visible, the door stays open and the infection comes back.
2. **Take a full backup** (files and database) as it is, infected or not. It serves as evidence and as a way back.
3. **Change the passwords** for hosting, FTP, the database and the administrators, from a clean computer.
4. **Update everything** you can: core, plugins and theme. Most infections get in through an outdated plugin; how to find the ones with known flaws even when the dashboard says nothing is in [vulnerable WordPress plugins](https://webintacta.com/en/guides/vulnerable-wordpress-plugins).
5. **Find the way in before you call it done.** If you don't know how they got in, the cleanup is just a patch.

> Restoring an older backup looks like the quick fix, but if the flaw they used isn't fixed, the site usually gets reinfected within days.

The full sequence, from the first hour to the Google review, is in [how to recover a hacked website](https://webintacta.com/en/guides/recover-hacked-website). And if you're choosing a security plugin, [which WordPress security plugin to choose](https://webintacta.com/en/guides/best-wordpress-security-plugin) explains what each one does and what none of them do.

## If you'd rather I handle it

Cleaning up a hacked WordPress site costs €219 excluding VAT, with a 90-day guarantee and a report of what was there and what I did. The details are in [WordPress malware removal](https://webintacta.com/en/wordpress-malware-removal).

## Sources

- [WordPress: FAQ “My site was hacked”](https://wordpress.org/documentation/article/faq-my-site-was-hacked/) (signs of compromise such as Google warnings, hosting suspension or new users, and `.htaccess` as one of the most frequently modified files).
- [WP-CLI: wp core verify-checksums](https://developer.wordpress.org/cli/commands/core/verify-checksums/) and [wp plugin verify-checksums](https://developer.wordpress.org/cli/commands/plugin/verify-checksums/) (compare core and plugin files against the WordPress.org checksums).
- [WordPress: must-use plugins](https://developer.wordpress.org/advanced-administration/plugins/mu-plugins/) (they are enabled automatically and don't appear in the normal plugin list).
- [WordPress: the basic .htaccess](https://developer.wordpress.org/advanced-administration/server/web-server/httpd/) (the block between `# BEGIN WordPress` and `# END WordPress`).
- [web.dev: fix the Japanese keyword hack](https://web.dev/articles/fix-the-japanese-keyword-hack) (spam pages created on your domain).

## Frequently asked questions

### Will a security plugin catch all of this?

It's good at known signatures and some file changes, but it doesn't check the database thoroughly or tell you how they got in. It helps; it isn't a diagnosis.

### Can my site be hacked if Google shows no warning?

Yes. Google warns when it detects malware or spam in what it crawls; many infections (backdoors, email spam, data theft) leave no trace in the search results.

### How often should I check?

Updates, every week. A full review of files and users, at least once a year or after any major change.

## About the author

[Jose Soriano](https://webintacta.com/en/about): Full-stack developer specialized in PrestaShop, WordPress and WooCommerce, who has passed the official PrestaShop course and exam. He has been building online stores and modules since 2023 and is the founder of WebIntacta, the website security service through which he scans, cleans and maintains small-business websites and online stores himself, remotely from Ibi (Alicante, Spain). WebIntacta facts: https://webintacta.com/en/about#datos