Signs Your WordPress Site Has Been Hacked

Signs other people notice first

A browser or search warning

Google reports hacked content, malware and deceptive pages in the Search Console Security Issues report, and affected pages can show a warning label in search results or a full warning page in the browser ^[1]. If a customer tells you Chrome showed a red screen before your site, take it seriously even if you cannot reproduce it. Google notes that warnings may not appear consistently, and treats the Security Issues report as the source of truth ^[1].

Visitors sent somewhere else

Redirect hacks often target visitors who arrive from a search result, or only visitors on phones, while sending everyone else to your normal page. The result is a customer who insists your site sent them to a prize draw or a pharmacy, while the site looks fine on your office computer.

Strange search results for your name

Search Google for site:yourdomain.com.au and scroll through the results. Japanese or Chinese characters, pages about medicines or luxury goods, or page titles you never wrote suggest a spam hack. The pages may not be visible on the site itself, but Google has seen them.

Bounced or reported emails

If your website sends email, a hacked site can be used to send spam. Signs include bounce messages for emails you did not send, a sudden block on your domain by email providers, or a warning from your host about mail volume. In Australia, the ACMA says commercial messages need consent, must identify the sender and must include a working unsubscribe option ^[3]. Spam sent through a hacked site breaks all three, and it can get your domain blocked by email providers, so stop it quickly and tell your host.

Signs inside WordPress

Users you did not create

Go to Users and sort by role. Any administrator you cannot name is a red flag, especially one with a generic name such as "wpadmin", "support" or a random string. Check the email addresses too: an attacker may reuse a staff name with a different address.

Plugins you did not install

Look at the full plugin list, including inactive plugins. Attackers sometimes add a plugin with a plausible name, or hide one from the list entirely, which is why a file check matters as well.

Settings that changed on their own

Check Settings, General for the site address and admin email, and Settings, Reading to make sure search engines are not being blocked or allowed unexpectedly. A changed admin email address is particularly serious, because it lets the attacker reset passwords.

New posts, pages or comments

Spam pages are often published as drafts or private posts, or given dates in the past so they do not show at the top of your lists. Sort by date and by author.

Signs in the files and hosting account

If you have access to the hosting file manager, a few checks are worth doing:

• PHP files inside wp-content/uploads, which normally holds images and documents only;
• recently modified core files in wp-admin or wp-includes when no update has run;
• unfamiliar files in the main folder with names that imitate WordPress files;
• a changed .htaccess file with redirect rules you did not add.

The WordPress hardening guide recommends keeping logs and monitoring file integrity precisely so that changes like these can be spotted and traced ^[2].

Performance and hosting signs

A site that suddenly becomes slow, uses far more bandwidth than usual, or hits its hosting limits may be serving spam pages or running scripts in the background. A suspension notice from your host is the most obvious sign of all. Hosts usually act after an automated scan or a complaint, and the notice often lists the files involved.

Things that look like a hack but may not be

Not every oddity is an attack. Before raising the alarm, rule out the ordinary explanations:

• A site that breaks straight after an update may simply have a plugin conflict rather than a hack, especially if nothing else on this page applies.
• An expired security certificate causes browser warnings that look alarming but are fixed by renewing the certificate.
• A slow site may simply have outgrown its hosting plan or have a heavy new plugin.
• A new user may have been added by a colleague or a developer you forgot was working on the site.

The difference is usually in the detail: a certificate warning names the certificate, while a Google security warning names deceptive or dangerous content. When in doubt, the Search Console Security Issues report is the place to check ^[1].

A five-minute check from your phone

If you only have a few minutes, do this. Open a private browsing window on your phone, search Google for your business name, and tap your site in the results. Then search for site: followed by your domain and scroll through the titles. Finally, ask a colleague on a different network to do the same. If all three look normal and Search Console shows no security issues, the site is less likely to be serving a hidden redirect.

What to write down when you spot a sign

When something looks wrong, the instinct is to fix it straight away. Before you do, take two minutes to record what you are seeing. Early signs are often the best clues to how the site was affected, and they can disappear once someone starts changing things.

Write down:

• the date and time you noticed it, and the device and browser you were using;
• the exact web address where it appeared, copied from the address bar;
• what happened, in plain words, such as "redirected to a pharmacy site on mobile only";
• whether it happens every time, or only sometimes, or only for visitors who arrive from a search engine;
• a screenshot, if you can take one safely without entering details on the strange page.

Some infections show themselves only to certain visitors, such as people on phones or people clicking from search results, and stay hidden from logged-in administrators. That is why a note like "only from Google on my phone" is so valuable to whoever investigates.

Do not try to reproduce a harmful redirect over and over, and never enter passwords or payment details on a page you were redirected to. One clear record is enough to start with.

How to check without making it worse

• Do not start deleting files. You may remove evidence of how the attacker got in, or break the site in ways that make recovery harder.
• Copy before you change. If you can, download a full backup of files and database as they are now.
• Use a clean device. Change passwords from a computer you trust, not one that might be part of the problem.
• Write down what you see. Dates, screenshots, user names and file names all help whoever cleans the site. Our incident checklist builds a simple text file of your notes.

If several of these signs are present, move on to the first steps after a hack, which explains how to contain the problem while keeping evidence intact.