How to check if your WordPress site has been hacked: 6 signs

A hacked WordPress site almost never looks hacked. Whoever broke in doesn't want to break your website: they want to use it. To send visitors to a fake pharmacy, to host spam pages that rank on Google, to send email from your server. And they do everything they can so that you, who visit your own site every day from the office computer, notice nothing.

So the useful question isn't "does my site look fine?" but "does my site behave the same for everyone?" These are the six signs worth checking, from the most visible to the quietest, with the exact place to look for each one.

How to check if your WordPress site is hacked: the short answer

• +The six signs: redirects only other people see, pages on Google you never wrote, admin users nobody created, warnings from Google or your host, files you didn't upload and email you didn't send.
• +Many hacks hide from the owner: they redirect only on phones or only visitors coming from Google, and show you the normal site or a 404 error.
• +You can check in 15 minutes with free tools: a site: search on Google, the Security issues report in Search Console, the WordPress user list and Google's Safe Browsing site status.
• +91% of the new WordPress vulnerabilities Patchstack recorded in 2025 were in plugins and 9% in themes. Core had six. The way in is almost always an outdated plugin or a stolen password.
• +If you find a sign, don't just delete the odd file and move on: make a copy, change every password and look for the backdoor. A half-cleaned hack comes back.

1. Your site redirects somewhere else, but not when you visit

This is one of the most frequent signs and the most deceptive. A customer tells you they went to your site and ended up on a casino, a fake giveaway or a watch store. You check and everything looks fine. The customer didn't make a mistake: many hacks redirect only visitors coming from a search engine, only phones, or only someone's first visit, precisely so the owner doesn't see it. Google documents this as sneaky mobile redirects: the desktop version looks normal and phone users land on a different domain.

How to check: on your phone, using mobile data (not the office wifi) and in an incognito tab, search Google for your company name and tap your result. Repeat with two or three inner pages. If Google Analytics shows that time on page for mobile users collapsed overnight, that's a clue too.

2. Google shows pages on your site you never wrote

The spam hack creates hundreds or thousands of pages inside your domain, with autogenerated text and links to counterfeit goods or pharmacies. A case Google has documented in detail is the Japanese keyword hack: pages in randomly named folders, like yourdomain.com/ltjmnjp/341.html. Sometimes those pages show you a 404 error and show Google the spam. It's called cloaking, and it exists so you'll think nothing is wrong.

How to check: type site:yourdomain.com into Google and go through the results. Look for titles in another language, brand names you don't sell, words like "viagra", "casino" or "replica", and addresses with odd folders. If a suspicious page returns a 404 when you open it, paste it into the URL Inspection tool in Search Console: it shows what Google sees, not what you see. Keep in mind that site: is a sample, not the full list of indexed pages; the Pages report in Search Console is more complete.

3. There are admin users nobody created

The first thing an attacker does once inside is make sure they can come back. The simplest way is to create an administrator account, sometimes with a system-sounding name like "wpadmin", "support" or "backup". The official WordPress documentation lists the creation of unauthorized users among the clear indicators of a hack.

How to check: in the dashboard, go to Users and filter by the Administrator role. There should be only people you know, each with their own account. Check Search Console too, under Settings, Users and permissions: in the Japanese keyword hack, the attacker often adds themselves as a property owner to control your sitemap and geotargeting.

4. Google, the browser or your host is warning you

Sometimes the warning comes from outside, and it's worth knowing where it shows up before a customer sees it:

• +Search Console has a Security issues report that flags three types: hacked content, malware or unwanted software, and social engineering (pages that trick visitors into doing something dangerous).
• +Google Safe Browsing: if your site is flagged, Chrome and other browsers show a red warning screen before entering, and search results may say the site may be hacked. You can look up your domain's status in Google's Transparency Report. A clean result doesn't mean a clean site: Google itself warns that some spam hacks never get flagged.
• +Your host suspended the account, sent you a malware notice or says your site is using far more resources than usual.
• +Customers telling you their antivirus blocked your site.

Any of these warnings is serious, because it's no longer just your suspicion: it's the label other systems are putting on your website, and it affects everyone who tries to visit.

5. There are files you didn't upload, or files that changed on their own

This sign is more technical, but it's the one that confirms the others. What to look at:

• +Plugins or themes nobody installed, sometimes with generic names or deactivated so they go unnoticed.
• +.php files inside wp-content/uploads. That folder holds the images and documents you upload; a code file in there is a red flag.
• +Changes to the .htaccess file, a favorite place to plant redirects, and to index.php, header.php, footer.php or functions.php, because they affect every page at once.
• +Unreadable code inside files: long blocks of mixed letters and numbers next to functions like base64_decode or eval, which attackers use to hide what their code does.

If your host has WP-CLI, the wp core verify-checksums command compares WordPress core files against the originals published on WordPress.org and flags every one that doesn't match. It covers core only; plugins and themes have to be checked separately.

6. Your domain is sending email you didn't send

A hacked server is a server that can send spam. The consequences show up in email before they show up on the site: customers getting strange messages from your domain, bounce notices for email you never sent, or your own messages starting to land in spam. The WordPress documentation calls this one of the most serious consequences of a hack today: the server's IP address ends up on email blacklists, and if your email goes out through that same server, it drags it down too.

How to check: ask your host whether there was a spike in outgoing email from your account, and see whether your server's IP shows up on the most widely used blacklists. If your company email lives on the same hosting as your website, that's a good reason to separate them. One caveat: messages that only look like they come from your domain can be spoofing, with no hack involved. That's fixed with SPF, DKIM and DMARC on your DNS, not by cleaning the site.

The six signs in one table

What isn't a sign (on its own)

Not everything that goes wrong is a hack. A slow site is usually weak hosting, heavy images or too many plugins. A plugin that broke after an update is an incompatibility. And seeing hundreds of login attempts in your security log is normal: every public WordPress site gets automated attempts all the time. Trying doesn't mean they got in. What matters is whether any of those attempts ended in one of the six signs above.

You found one: the first steps

The official WordPress guide for hacked sites opens with advice that sounds obvious and isn't: stay calm and document. Order matters more than speed:

• +Write down what you saw, when, and what changed in the days before: a new plugin, an updated theme, access you gave someone. It's the foundation of any diagnosis.
• +Make a full copy of the files and the database as they are, even if they're infected. If the cleanup goes wrong, it's your safety net, and it's the evidence of how they got in.
• +Change every password, not just the dashboard one: hosting, FTP or SFTP, database and every administrator. Regenerate the secret keys in wp-config.php to end open sessions. And scan your computer: sometimes the password was stolen from there.
• +Delete users you don't recognize, in WordPress and in Search Console.
• +Tell your host. They can confirm whether it's a hack or an outage, and on shared hosting the problem may come from another account on the same server.

What not to do: delete the suspicious file you found and call it done. Attackers leave backdoors in several places, and the reinstall option inside the dashboard only replaces files that already existed, not the ones the attacker added. A full cleanup (replacing core, reviewing plugins and themes one by one, cleaning the database, closing the way they got in, changing the passwords again at the end and requesting a review from Google in Search Console) is a job in itself, and if your site sells or brings in leads, it's worth having someone who has done it before.

How they almost always get in

WordPress itself is fairly secure: six core vulnerabilities were reported in 2025, all low priority, according to Patchstack's annual report. The problem is everything around it. Of the 11,334 new vulnerabilities that report recorded, 91% were in plugins and 9% in themes, and 46% had no fix from the developer when they were made public. The usual ways in are three: plugins or themes that aren't updated (or that their author abandoned), premium themes and plugins downloaded "free" from pirate sites, which often come with malicious code already inside, and weak or reused passwords without two-factor authentication.

A WordPress site with 40 plugins doesn't have 40 features: it has 40 vendors your security depends on.

Prevention is boring and it works: only the plugins you need, everything updated, long unique passwords with two-factor for administrators, backups stored off the server that you have actually tried restoring, and Search Console set up so Google's warning reaches you before it reaches your customers.

At loco22 we rescue inherited WordPress sites: we audit them, clean them up and put them on a maintenance plan that covers updates, security and backups. If you've seen any of these signs on your site, or you simply don't know when someone last updated your plugins, message us on WhatsApp and we'll take a look.