WordPress runs a large share of the web, which makes it a favourite target. Most attacks are automated: bots look for outdated plugins and weak passwords, and break in without caring whose site it is. The tricky part is that a hacked site often looks perfectly normal to you.
Signs your WordPress site may be hacked
Visible signs
- Your host or the browser shows a warning, such as "Deceptive site ahead" or "This site may be hacked".
- Visitors are redirected to another site, often only on mobile or only when they arrive from Google.
- New pages, posts or links you never created.
- Your site has changed its look, or a "hacked by" message is on the homepage.
Signs in search
- Google search results for your site show unexpected text, often in Japanese, or products like pills and watches. See the Japanese keyword hack and the pharma hack explained.
- A sudden drop in traffic, or a message in Google Search Console about security issues.
Signs inside WordPress
- Administrator users you do not recognise. Check Users, then filter by Administrator.
- Plugins you did not install, or plugins that disappeared from the list in the dashboard but still exist on the server.
- Your host reports unusual CPU use, or your email is being flagged as spam, because the site is sending junk mail.
- You cannot log in, and the password reset does not work.
Where to look for proof
- Check the site as a stranger would. Open it in a private window, from your phone on mobile data, and by clicking through from a Google search result. Some malware hides from logged-in admins and from direct visits.
- Look at the page source. Search it for unfamiliar scripts, long unreadable strings, and links to unknown sites. Links hidden with
display:noneor placed far off screen are a common trick. - Check the files. Compare WordPress core files with a clean copy. Look for PHP files in
wp-content/uploads, which should only contain media. Sort files by modification date and look for recent changes you did not make. - Check the database. Spam is often injected into posts and options. A search in the posts table for suspicious words,
<scriptor<iframecan reveal it.
Quick checks you can run now
Our free website hack check looks from the outside, as any visitor would. It checks malware and phishing lists and looks for injected scripts, hidden links, spam keywords and cloaking. It cannot see inside your server, so a clean result does not prove the site is safe, but a bad one is a clear warning.
What to do if you find something
Do not start deleting. Take a backup of the infected site, change all passwords, restore a clean backup if you have one, and update everything. My website was hacked: what to do first walks through the steps in order.
How to catch it earlier next time
The expensive part of a hack is the time between the infection and the day you notice. Cutting that time is what monitoring is for. ServerMonitor regularly checks your pages for injected scripts, hidden links and spam, looks at malware and phishing lists, and for WordPress sites also checks for outdated versions, known vulnerable plugins and exposed files such as debug logs. You get an alert when something changes, which is often days or weeks before a human would see it.
Prevention matters just as much: keep core, themes and plugins updated, delete what you do not use, use strong unique passwords with two-factor authentication, and keep backups somewhere other than the same server.