Most hacked WordPress sites do not crash or show an obvious error. They keep loading and ranking — while quietly redirecting visitors to spam pages or hosting pages you never created. That is why knowing how to check if your WordPress site is hacked matters: the earlier you spot an infection, the smaller the cleanup and the damage to your traffic and reputation.
This guide covers the 9 warning signs, then a check-first workflow. No developer skills required.
9 Signs Your WordPress Site Is Hacked
Any single sign is worth investigating; two or more are strong evidence of a compromise.
1. Google shows a “This site may be hacked” or “Deceptive site ahead” warning
A red warning screen in Chrome, or a “This site may be hacked” note on your listing, means Google’s Safe Browsing flagged your site for malware, phishing, or spam. Most visitors will not click past it.
2. Visitors are redirected to spam pages — especially on mobile or from Google
One classic sign a WordPress site is hacked is the conditional redirect. Your own visit looks normal, but a customer lands on a pharmacy, casino, or “your device is infected” page. It often fires only for logged-out visitors, mobile users, or search traffic — so test in a private window, on a phone, and via a search click.
3. Spam or foreign-language pages appear in search results for your domain
Search Google for site:yourdomain.com. Pages you never wrote — pharmaceutical keywords or foreign-language text — mean attackers injected spam pages, often hidden from navigation, so the index is sometimes the only place they show up.
4. An unknown WordPress admin user appears in your dashboard
An unknown WordPress admin user is a classic backdoor sign. Check Users > All Users for Administrator accounts nobody recognizes — attackers use them to log back in after malware removal, so deleting the account alone is never the full fix.
5. PHP files show up in wp-content/uploads
The uploads folder should hold only media. PHP files there — or double extensions such as image.jpg.php — are a major red flag: often webshells letting an attacker run commands on your server.
6. Plugins or themes reappear after you delete them
If a deleted plugin comes back on its own, or an uninstalled theme keeps showing up, you face reinfection — malware restoring itself. You need a full cleanup, not another round of deleting files one by one.
7. Your host warns you, suspends the account, or blocks outgoing mail
Hosts monitor for malware, spam-sending, and resource abuse. A suspicious-activity email, suspension notice, or customers reporting your emails landing in spam can all point to an infection. Ask your host what triggered the alert.
8. Your site suddenly slows down or hits 100% CPU
A sharp, unexplained slowdown — pages timing out, server constantly at high CPU — can mean a crypto-mining or spam-sending script burning resources. Alone it does not prove a hack, but combined with another sign here, treat it as a compromise.
9. Traffic or rankings drop suddenly with no other explanation
If traffic or rankings fall off a cliff without a content change or redesign, check for a hack before assuming an SEO problem. Google may demote a flagged site, and spam redirects can quietly send your traffic elsewhere.
Signs vs. Verification: How to Confirm Each Warning Sign
A sign tells you something is wrong; verification tells you what it is.
| Warning sign | How to verify it |
|---|---|
| Google or browser warning | Google Safe Browsing site status tool |
| Spam redirects | Visit logged out, on mobile, via a search click |
| Spam pages in search results | Search site:yourdomain.com, review indexed pages |
| Unknown WordPress admin user | Users > All Users in wp-admin |
| PHP files in wp-content/uploads | File manager or FTP: check uploads folder |
| Plugins reappearing after deletion | Delete once; a return within 24 hours means reinfection |
| Host warning or suspension | Read the host’s notice |
| Sudden slowness or 100% CPU | Host resource graphs |
| Sudden traffic drop | Search Console clicks vs. warning date |
How to Check If Your WordPress Site Is Hacked: The Confirm-First Workflow
Do not delete files at random — that can break your site and destroy evidence.
Step 1: Run a Google Safe Browsing check
Enter your domain in Google’s Safe Browsing site status tool: it reports within seconds whether Google considers the site dangerous. Then check Search Console’s Security Issues report for infected URLs.
Step 2: Run a WordPress malware scan
Install a reputable security plugin such as Wordfence and run a full scan. A WordPress malware scan compares core, theme, and plugin files against known-good versions and flags suspicious files. Treat the report as a map of the infection, not the cleanup.
Step 3: Check users, files, and recent changes by hand
- Review Users > All Users for unrecognized administrators; note them before removal.
- Check uploads for PHP files, and scan recently modified theme files — especially
functions.php— for code you did not write. - Check recently installed plugins and scheduled tasks for anything unfamiliar.
Step 4: Back up FIRST — before you delete anything
Before cleaning, back up the infected site in full, even though it contains malware. If cleanup breaks your theme or deletes content, you can restore and start over. Label it as infected so it is never restored by mistake.
Step 5: Contain, then clean from known-good sources
Change every connected password: WordPress admins, hosting panel, FTP/SFTP, database, and email accounts used for resets. Use maintenance mode if visitors are being redirected or exposed to phishing content. For a serious infection, rebuild: fresh core, plugin, and theme files from official sources, a new wp-config.php, and content from a pre-hack backup only. For lighter infections, a security plugin can repair changed core files — then verify with a second scan. If payment or personal data may be involved, get specialist help immediately.
For a detailed recovery walkthrough, see WPBeginner’s guide to fixing a hacked WordPress site.
How to Harden WordPress After a Hack
Cleaning without closing the entry point guarantees a repeat:
- Update core, themes, and plugins, and delete anything unused — outdated plugins are a top entry point.
- Turn on two-factor authentication for all admins and use strong, unique passwords.
- Disable the built-in theme and plugin file editor by adding
define('DISALLOW_FILE_EDIT', true);towp-config.php. - Install plugins and themes only from trusted sources; avoid nulled versions, which often ship with malware.
- Set a routine: weekly updates, user reviews, and a scan; monthly backup-restore tests.
- Keep the site fast after recovery — see our guide on how to speed up your WordPress site.
If cleanup feels beyond your comfort level, get help: a bad cleanup can leave a backdoor in place while looking clean. Our team can assess a compromised site — see our services or contact us.
Frequently Asked Questions
Can a WordPress site be hacked without the owner noticing?
Yes. Many infections stay invisible: redirects firing only for logged-out or mobile visitors, spam pages hidden from navigation, and background scripts sending spam or mining cryptocurrency. Regular checks matter even when all looks fine.
How do I do a WordPress malware scan for free?
Install a free security plugin such as Wordfence from the official plugin directory and run a full scan. You can also use Google’s free Safe Browsing tool and Search Console’s report.
What is a WordPress redirect spam fix?
A WordPress redirect spam fix means removing the code sending visitors to spam pages, then closing the entry point so it does not return. The code is often injected into functions.php or .htaccess, or hidden in a malicious plugin. Removing it alone is not enough: change all passwords, remove unknown admins, update everything, and rescan.
How long does it take Google to remove a “This site may be hacked” warning?
Once the site is fully clean, request a review in Search Console’s Security Issues report, explaining what you found, removed, and changed. Requesting review early can slow the next review — so verify with a fresh scan first.
Conclusion: Check First, Then Clean — In That Order
Knowing how to check if your WordPress site is hacked is a skill every site owner needs: most infections announce themselves with small clues long before visible damage. Watch for the 9 warning signs, confirm them with a Safe Browsing check and a malware scan, back up first, and harden the site once it is clean.
