7 signs your WordPress site has been hacked (and what to do first)

Most site owners don't find out they've been hacked from a security scanner. They find out from a customer who says "your website sent me to a casino", or from an email from their host. By then the infection has usually been there for days or weeks.

Hacks are rarely dramatic. Attackers want your site to keep working, because a working site keeps sending them traffic, ranking their spam and hosting their files. That's why the signs are often subtle. Here are the seven I see most often.

1. Visitors are redirected to spam or scam sites

This is the classic symptom. Someone visits your site and lands on a fake lottery, a pharmacy or an "Your device is infected" page.

Many redirects are conditional: they only fire for visitors coming from Google, only on mobile, or only once per visitor. Logged-in administrators are usually skipped. So if a customer reports a redirect and you can't reproduce it, don't dismiss it. Open your site in a private window on your phone, from a Google search result, and see what happens.

2. Google or your browser shows a warning

Two different warnings can appear:

• "This site may be hacked" under your listing in Google search results. Google found spam content or pages added by someone other than you.
• "Deceptive site ahead" or "Dangerous site", a full red screen in the browser. Your site is on Google's Safe Browsing list for phishing or malware.

Either one costs you traffic and trust immediately. Check the Security issues report in Google Search Console to see exactly what Google found.

3. Strange pages in Google results

Search Google for site:yourdomain.com. If you see pages in Japanese, pages selling pills or replica watches, or thousands of URLs you never created, your site is being used for SEO spam. This is known as the Japanese keyword hack or the pharma hack, and it often goes unnoticed for months because the spam pages never appear in your menus.

4. Admin users you didn't create

Go to Users in your dashboard and filter by Administrator. Attackers often create an admin account with a believable name like wpadmin, support or a slightly misspelled version of yours, so they can get back in after a cleanup. Any administrator you can't account for is a red flag.

5. Your host suspended the account

Hosting companies scan for malware and for accounts sending large volumes of spam email. If they find either, they'll warn you or take the site offline to protect their other customers. A suspension notice is a sign to act quickly, not just to ask support to switch the site back on.

6. Unexpected files or code

A few things that should never be there:

• PHP files inside wp-content/uploads, which should only hold images and documents
• Long, unreadable lines of code in functions.php, wp-config.php or index.php
• Code using functions like eval() together with base64_decode() to hide what it does
• Recently modified WordPress core files when you haven't updated WordPress

Legitimate plugins occasionally use these functions too, so treat them as clues rather than proof.

7. Slowdowns, pop-ups or a sudden drop in traffic

Malware uses your server's resources. A site that suddenly becomes slow, shows pop-ups you didn't add, or loses a large share of its search traffic overnight deserves a closer look.

What to do first

If you recognise one or more of these signs, resist the urge to start deleting things. Do this instead:

1. Take a full backup of the infected site, files and database. It sounds strange, but it preserves evidence of how the attacker got in and protects you if a cleanup goes wrong.
2. Change your passwords: hosting account, WordPress administrators, database and SFTP. Change them again once the site is clean.
3. Don't just reinstall a plugin and hope. Visible spam is usually only one part of the infection. Backdoors are designed to survive a quick fix.
4. Check Google Search Console for security issues, so you know what needs to be cleared afterwards.
5. Get the site properly cleaned and hardened. Removing the infection is half the job; closing the way in is the other half.

You can see how this worked on a real site in the Clean Experts case study, where a suspended, flagged website was cleaned and brought back online. If your site shows any of these signs, get in touch and I'll take a look.