10 Signs Your WordPress Site Was Hacked
Learn the warning signs of a hacked WordPress site, how to verify each symptom, and the steps to contain, clean, and prevent another compromise.
A hacked WordPress website does not always display an obvious warning. Attackers often try to remain hidden so they can send spam, redirect visitors, steal data, or maintain access. Early signs may include unexplained slowdowns, unknown pages in Google, new administrator accounts, failed email delivery, or unexpected file changes.
Quick answer: how can you tell if a WordPress site was hacked?
Check for these warning signs:
- visitors are redirected to unfamiliar domains;
- pages, links, advertisements, or downloads appear without permission;
- unknown WordPress administrator accounts exist;
- Google Search Console reports malware, phishing, or hacked content;
- hosting resource usage rises without a clear reason;
- email from the domain reaches spam or is rejected;
- WordPress core, plugin, or theme files changed unexpectedly.
One symptom does not always prove a compromise. Two or more unusual changes appearing in the same period justify an urgent security investigation.
10 less obvious signs that your WordPress site was hacked
1. The website suddenly became slow
A sharp increase in loading time may occur when malicious code sends spam, generates automated traffic, or runs hidden server processes. Performance problems can also have normal causes, including a faulty plugin, oversized images, or insufficient hosting resources.
How to check: compare current performance with earlier measurements, review CPU and memory usage in your hosting account, and ask your provider whether it sees unusual requests or processes.
2. Visitors are redirected to unfamiliar websites
Some infections redirect only mobile users, visitors arriving from search engines, or first-time visitors. You may see a normal website while customers are sent to gambling pages, fake products, advertisements, or phishing forms.
How to check: test the website in a private browser window, on a phone, and from a different connection. Avoid repeatedly opening a suspicious page on your main work device.
3. Unknown pages appear in Google results
Attackers may create hundreds of pages about pharmaceuticals, loans, gambling, or counterfeit products. Sometimes this content is shown only to search engines, a technique called cloaking.
How to check: search Google for site:yourdomain.com and review unfamiliar titles. In Google Search Console, inspect the Pages, Manual Actions, and Security Issues reports.
4. New administrator accounts appear
An unknown administrator account allows an attacker to return even after you change your password. Its username may look legitimate or resemble a technical service account.
How to check: open Users in the WordPress dashboard and review every account with administrator privileges. Confirm each account with your team and external providers before removing it.
5. Website emails reach spam or stop sending
A compromised site may be used to send unsolicited email. The reputation of the domain or server IP can decline, causing legitimate order, password reset, and contact form messages to be rejected.
How to check: review email delivery logs, test messages, and hosting notifications. Also check the email service for unfamiliar accounts, forwarding rules, or authentication changes.
6. Content, links, or advertisements changed
Spam links can be hidden in the footer, old articles, page source, or areas displayed only on certain devices. Unauthorised banners, pop-ups, and downloadable files may also appear.
How to check: compare important pages with a backup known to be clean. Review the homepage, high-traffic landing pages, checkout, forms, and older posts.
7. Plugins or the theme behave differently
A plugin disabled without explanation, changed settings, or failed updates may indicate altered files. These symptoms can also come from software conflicts or insufficient disk space.
How to check: document what changed, review the activity log, and compare files with official versions. Preserve evidence before reinstalling software.
8. Unknown PHP files or scheduled tasks appear
Attackers may add files with names similar to legitimate WordPress files or scheduled tasks that restore malware after cleanup. This method of retaining access is called persistence.
How to check: ask a qualified specialist to review recently modified files, upload directories, server configuration, and scheduled events. Deleting files at random can break the website or destroy useful evidence.
9. Your hosting provider sends an alert or suspends the site
The host may detect malware, spam, phishing, excessive resource use, or unusual connections. Suspension does not automatically mean WordPress caused the problem, but it should be treated as a security incident until investigated.
How to check: request the detected file list, incident time, logs, and reason for the restriction. Keep all reports and messages for the investigation.
10. Google or the browser displays a security warning
Google may flag malware, hacked content, or social engineering. The warning can appear in search results or before a visitor opens the website.
How to check: review the official Security Issues report in Google Search Console. The example URLs supplied by Google are a sample and may not represent every affected page.
What not to do when you suspect a hack
- Do not ignore warnings because the website looks normal on your computer.
- Do not install several security scanners at the same time.
- Do not delete suspicious files before preserving a copy for investigation.
- Do not restore a backup until you investigate how access was gained.
- Do not change passwords from a device that may itself be infected.
- Do not publish technical details that could help the attacker regain access.
What should you do immediately?
Step 1: document the symptoms
Take screenshots and record the time, affected URLs, warnings, and changes you observed. WordPress recommends a practical response that begins by documenting indicators of compromise.
Step 2: contact the hosting provider
Ask the host to review its logs, isolate the account if necessary, and preserve a copy of the files. If the same hosting account contains several websites, each one must be checked.
Step 3: limit access
If visitors, payments, or personal data may be at risk, use a maintenance page or ask the host to restrict access temporarily. Do not continue collecting information through a website that may be unsafe.
Step 4: change credentials from a safe device
Change passwords for WordPress, hosting, SFTP, database access, email, and connected services. End active sessions, remove unknown accounts, and enable two-factor authentication where available.
Step 5: identify the source of the compromise
Review WordPress, plugin, and theme versions, administrator accounts, modified files, server logs, and administrator devices. Removing visible malware without fixing the original vulnerability allows reinfection.
Step 6: clean or restore the website carefully
Replace WordPress core, plugins, and themes with clean copies from official sources. Remove malicious persistence and spam content. A backup is useful only if it predates the incident and the weakness that enabled the attack is fixed.
Step 7: test before reopening
Test login, forms, orders, payments, email, user roles, and indexed pages. Continue monitoring activity and server logs after the website returns online.
Step 8: request a Google review when required
After the site is clean and the cause has been removed, request a review in Search Console. Explain the issue, what was cleaned, and what controls were added to prevent another compromise.
How to prevent another WordPress compromise
- update WordPress, the theme, and plugins after testing;
- remove unused or abandoned extensions;
- use unique passwords and two-factor authentication;
- give administrator access only to people who need it;
- store automated backups in a separate location;
- monitor file changes, logins, and known vulnerabilities;
- test restoration and incident response procedures regularly.
Official WordPress guidance explains that security is about reducing risk, not eliminating it entirely. Review the WordPress hardening guide and the official My site was hacked FAQ.
For a broader plan, read our cybersecurity guide for small businesses, prepare a WordPress disaster recovery plan, and compare the best WordPress security plugins for 2026.
Frequently asked questions
Does a slow site mean it was hacked?
Not necessarily. Hosting limitations, large images, traffic, or a faulty plugin can also reduce performance. It becomes a stronger warning when the slowdown appears with modified files, redirects, suspicious traffic, or unusual resource usage.
Can a security plugin confirm the attack by itself?
Not in every case. Scanners may miss new code, database changes, or attacks shown only to selected visitors. A reliable investigation combines scanning with server logs and reviews of files, accounts, traffic, and scheduled tasks.
Is restoring a backup enough?
No. If the compromised account, vulnerable plugin, or stolen password remains, the attacker can return. Verify the backup, restore it carefully, fix the original weakness, and continue monitoring.
Do I need to report the incident?
If personal, payment, or confidential data may have been exposed, contractual and legal obligations may apply. Preserve evidence and seek appropriate legal or data protection advice promptly.
Do you run an online store or collect personal data?
Treat any suspected compromise urgently. Removing a visible redirect does not prove that the attacker’s access is gone or that customer data is safe.
Do you suspect that your WordPress site was hacked?
We can review indicators of compromise, identify the likely source, and define a safe cleanup and hardening plan without making random changes to the live website.
