How to check if your WordPress site is hacked, and what to do first

To check if your WordPress site is hacked, start by assuming the hack is trying to hide, because a hacked site often looks fine from where you sit. Most modern WordPress malware doesn’t deface your home page. It quietly adds spam pages for search engines, redirects some visitors to scam sites, or creates a hidden admin account to come back later. You can look straight at your site and see nothing wrong. Here are the ten signs I check first, the free tools that confirm them, and what to do in the first hour once you’re sure.

Already sure it’s hacked, and your site earns money? Don’t wait for the checklist. A hand cleanup from $99, with the way in closed, is on my WordPress malware removal page, and a broken site without malware goes to WordPress repair.

Why can a hacked site look completely normal?

Attackers make money from your site’s reputation and traffic, not from breaking it. A site that keeps working keeps its rankings, so the hack stays useful for longer. That’s why so many hacks only show themselves to:

• Visitors arriving from Google, not those typing your address
• Mobile visitors, not desktop
• First-time visitors, tracked by a cookie
• Search engine crawlers, who see spam pages you never see

So the checks below deliberately look at the site the way strangers and search engines do.

1. Are there spam pages under my domain in Google?

Search Google for site:yourdomain.com and scroll through the results. Pages you never created, often about pharmacy products, gambling, replica goods or in a language you don’t use, are the clearest sign of a hack. Also try site:yourdomain.com with words like “casino” or “viagra” to surface hidden pages faster.

2. Is there a warning in search results or Search Console?

Ads stopped too? That can be a Compromised Site disapproval in Google Ads.

If Google detects a problem it may label your result “This site may be hacked” or show a red warning page in Chrome. Open Google Search Console and check Security issues and Manual actions. Both should say no issues detected. Google’s security and hacked-site help explains each message.

3. Does my site redirect only sometimes?

Open your site on your phone, on mobile data rather than Wi-Fi, in a private window. Then search for your business on Google and click through to your site. If you land somewhere else even once, treat it as a hack, even if it never happens on your laptop.

4. Are there admin users I didn’t create?

In the WordPress dashboard, go to Users and filter by Administrator. Every name should be someone you know. Attackers often add an account with a plausible name such as “support”, “wpadmin” or a copy of a real user’s name with one letter changed. Check the email addresses too.

5. Are there PHP files in my uploads folder?

The wp-content/uploads folder should only hold images, PDFs and similar files. Using your host’s file manager, search inside it for files ending in .php. There’s almost never a legitimate reason for one to be there, and it’s a classic place to hide a back door.

6. Do my core files match WordPress.org?

WordPress publishes checksums for every file. If you or your developer can use WP-CLI, run wp core verify-checksums (command reference) to list any core file that has been changed, and wp plugin verify-checksums --all to do the same for plugins from the WordPress directory. Modified core files on a site nobody has edited are a strong sign of a hack.

7. Are there strange scheduled tasks?

Malware often reinstalls itself using WordPress’s scheduled tasks (cron). A plugin such as WP Crontrol, or wp cron event list in WP-CLI, shows them. Look for tasks with random-looking names or tasks that belong to no plugin you have installed.

8. Has my host or email provider warned me?

Hosts scan for malware and may suspend a site or email you about “malicious files”. Email providers may start rejecting messages from your domain because a hacked site has been sending spam. Don’t dismiss these as false alarms without checking.

9. Did my traffic or speed change suddenly?

A sharp drop in Google traffic can follow a hack once Google notices spam on the site. A sudden spike in server load, bandwidth or outgoing email can mean the site is being used to attack others or send spam. Check your hosting resource graphs alongside your analytics.

10. Has anything changed that I didn’t change?

Unknown plugins in the plugin list, a changed site title or tagline, new pages in drafts, links in your footer you never added, or ads appearing on pages. Any change nobody on your team made needs an explanation.

I found a sign. What do I do first?

Stay calm and work through these in order, because deleting things too early can destroy the evidence you need:

1. Don’t delete anything yet. Take a full copy of the files and database as they are now. You’ll need it to work out how the attacker got in.
2. Change every password: all WordPress administrators, the hosting account, the database, FTP or SFTP, and any connected email accounts. Turn on two-factor login.
3. Put the site into maintenance mode if visitors are being redirected or warned, so customers aren’t harmed while you clean.
4. Clean, then close the door. Replace core files with clean copies, check plugins and uploads, remove unknown users, and update or remove the plugin that let them in. My step-by-step guide on how to fix a hacked WordPress site covers each step.

A real example: the scanner said clean, the site was not

A SaaS site had its Google Ads disapproved for “Compromised Site”, and an appeal after a scanner cleanup had failed. The way in was a pirated copy of a paid caching plugin. A second pirated plugin, the page builder’s Pro add-on, held hidden code that loaded content from an outside server over plain HTTP, and the scanner missed it. WordPress core and every free plugin matched the official checksums, so only a manual check of uploads, the database, scheduled tasks and server keys found the rest. The lesson for your own check: a clean scanner result does not clear a site that runs pirated plugins. See the Google Ads Compromised Site flag for how that case ended.

How do attackers usually get in?

Patchstack’s 2026 report found that 91% of new WordPress vulnerabilities in 2025 were in plugins. In practice, most hacked sites I see share three things: plugins left months behind on updates, a premium plugin or theme downloaded from an unofficial “nulled” site, and an administrator password used somewhere else. Fix those three and you remove most of the risk.

Is there a five-minute check I can run every month?

You don’t need to be a security expert to catch problems early. Once a month:

• Run site:yourdomain.com in Google and glance through the results
• Check Search Console’s Security issues report
• Review the list of administrator users
• Open the site on your phone from a Google search
• Confirm your last backup ran and is stored off the server

That routine catches most hacks within weeks rather than months. If you’d rather not do it yourself, it’s part of every WordPress care plan I run, along with tested updates that close the holes before they’re used.

When should I call for help?

Prices vary a lot, so see what WordPress malware removal costs before you decide.

Get help from a WordPress malware removal specialist if you find PHP files you can’t explain, if the infection comes back after cleaning, if the site takes payments or stores customer data, or if Google has already flagged it. Those cases need a careful clean and a written record of what was found. Send me the address and I’ll tell you what I see before you spend anything.

Written by Sakib Islam, a WordPress developer who builds and looks after sites for businesses and agencies. About my work