People often imagine a hacked website as something dramatic: a defaced homepage, a ransom note, flashing messages. That does happen, but it’s rare. Most attackers want the opposite. They want your site to keep working normally so they can use it quietly for as long as possible, to send spam, host phishing pages, inject links for their own SEO or steal data from your visitors.
That’s why so many hacks go unnoticed for weeks or months. In the investigations I’ve done, the owner usually found out from someone else: a customer complaining about a strange redirect, Google showing a warning, or the hosting company suspending the account.
The earlier you spot a compromise, the less damage it does. Here are the warning signs I look for, and how you can check each one yourself.
Signs you might notice as a visitor
1. Redirects to other websites
Visitors land on your site and get sent to a gambling, pharmacy or scam page. The tricky part is that many redirect infections are selective. They only redirect visitors coming from search engines, or only on mobile, or only the first visit from each IP address. Logged-in administrators often never see it.
How to check: Search for your site on Google from your phone using mobile data, then click through to your site from the results. Try it in a private browsing window too. If someone reports a redirect you can’t reproduce, take them seriously.
2. Spammy pages in search results
Search Google for site:yourdomain.com and look through the results. Pages you never created, especially with Japanese text, pharmaceutical terms, replica goods or casino keywords, are a classic sign of SEO spam injection.
How to check: Run the site: search and scroll through several pages of results. Also try site:yourdomain.com with words like casino, viagra or loan.
3. Browser or search engine warnings
Chrome showing a red “Dangerous site” warning, or Google listing your site with “This site may be hacked”, means Google’s systems have detected malicious content.
How to check: Look up your site in Google’s Safe Browsing site status tool, and check the Security Issues report in Google Search Console.
4. Unexpected pop-ups or ads
If your site shows ads or pop-ups you didn’t add, malicious JavaScript may have been injected into your theme, plugins or database.
5. Strange characters or links in your content
Hidden links in post content, footers or widgets, often invisible to visitors but present in the page source, are used to boost the attacker’s websites in search.
How to check: View the page source with Ctrl+U or Cmd+Option+U and search for links to domains you don’t recognise.
Signs in your dashboard and accounts
6. Administrator accounts you don’t recognise
Attackers often create a hidden admin account so they can get back in later. Some infections even hide that account from the Users screen.
How to check: Look at Users in the dashboard, filtered by Administrator. Then check with WP-CLI or directly in the database, because what the dashboard shows can be manipulated:
7. You can’t log in
Your password suddenly stops working, or your account has been demoted. This can mean an attacker has changed credentials to lock you out.
8. Plugins or themes you didn’t install
Look for plugins with generic names, no description, or names that mimic real plugins with small spelling changes. Some malicious plugins hide themselves from the plugins list entirely.
How to check: Compare the plugins list in the dashboard with the actual folders in wp-content/plugins.
9. Unexpected changes to settings
Changed site URL, new admin email address, different default role for new users (set to Administrator), or open user registration you never enabled.
How to check: Review Settings, then General. If “Anyone can register” is ticked and the new user default role is Administrator, treat it as a serious red flag.
Signs on the server
10. Unfamiliar or recently modified files
Malware usually lives in PHP files: new files with random names, files in the uploads folder or modifications to core files.
How to check: From the site root, list recently modified PHP files and look for PHP in uploads:
| <code>find . -name "*.php" -mtime -30 -printf "%TY-%Tm-%Td %p\n" | sort |
|---|
Then compare core and plugin files against official checksums:
11. Obfuscated code
Code that’s deliberately unreadable is rarely legitimate in a WordPress site. Long base64 strings, eval statements and functions like gzinflate or str_rot13 chained together are common in backdoors.
| <code>grep -rnE "eval\( | base64_decode\( | gzinflate\( | str_rot13\(" –include=*.php wp-content | head -50</code> |
|---|
Some plugins use these functions for legitimate reasons, so investigate each match rather than deleting blindly.
12. Changes to .htaccess or server config
Attackers frequently add redirect rules to .htaccess files, sometimes in subfolders. Check every .htaccess file on the site, not just the main one.
13. Unusual traffic or resource usage
A sudden spike in CPU usage, bandwidth or outgoing email can mean your server is being used to send spam, mine cryptocurrency or attack other sites. Hosting companies often notice before owners do.
14. Suspicious scheduled tasks
Malware can re-create itself using WordPress cron events or system cron jobs, which is why some infections keep coming back after cleanup.
15. Emails bouncing or flagged as spam
If your domain suddenly appears on email blocklists, or your legitimate emails start landing in spam, your server may be sending spam on someone else’s behalf.
Check Search Console carefully
Google Search Console is one of the best early warning systems available. Beyond the Security Issues report, look at:
- Users and permissions. Attackers sometimes verify themselves as owners of your property, so they can submit their spam pages to Google. Remove any owner you don’t recognise.
- Sitemaps. Look for sitemaps you didn’t submit.
- Performance. A sudden surge of impressions for unrelated keywords, like luxury brands or drugs, suggests spam pages are being indexed.
What to do if you find signs
If several of these checks point to a compromise, resist the urge to start deleting files immediately. The order matters.
- Take a backup of the current state, files and database, even though it’s infected. It contains evidence of how the attacker got in.
- Change critical passwords from a clean device: hosting, WordPress admins, database, SFTP and email.
- Find the entry point. Look at the earliest malicious files and match their timestamps against access logs.
- Clean thoroughly. Replace core and plugin files with fresh copies, remove backdoors, check the database for injected content and remove rogue users.
- Regenerate security keys in wp-config.php to log out all sessions.
- Fix the vulnerability that allowed the attack, usually an outdated plugin or weak password.
- Request a review in Search Console once you’re confident the site is clean.
- Set up monitoring so you catch anything that comes back.
If the site is business critical, a store or handles personal data, consider bringing in someone experienced in WordPress incident response. Incomplete cleanups are the main reason sites get reinfected.
Prevention beats detection
The best way to avoid all of this is to make your site a harder target: keep everything updated, remove unused plugins, use strong passwords with two-factor authentication, block PHP execution in uploads and keep off-site backups. Add file integrity monitoring and uptime alerts, and you’ll hear about problems in hours instead of months.
A five-minute monthly health check
You don’t need to run every check above every week. A short monthly routine catches most problems early. Search site:yourdomain.com and skim the results. Open the Users screen and confirm every administrator. Look at Search Console’s Security Issues report and the list of verified owners. Run the core and plugin checksum commands. Finally, visit your homepage from your phone on mobile data, arriving through a Google search. It takes five minutes, and it’s often enough to spot an infection weeks before a customer or your host does.
Frequently asked questions
Can a site be hacked even if it looks normal?
Yes, and that’s the most common situation. Many infections are designed to stay invisible to the site owner and only affect search engines or specific visitors.
Will a security plugin detect every hack?
No. Security scanners catch many known infections, but attackers constantly change their code. A plugin running on an already compromised site may also be tampered with. Manual checks and server-level scanning add important layers.
My host says my site was sending spam. What does that mean?
Usually that a malicious script on your site is being used to send email. It’s a sign of compromise, not just a configuration issue. Treat it as a hack and investigate fully.
How did the attacker get in?
Most often through an outdated plugin or theme with a known vulnerability, a weak or reused password, a compromised hosting account or nulled software. Finding the specific cause is important, otherwise the attacker can return the same way.
Final thoughts
A hacked WordPress site rarely shouts. It whispers through odd search results, a strange admin account or a customer’s complaint you can’t reproduce. Learn these warning signs, check them every so often and set up monitoring to do the watching for you. When something does look wrong, act methodically: preserve evidence, clean completely, close the door the attacker used and keep watching afterwards.
