A hacked WordPress site rarely announces itself. Most compromises are built to stay quiet, and the owner is often the last to find out. The signs below are grouped by where you can see them, followed by quick checks and a way to tell a compromise from an ordinary fault.
Signs visitors see
- Redirects. Visitors are sent to unrelated sites. Often it only happens on mobile, from a search result, or on a first visit, so you may never see it. See WordPress Site Redirecting to Spam: Causes and Fixes.
- Popups, banners or overlays that your theme and plugins don't produce.
- Defacement. The home page replaced with a message, or content changed without anyone editing it.
- Browser warnings such as "Deceptive site ahead", which means a safety service has flagged the domain. See flagged and blacklisted sites.
Signs in search results
Search Google for site:yourdomain.com and scan the titles. Pages about casinos, pharmacy products or text in another language that you never published are a strong indicator of SEO spam. These pages are frequently cloaked, so they appear in search but not when you browse the site. If you have Google Search Console, open the Security issues report and look for sudden swings in indexed pages or traffic.
See WordPress spam links and SEO spam hack and Casino and Pharmacy Spam on WordPress: Cleanup Guide.
Signs in the WordPress dashboard
- Administrator accounts you didn't create, or editors who were silently promoted. See Unknown Admin User in WordPress: What to Do.
- Plugins or themes you don't remember installing, especially ones with generic names.
- Settings changed: site URL, default user role, permalink structure.
- You can't log in, or password-reset emails arrive that you didn't request.
- Posts or pages with links or scripts that you didn't add.
Signs on the server
- A malware or abuse notice from your hosting provider, or a suspension. See WordPress Website Suspended for Malware: Recovery Guide.
- CPU or bandwidth spikes with no change in real traffic.
- Outgoing spam email from the domain, or bounces for mail you didn't send.
- PHP files in
wp-content/uploads, or core and plugin files with recent modification dates you can't explain.
Quick checks you can run
If you have shell access and WP-CLI, these read-only commands answer several of the questions above. They change nothing.
# Compare WordPress core files with the official release
wp core verify-checksums
# Compare plugin files with the published versions (wordpress.org plugins)
wp plugin verify-checksums --all
# List administrators
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
# PHP files that should not exist in uploads
find wp-content/uploads -type f -name "*.php"
# Files changed in the last 7 days
find . -type f -name "*.php" -mtime -7Treat results as leads, not verdicts. Plugin and theme updates change files legitimately, and a clean checksum result doesn't prove a clean site, because malware also lives in the database and in files that checksums don't cover.
Hack or glitch?
| Symptom | Usually harmless if… | Points to a compromise if… |
|---|---|---|
| Changed files | They match a plugin or core update you ran | They changed with no update, or are PHP files in uploads |
| New admin user | A colleague or agency you know created it | Nobody can say who created it, or it has an odd email |
| Slow site | Traffic grew, or a plugin update needs tuning | CPU is high while traffic is flat |
| Redirect | You set it up deliberately in a plugin or .htaccess | It only affects some visitors, and you didn't configure it |
| Spam in Google | Someone else is copying your domain name on their own site | The URLs are on your domain |
What to do if you think it's a compromise
Don't start deleting. Take a copy of the files and database first, then work through the WordPress Hacked Site Emergency Checklist. The full lifecycle is in the The Complete WordPress Hacked Site Recovery Guide. If you would rather have it handled, hacked-site recovery and malware removal start from $199.
Further reading
Dealing with this on a live site?
Send us the details and we'll tell you what we'd do and what it would cost.