Signs your WordPress site has been hacked

Hacked sites do not always look hacked. Attackers often want to stay hidden so they can keep using your server.

Warning signs

1. Redirects. Visitors, especially from Google or on mobile, land on unrelated sites.
2. Spam in search results. Your domain shows pages about pills, casinos or fake products you never wrote.
3. Unknown admin users. New accounts in Users that nobody on your team created.
4. Browser or search warnings. “Deceptive site ahead” or “This site may be hacked”.
5. Sudden slowness or high server load. Malware often runs scripts in the background.
6. Changed files. Recently modified PHP files in uploads or core folders.
7. Your host suspends the account or sends an abuse notice.

First hour: what to do

• Take a full backup of the current state before changing anything, so evidence is not lost.
• Change passwords for WordPress, hosting, database and FTP/SSH, from a clean device.
• Put the site in maintenance mode if visitors are being harmed.
• Contact someone who does cleanups regularly.

What not to do

Do not only reinstall WordPress or delete the obvious file. Backdoors are usually hidden in several places, and without finding how the attacker got in, the site is likely to be infected again.