Practical guides on websites, online stores, and getting found on Google — written for business owners, not developers.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
19 real signs your WordPress site is hacked, grouped by who notices first: you, Google, or your host. Each comes with the 2-minute check to confirm it.
Something feels off on your WordPress site, and you cannot say exactly why.
Maybe a client mentioned a strange redirect. Maybe Google flagged a page you don't remember writing. Maybe nothing looks wrong at all, and that is exactly the problem.
Most WordPress hacks are quiet. On one site we investigated, the actual break-in happened more than a year before anyone noticed a single symptom. Attackers do not usually deface a homepage the day they get in. They plant a backdoor, wait, and use the site slowly, a redirect here, a fake plugin there, spread out over months so nothing triggers alarm.
That is what makes it hard to tell if your site is actually hacked. A slow site could be a plugin conflict. A traffic drop could be seasonal. A weird admin account could be an old freelancer nobody removed. Chase every odd thing on your site like it's a hack and you'll waste a day on nothing. Ignore the wrong one and you'll lose your rankings.
Below are 19 real signs, grouped by who notices them first: your visitors, Google, your own dashboard, your files, or your host. Each one comes with the fast check that tells you whether you're looking at a hack or a false alarm.
Each sign below follows the same shape: what it looks like, the ordinary explanation people usually mistake it for, and the check that tells you which one you're actually looking at, usually in under two minutes.
One sign by itself is a clue, not a verdict. A slow site alone probably isn't a hack. A slow site plus a plugin you never installed probably is. Read for patterns, not single red flags.
The signs are grouped by who notices them first: your visitors, Google, your own dashboard, your files, or your host. Start with whichever group matches what actually happened to you.
These are the signs a visitor, a customer, or your own eyes catch first, often before you've opened wp-admin.
Random text on your homepage, a hacker's signature, spam links, or a page in a language you don't publish in. Rule out a cached old version or a demo theme you accidentally left active first. Load the page in an incognito window with a hard refresh. If the change is still there and nobody on your team made it, it's real.
Visitors click a link to your site and land somewhere else entirely, often gambling or pharma spam. Hackers usually cloak this so only new visitors, mobile users, or logged-out traffic get redirected, while you, logged in as admin, see nothing wrong.
This is exactly what happened on a client site we cleaned up: casino spam started appearing on its own, then desktop visitors were redirected to a fake Cloudflare "verify you are human" page that walked them through pasting a command into Windows Terminal. A real Cloudflare check never asks you to run anything on your computer. We've documented that full incident in Fake Cloudflare CAPTCHA: WordPress ClickFix Malware Case Study.
Test the site in an incognito window and on your phone, not just at your desk. If the redirect keeps coming back after cleanup, see WordPress Redirect Hack: How to Stop Your Site Redirecting to Spam.
A "your browser is out of date" prompt, an ad, or a pop-up nobody on your team installed. Check first whether a plugin update quietly added it, since some ad and subscription plugins do this by default. View the page source for a script tag you don't recognize, or disable plugins one at a time on staging to isolate it.
Chrome shows a "dangerous site" warning, or an antivirus tool flags your domain. This one is rarely a false alarm. Pull up Google's Safe Browsing transparency report and Search Console's Security Issues tab; both name the exact threat Google found and when.
A customer says they got an email "from you" asking for card details, or a charge they never made. This can be a payment processor issue unrelated to your site, so rule that out first. Then review WooCommerce for unfamiliar admin or API users, and check whether your own server is the one sending the phishing emails.
Search engines usually notice a hack before you do, since they crawl your site more often than you check it.
Google adds this warning directly under your listing in search results. It is not a guess. Google's automated scanners found something specific, usually injected spam content or a malicious redirect, and flagged it publicly. Open Search Console's Security Issues report, where Google lists exactly what it found and on which pages.
A red banner in Search Console reporting malware, spam content, or a manual action against your site. This one almost never happens without a real cause behind it. Read which pages are affected and what type of issue Google logged; the report tells you exactly where to start looking.
Organic traffic falls off a cliff with no algorithm update, seasonal pattern, or content change to explain it. Rule out a manual action or a known Google update first by checking Search Console and comparing dates. If neither explains it, check whether specific pages lost rankings for spammy or unrelated keywords instead of your own, since that points to a hack rather than an algorithm shift.
Our security experts remove malware, fix vulnerabilities, and protect your site.
Search site:yourdomain.com in Google and pages you never wrote show up, often pharmacy spam or content in a language your site doesn't use. This is a classic sign of a hack built to rank on someone else's keywords using your domain's authority. We've covered this exact pattern in Japanese Keyword Hack: How to Detect and Remove Japanese SEO Spam. Scroll past the first page of results when you run that search, since the spam is usually buried deeper in the index.
These signs show up only once you log in, which is exactly why hackers try to keep you from noticing them.
An admin or user account you don't recognize, sometimes with a name close enough to yours to go unnoticed. Rule out an old freelancer or agency account nobody removed. Check each user's registration date under Users; a hacker-created account usually appears the same day as the first suspicious activity elsewhere on the site.
A plugin or theme in your list that nobody on your team recalls adding, often with a generic or misspelled name. Before assuming the worst, check if it came bundled with your theme or hosting package. Look the plugin name up directly, since malicious plugins rarely exist on the official WordPress.org repository.
Your firewall or malware scanner shows as inactive, or scan results stop updating, and nobody turned it off. A plugin conflict after an update can sometimes cause this too. Open the plugin's own activity log for the exact time and user behind the change, not just whether it's currently on.
Your site's title, tagline, or the admin email under Settings no longer matches what you set. Almost nobody touches these fields after launch, so this rarely happens by accident. Cross-check it against your original setup notes or a backup from before the change, and see who was logged in at the time.
Posts, pages, or menu items changed, scheduled, or published that nobody remembers writing. A forgotten scheduled post from months ago can look alarming but is harmless. Check the post revision history for the author and timestamp, and compare it against your team's actual work schedule.
These four need FTP, SSH, or hosting panel access. If that's not you, this section tells you what to ask whoever manages your server.
A .php file sitting in a folder meant for images, PDFs, or media only. WordPress never puts executable code there on its own. On the same client incident referenced above, one of the malicious files was named to look like a routine template, sitting in exactly this folder. We walk through the full file list and the cleanup in How We Recovered a Hacked WordPress Site, and if you want to do this yourself, How to Manually Scan and Clean WordPress Malware walks through the process.
Check the file's creation date against any suspicious activity elsewhere on the site, and open it in a text editor rather than running it.
Code in WordPress core files, your database config, or redirect rules you never wrote. A recent WordPress or plugin update can sometimes touch core files legitimately. On the same incident, we found a fake wp-config.php planted inside a theme folder instead of the site's real config location, exactly because nobody thinks to check there.
Compare the file against a clean copy of the same WordPress version, or check your host's file change log if one exists.
A scheduled task in WP-Cron or your server's cron list that nobody set up, often running at odd hours. Some plugins add legitimate scheduled jobs during setup. Check what command or script the job actually runs; a hacker's cron job usually points to a file you don't recognize.
Server resource usage spikes, pages take longer to load, or your host warns about excessive CPU use, all with no real increase in visitors. This is often just a heavy plugin or an unoptimized image. Check your server's process list during the slowdown for a script you don't recognize consuming resources.
If any of these four check out positive, stop here before you delete or fix anything. Screenshot what you found, note the exact file paths and timestamps, and leave the files in place. Those timestamps matter more than they look: on the same incident, comparing them showed the attacker planted files in two separate waves eleven hours apart, which is how we could tell this wasn't a single break-in but someone who came back. That evidence is what separates a five-minute cleanup from finding the same backdoor three months later. We walk through that process step by step in WordPress Site Hacked? How to Investigate the Attack Before You Clean It.
Your hosting provider suspends the site, or emails you about malware, spam, or resource abuse traced to your account. Hosts run their own detection independent of any plugin you have installed. Ask your host for the specific file paths or log entries that triggered the report; a vague "suspicious activity" notice can mean anything from a hack to a misconfigured contact form.
One sign on this list is worth a second look. Two or three together, especially across different clusters, means stop guessing and start investigating.
If what you confirmed lives in your files, your server, or a cron job, that's usually past what a non-technical site owner should handle alone. That's exactly the situation our WordPress malware removal service exists for, and it's the same forensic approach we used on the real infection referenced throughout this list.
If none of the 19 signs above confirmed positive but something still feels wrong, don't stop here. Our guide to investigating a WordPress hack covers exactly how to trace an attacker's path through your logs and files once you suspect something.
Yes. Many of the signs above only show up in files, logs, or Search Console, not on the page itself. A site can look completely normal to every visitor while a backdoor sits quietly in the background for months.
Not entirely. A scanner finds known malware patterns, not every backdoor an attacker might leave behind. A clean scan combined with any of the 19 signs above still deserves a closer manual look.
Usually not. A white screen or fatal error is more often a plugin conflict, a failed update, or a PHP memory limit issue. Check your error logs first; a hack rarely announces itself this loudly.
Preserve evidence before you fix anything: screenshot what you found and note file paths and timestamps. Then move to isolating the site and finding how the attacker got in, not just what they left behind.
SEO & Security Expert, AppDeel
Azizul Hakim is an SEO and website security specialist at AppDeel, the agency he founded and where he still handles client work himself. For more than ten years he has helped business owners and eCommerce brands get found in search and keep their websites secure.
Read more posts by Md Azizul Hakim →Comment spam, form spam and fake registrations all cost you time, leads and security. Here's a business owner's guide to stopping WordPress spam for good.
A brute force attack is a hacker's program trying login after login, thousands or millions of combinations, until one works.
XML-RPC still runs on most WordPress sites by default. See what it does, who still needs it, and a clear answer on when to disable it safely.
Nulled WordPress themes and plugins ship with malware and backdoors built in. Here are 12 real reasons to avoid them, with the data behind each one.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
