Here is the uncomfortable truth about the signs your WordPress site has been hacked: the obvious ones are the lucky ones. A defaced home page tells you right away. A quiet infection that sends spam from your server for three months does not.
So this is a field guide to both kinds. Twelve signs, split into the ones you can see and the ones hiding in the back rooms, with a quick way to check each. At the end, there is what to do first, which matters more than most people expect.
If you read this and find something, take a breath. Hacked sites get cleaned every day. You are about to be one of the people who noticed.
Visible Signs Your WordPress Site Has Been Hacked
These are the signs you (or your visitors) can see with a browser. They are the easiest to spot, though not always as easy as you would think.
1. Visitors Get Sent Somewhere Else
Your site loads fine for you, but a customer says they landed on a pharmacy page, a fake prize draw or a "your phone is infected" screen. This is a redirect hack, and it is a sneaky one because it often skips anyone who is logged in, and sometimes anyone on a desktop.
How to check: Open your site in a private window on your phone, on mobile data (not your office wifi). Then search for your own business name on Google and click the result from there. Many redirects only fire for visitors who arrive from a search engine. We cover this one in depth in our guide to the WordPress redirect hack.
2. Spam Pages or Links You Did Not Write
You find pages about watches, loans or casinos that you never created. Or your real pages have a block of links tucked in the footer, or hidden with CSS so only search engines see them.
How to check: Search Google for site:yourdomain.com and scroll through the results. Look for titles that have nothing to do with your business, or for pages in another language. A search like site:yourdomain.com casino or site:yourdomain.com pharmacy is a quick way to test for the usual suspects (drug spam has its own guide: the WordPress pharma hack). Spam that only shows up in your comments is a different, milder problem, covered in WordPress comment spam. Pages in Japanese are a special case with their own fix, covered in the Japanese keyword hack.
3. A Defaced Home Page
The classic. Your home page has been replaced with a message, a skull, or a proud announcement from a group you have never heard of. These days it is less common than quiet infections, because defacement draws attention and attackers usually prefer not to be noticed.
How to check: Look at it. If it happened, you will know. Also check a few inner pages and your sign-in page, since a partial defacement is easy to miss.
4. Browser or Google Warnings
Chrome shows a red "Dangerous site" screen. Google Search adds "This site may be hacked" under your result. Your security plugin or your host tells you the site is blocklisted. Our guide to removing the "This site may be hacked" warning covers this sign in full.
How to check: Open Google Search Console and look at the Security Issues report. It lists what Google thinks is wrong and, once you have cleaned up, it is where you ask for a review. Google's own page on malware and unwanted software explains how that process works.
5. You Cannot Sign In Anymore
Your password stopped working, or your account has vanished from the Users screen. Attackers sometimes change the administrator's email or password to lock the owner out.
How to check: Try the "Lost your password" link. If the reset email never arrives, or arrives at an address you do not recognise, someone has changed the account details. Your host can help you get in through the database, and WordPress.org has a practical FAQ for hacked sites that covers regaining access.
Hidden Signs Your WordPress Site Has Been Hacked
Now for the quiet ones. Nobody sees these unless they go looking, and attackers are counting on that. Set aside ten minutes and check each one.
6. Administrator Accounts You Do Not Recognise
This is the most reliable hidden sign. An attacker who gets in will often create their own administrator account as a spare key. They tend to pick bland names like "wpadmin", "support" or "service". (While you are on that screen, if your own account is still called admin, here is how to change your WordPress admin username.)
How to check: Go to Users, then filter by Administrator. Every name on that list should be someone you can put a face to. If you find a stranger, do not delete it yet. Note the username, email and registration date, because that timestamp tells you when the break-in probably happened.
A good activity log makes this much easier. Stack Guard's activity log records sign-ins, failed attempts, lockouts, user and role changes, password resets and settings changes, with who did it and from which address. Free keeps core events for 7 days. Pro keeps them for 90 days with the full event catalogue, which is handy when you are working out what happened last month.
7. Files You Did Not Put There
Hacked sites almost always gain files. A strangely named PHP file in the uploads folder (which should hold images, not code). A .php file in a theme that has no business having one. A file that looks like a core WordPress file but sits in the wrong folder.
How to check: In your host's file manager or over SFTP, sort the wp-content/uploads folder by type and look for .php files. There should be almost none. Then sort your theme and plugin folders by "last modified" and ask whether you really changed those files recently.
There is a shortcut for the WordPress files themselves. Run a malware scan that compares each core file with the official copy for your version. Stack Guard's malware scanning does that in Free, along with signature checks for known back doors, web shells and injected code, and flags extra PHP files in the WordPress folders.
For your own plugin and theme folders, a baseline works better. File change monitoring (a Pro feature) records a fingerprint of every code file and tells you what was added, changed or removed since the last scan. An unexpected new PHP file in a theme folder is one of the clearest warning signs there is.
8. Strange Scheduled Tasks
WordPress runs a to-do list in the background called WP-Cron, a list of jobs set to run on a schedule. Malware loves it, because a job can quietly recreate a deleted backdoor every hour.
How to check: You need a way to see the list, either a cron viewer plugin or your host's WP-CLI. Look for jobs with random-looking names, or jobs that call functions you cannot match to any plugin you use. Not every odd name is malicious (some plugins have cryptic ones), so search the name before you decide.
9. A Sudden Drop in Search Traffic
You did not change anything and your traffic fell off a cliff. Or the opposite: search impressions spike for keywords you have never targeted. Both can mean hacked content is being indexed in place of yours.
How to check: In Search Console, open the Performance report and look at queries and pages over the last three months. Unfamiliar queries (especially pills, gambling or foreign-language terms) and unfamiliar page URLs are the giveaway.
10. Your Host Suspends the Site or Sends a Warning
An email from your host saying your account is using too many resources, sending bulk mail, or hosting malicious files. Some hosts suspend the site first and explain later.
How to check: Read the email carefully, because it often names the exact file they found. Keep that detail. Ask the support team for their scan report and for the log lines that triggered the alert. It is free information.
11. Outgoing Spam and Bounce Messages
You start getting bounce messages for emails you never sent. Customers say they received odd messages from your domain. Your mail goes to spam when it never did before.
How to check: Look at your mail provider's sent log, or your SMTP plugin's log if you use one. A pile of messages you did not send is a strong signal that something on the server is sending them, which is why a hacked site can wreck your email reputation even when the site looks fine.
12. Settings, Plugins or Code You Did Not Change
A plugin you never installed shows up in the list. Your site address was changed. A theme file contains a long, scrambled-looking string of text. The site is slow with no new traffic to explain it.
How to check: Compare your plugin list with what you actually installed. Check Settings, then General, to make sure the WordPress Address and Site Address are exactly what they should be. For scrambled code, you are looking for very long lines of random characters, often wrapped in functions such as eval or base64_decode. If you see that in a theme file, treat it as a finding, not a curiosity.
Pro tip: Check from the outside as well as the inside. Several of these signs, such as redirects and spam pages, only show up to strangers arriving from Google, never to a logged-in admin.
Quick Reference: Where to Look
Here is the whole list of signs your WordPress site has been hacked, with the fastest place to check each one.
| Sign | Where to check | Time it takes |
|---|---|---|
| Redirects | Private window on a phone, arriving from Google | 2 minutes |
| Spam pages | Google search for site:yourdomain.com | 3 minutes |
| Browser warning | Search Console, Security Issues | 2 minutes |
| New admin users | Users screen, filter by Administrator | 1 minute |
| Unknown files | Uploads folder, theme folders, malware scan | 5 to 10 minutes |
| Odd scheduled tasks | Cron viewer or WP-CLI | 5 minutes |
| Traffic drop | Search Console, Performance | 3 minutes |
| Host warning | Your inbox and host dashboard | 2 minutes |
| Outgoing spam | Mail logs and bounce messages | 5 minutes |
What to Do First If You Think Your Site Is Hacked
You found one of the signs your WordPress site has been hacked. Your stomach drops. Here is the order that saves you the most pain.
Do Not Panic and Do Not Delete Blindly
Hacked sites feel like a fire, but the cleanup rewards patience. The most common mistake is jumping in and deleting files that look suspicious. Some of them will be real. Others are decoys, and the real backdoor is somewhere else, ready to rebuild everything you removed.
Write It Down
Note what you saw, when you noticed it and what you changed recently. Did you install a plugin last week? Update a theme? Share a password? This becomes your incident notes, and it often points straight at how the attacker got in.
Take a Backup of the Site as It Is
Key takeaway: Back up first, clean second. A copy of the hacked site is your evidence and your safety net.
This sounds backwards (why back up a hacked site?), but it is the step people skip and regret. A copy of the current state gives you evidence, a reference for what changed, and a safety net if your cleanup breaks something. Label it clearly so nobody restores it by accident later.
Files and database both count. If you have an older clean backup, keep that too, separate from the new one. With Stack Guard, backups are manual in Free, verified before they count, and restore with one click that is staged and checked first. You can keep or roll back for 7 days after a restore, which is a comfortable cushion when you are cleaning up in a hurry.
Lock the Doors
Change the passwords for WordPress administrators, your host account, SFTP, and the database. Do it from a computer you trust, because sometimes the leak started with a password stolen from a laptop. Rotating your site's security keys signs everyone out, including a stranger who is still logged in. Our guide to WordPress salts shows how.
Then Clean Methodically
From here, the job is finding every changed file and every planted account, replacing core and plugin files with clean copies and getting rid of whatever let the attacker in. That is a longer story, and we walk through it step by step in the guide to recovering a hacked WordPress site. If you want a scan to point you at the right files first, the guide to scanning WordPress for malware shows how.
How to Catch the Next One Sooner
Most of the signs your WordPress site has been hacked are things you can check by hand, but nobody does that daily. A few habits turn a three-month infection into a three-day one.
- Scan on a schedule. A scan finds what you cannot see. Scheduled scans are part of Pro, and manual scans are free.
- Watch file changes. A baseline of your files makes new and edited files stand out within a day.
- Keep a log. If you know who changed what, the question "was that me?" answers itself.
- Turn on two-factor. A stolen password stops being enough, which closes the most common door.
- Keep everything updated. Old plugins are where known weaknesses live.
If you are still choosing a tool to do this, our guide to picking the best WordPress security plugin shows what to look for.
None of this makes a site unhackable, and anyone who says otherwise is selling something. But it moves you from finding out when a customer complains to finding out when it starts.