Something feels wrong with your WordPress site. Maybe a customer saw a warning, Google shows strange search results or your host sent an email.
Here is how to confirm whether your site is hacked, and what to do if it is.
Key takeaways
- Many hacks hide from logged-in admins and only show to visitors or search engines.
- Check from a logged-out phone, Google search results and VirusTotal.
- Unknown admin users and recently modified files are the clearest evidence.
- Clean up first, then request delisting from every vendor that flagged you.
10 signs your WordPress site is hacked
Any of these is a strong signal:
- Browsers show a red warning page.
- Antivirus products block your site.
- Google search results show spam titles, foreign text or pharmacy keywords.
- Mobile visitors are redirected to other sites.
- Admin users you did not create appear under Users.
- Files in wp-content or the root changed without updates.
- Your host suspended the account or reported malware.
- Emails from your domain bounce or land in spam.
- The site is suddenly slow or uses unusual resources.
- Search Console reports Security Issues.
Quick checks you can do now
Log out and open your site from a phone on mobile data. Search Google for site:yourdomain.com and look for pages you did not create. Scan the domain with VirusTotal and Sucuri SiteCheck, and check Search Console's Security Issues report.
Logged-in admins are often deliberately excluded from malicious redirects. Always test while logged out.
Deeper checks in WordPress
In the dashboard, review Users for unknown administrators and Plugins for anything you did not install. On the server, sort files by modification date and look for PHP files in wp-content/uploads. Compare core files with a fresh WordPress download, and search the database for script tags pointing to unknown domains.
How to fix a hacked WordPress site
Back up, replace core files, reinstall plugins and themes from official sources, remove unknown users and injected database content, update everything, change all passwords and rotate the security keys in wp-config.php. Our CMS virus removal guide explains each step, and WordPress malware keeps coming back covers hidden backdoors.
Getting off the blacklists
Once external scans show the site is clean, request a review in Search Console, then contact every other vendor still flagging you. Follow our blacklist removal checklist. If you also see "Not Secure" in the address bar, that is a separate SSL issue; see why WordPress says Not Secure.
Frequently asked questions
Can a WordPress site be hacked without visible signs?
Yes. Many hacks only show spam to search engines or redirect first-time mobile visitors.
Will deleting the plugin that was hacked fix it?
Rarely. Attackers usually leave backdoors elsewhere, so a full clean-up is needed.
Is my hosting provider responsible?
Usually not for CMS-level hacks, but many hosts offer scanning and can help identify the entry point.
How do I prevent it from happening again?
Keep everything updated, remove unused plugins, use strong unique passwords with two-factor authentication and monitor your domain.