How to tell if your WordPress site has been hacked

The uncomfortable thing about a hacked WordPress site is that you are usually the last to know. Modern compromises are built to stay quiet — they serve spam to search engines, redirect only mobile visitors, or sit dormant waiting to be used later.

Here is how to check, and what to do the moment you find something.

The signs, in the order people usually notice them

• Google flagged you. A red interstitial, or a security issue in Search Console. This is the most common way owners find out, and by then traffic has already collapsed.
• Your host suspended the account. Usually for sending spam from your server.
• Search results show pages you never wrote. Search site:yourdomain.com and look for pharmaceutical, gambling or counterfeit-goods listings.
• Mobile visitors get redirected. Desktop is fine, so you never see it. Test on a phone, on mobile data, in a private window.
• Admin accounts you do not recognise. Check Users, and sort by registration date.
• Files changed at odd times. A modified timestamp at 3am on a file nobody touched.
• The site got slow for no reason. Someone else’s crypto miner or spam script is using your server.

How to check properly

Three checks catch the large majority of compromises:

1. Search Console. Security & Manual Actions → Security Issues. Google will name the problem if it has found one.
2. Compare core files. WordPress core files should match the official release exactly. Anything modified is a red flag.
3. Search the uploads directory for PHP. Your media library should contain images and documents. A .php file in /wp-content/uploads/ is almost never legitimate.

What to do first — and what not to

Do not start deleting files. This is the most common and most expensive mistake. The evidence of how they got in lives in those files, the modification timestamps and the server logs. Delete it and you will clean the site without closing the door, which is precisely why so many sites get reinfected within weeks.

Instead, in this order:

1. Take the site into maintenance mode if it is actively serving malicious content to visitors
2. Change all administrator passwords, and the database and hosting passwords
3. Check for user accounts you do not recognise, but do not delete them yet — note them
4. Take a full backup of the compromised state, for forensics
5. Then get help, or begin a careful cleanup

Where they usually got in

It is almost never a sophisticated attack on you specifically. It is a script scanning millions of sites for a known vulnerability. The usual routes:

• An outdated plugin or theme with a published vulnerability and an available patch nobody applied
• A weak or reused admin password, found through credential stuffing
• A compromised neighbour on shared hosting
• An abandoned plugin that has not been updated in years and never will be

Why sites get hacked again

Two reasons, and both are avoidable. Either the entry point was never identified and closed, or a backdoor was missed. Attackers routinely plant several — in the uploads folder, in a database option, in a legitimate-looking file in a theme nobody reads — specifically so a surface-level cleanup leaves them a way back in.

Any cleanup that does not include finding out how they got in is temporary by design.

What actually prevents it

Unglamorous, and it works: patch quickly, use strong unique passwords with two-factor authentication on every admin account, remove plugins you are not using, run a firewall, and keep offsite backups you have actually tested by restoring. A backup nobody has ever restored is not a backup, it is an assumption.