Skip to content

Is your WordPress site hacked? 9 signs and what to do right now.

Most site owners find out last. A customer mentions a strange redirect, or Google suddenly shows a red warning. Here's how to check your site in ten minutes, and what to do if it's infected.

BY LOGICAL CUBE7 MIN READ

9 signs your WordPress site is hacked

Not every hack is obvious. Many are built to stay hidden, so they can keep sending spam or stealing data for months. Watch for these signs:

  1. Redirects to gambling, pharma or adult sites, often only on mobile or only for visitors from Google.
  2. A Google warning like "This site may be hacked" or a red "Deceptive site ahead" screen.
  3. Spam pages in search results. Search site:yourdomain.com and look for pages in Japanese, or about pills and casinos.
  4. Admin users you don't recognise under Users in WordPress.
  5. Your host suspended your account or emailed about malware or sending spam.
  6. The site is suddenly slow, or your server usage spikes without more visitors.
  7. Pop-ups or ads you never added.
  8. Files you don't recognise, often PHP files in /wp-content/uploads/.
  9. Your emails land in spam because your domain got blacklisted.

How to check your site in 10 minutes

  • Google Search Console: open Security & Manual Actions → Security issues. Google tells you here if it found malware.
  • A free external scan such as Sucuri SiteCheck shows known malware and blacklist status.
  • A site: search on Google reveals injected spam pages you can't see in WordPress.
  • Check your users and remove nothing yet. Just note anything strange.
  • Visit your site on a phone using mobile data, from a Google search. Some hacks only redirect those visitors.

What to do right now

  1. Don't delete anything. The traces show how they got in. Without them, the same hole stays open.
  2. Change all passwords from a device you trust: hosting, WordPress admins, FTP/SFTP and the database.
  3. Take a full backup of files and database, even if it's infected. It's your safety net.
  4. Write down what you saw and when, including any emails from Google or your host.
  5. Get it cleaned properly. Restoring an old backup often brings the backdoor back with it.

Why WordPress sites get hacked

WordPress itself is secure. The problems are almost always around it:

  • Outdated plugins and themes, by far the most common way in.
  • Weak or reused passwords without two-factor authentication.
  • Nulled (pirated) themes and plugins that ship with malware built in.
  • Cheap shared hosting where one infected site can affect its neighbours.
  • Abandoned plugins that no one updates anymore.

How to prevent it next time

  • Update WordPress, plugins and themes every week, and remove what you don't use.
  • Turn on two-factor authentication for every admin.
  • Use a firewall and limit login attempts.
  • Keep daily off-site backups and test that they actually restore.
  • Or hand it all to a maintenance plan, so it's someone's job.

Frequently asked questions

Can I clean a hacked WordPress site myself?

You can remove what you see, but most hacks leave hidden backdoors. If you miss one, the site gets reinfected within days. A proper cleanup checks every file and the database.

How long until Google removes the warning?

After the site is clean, you request a review in Google Search Console. It usually takes one to three days.

Will restoring a backup fix it?

Only if the backup is from before the hack and you also close the hole they came through. Otherwise they simply come back in.

Hacked right now? Call or WhatsApp us and we start the same day: clean, secure and off the blacklists.
Get emergency help →