WordPress Hacked? 7 Signs to Check and What to Do First

Most business owners don’t find out their website was hacked from a security tool. They find out from a customer who was sent somewhere strange, or from Google showing pages they never made.

A hacked site doesn’t always look broken. The home page can look perfectly normal while hidden pages sell fake products or send visitors elsewhere. So here are seven signs worth checking, in the order we’d check them. None of them needs technical skill, and the first takes about ten seconds.

01The 7 signs

1. Google shows pages you never made

Open Google and search for site:yourdomain.com, using your own domain. Look through the results. Pages about casinos, medicines, Japanese or Chinese products, or anything your business doesn’t sell are a strong warning sign. So are titles and descriptions you didn’t write.

Attackers often hide these pages from you and show them only to search engines, which is why your site can look fine when you visit it.

2. An admin user nobody recognises

In WordPress, go to Users and filter by Administrator. Every account there should belong to someone you can name. An unfamiliar one, especially if it was added recently, needs explaining.

3. Visitors get redirected to other sites

Try your site on a phone, on mobile data, and by clicking through from a Google result rather than typing the address. Some malware only redirects certain visitors, such as people arriving from search on mobile, and leaves logged-in admins alone. That’s why a customer can see it when you can’t.

4. A security warning appears

Take these seriously, even if the site looks fine:

• A “Deceptive site ahead” page in the browser
• “This site may be hacked” under your listing in Google
• An email from your hosting company about malware or suspicious files
• A message under Security issues in Google Search Console

5. Files nobody can explain

This one usually needs your developer or host. Look for PHP files in the uploads folder, odd file names in the main website folder, and folders with random names. WordPress can’t tell you these are harmless just because they have old dates. As we explain below, attackers fake those dates.

6. The site suddenly slows down or keeps going down

Slowness has plenty of innocent causes. But if nothing changed on your side and your hosting account suddenly hits its limits, ask what’s using the resources. Hacked sites are often used to send spam or attack other sites, and that takes server power.

7. Your host says your account is sending spam

Emails from your domain landing in spam, bounce messages for emails you never sent, or a warning about sending limits can all point to a hijacked site.

02One sign doesn’t prove a hack

A slow site might just be a slow site. An admin you don’t recognise might be a former designer. Treat any one of these as a reason to look properly, not as proof. Two or more together deserve attention today.

03What to do first if you find something

1. Don’t start deleting files. It’s the natural reaction and it usually makes things harder. You lose the evidence of how they got in, and you can break the site, while the part that brings the malware back stays hidden.
2. Take a full backup of files and database. Yes, even of a hacked site. Store it away from the server, label it clearly as infected, and don’t restore from it later without checking it. It’s your record of what happened.
3. Tell whoever looks after your site or hosting. Ask them what changed recently and whether other sites share the same hosting account. One infected site can often reach the others.
4. Change passwords once the site is clean. Hosting, WordPress admins, database and FTP or SSH. Changing them while malware is still active may not help, because a hidden file can give an attacker a way back in without a password.
5. Find out how they got in. A cleanup without this step tends to end with the same problem a few weeks later.

Your PHP version is also worth checking now. PHP2Shell is being used in real attacks, and it doesn’t need a login to work.

04A clean-looking site can still rank for spam

Removing the malware doesn’t remove the damage in Google. In one recovery we handled, more than 100,000 spam addresses were still indexed weeks after the site was clean. The spam pages had already gone, but Google takes its time to drop them.

So after a cleanup, ask your developer to make sure those addresses return a “gone” response, not your home page, and request a review in Search Console if Google flagged the site.

05Need a second opinion?

If something on this list looks familiar, we can check your site and tell you plainly what we find. Get in touch or message us on WhatsApp. For day-to-day care, see our WordPress development service.