The clearest signs your WordPress site is hacked are admin accounts you did not create, visitors redirected to spam or adult sites, a Google “this site may be hacked” warning, and content or files you never added. If you see these, confirm the hack with an external scan, then contain the site, clean it, and close the entry point before going live again.

Most WordPress hacks are not personal. They are automated and opportunistic, run by bots that scan the web for a weak password or an outdated plugin and exploit whatever they find. We clean these across client sites, and the two reactions that cause the most damage are opposite extremes: panicking and deleting files at random, or ignoring the warning because the site still loads. The right first move is neither. It is to confirm what you are actually dealing with, then work through a calm, ordered response. This guide covers both halves: how to tell, and what to do.

What are the most common signs your WordPress site is hacked?

The signs of a hacked WordPress site range from near-proof to easy-to-misread, and treating them all as equal is how people either panic over nothing or miss a real breach. It helps to group the symptoms by how conclusive each one is. Some almost always mean a compromise, some warrant a closer look, and some are usually something else entirely. The three groups below sort them so you know how seriously to take what you are seeing.

Signs that almost certainly mean a hack

These signs rarely have an innocent explanation. If you see any of them, treat the site as compromised and move to the confirmation step:

  • Admin user accounts you did not create. Creating a hidden admin is one of the first things an attacker does, because it is a reliable way back in.
  • Your site redirects visitors to spam, adult, or unrelated third-party sites.
  • Google shows a “Deceptive site ahead” or “This site may be hacked” warning in search results or the browser.
  • Your homepage or pages have been defaced, or content appears that you never published.
  • You are locked out of your own dashboard despite using the correct password.
  • Your hosting provider suspended your account or emailed you about malicious activity.

Signs worth investigating

These often point to a hack but can occasionally have another cause, so verify before you conclude:

  • Unfamiliar .php files in wp-content/uploads, which should not normally contain executable PHP.
  • SEO spam: pages, posts, or pharmaceutical keywords on hidden pages you did not create, built to manipulate search engines.
  • Your domain sending spam email, or visitors reporting spam that appears to come from you.
  • New plugins you did not install, or security plugins that suddenly stopped working.
  • A sudden, unexplained drop in traffic in your analytics, which can signal malware redirecting visitors or a search blacklisting.

Signs that are often a false alarm

These get blamed on hackers constantly, and most of the time the cause is mundane:

  • A slow site on its own. Heavy traffic, a bloated plugin, or weak hosting cause this far more often than malware.
  • A single error message after an update, which usually means a plugin or theme conflict.
  • Layout glitches right after you changed a theme or plugin.

A slow or misbehaving site is worth checking, but on its own it is weak evidence. Pair it with something from the first group before you assume the worst.

How do you confirm your WordPress site is actually hacked?

Confirm the hack with outside tools before you touch a single file, because acting on a guess wastes time and can make a fixable problem worse. Confirmation takes a few minutes and removes all doubt about whether you have a real compromise or a false alarm. Run these checks in order.

Start with an external remote scanner. A free tool like Sucuri SiteCheck browses your public pages from the outside and flags known malware, injected scripts, and blacklist status without you installing anything. It is the fastest way to get an unambiguous first answer. Then check Google Safe Browsing and, if you have it connected, the Security Issues report in Google Search Console, which tells you whether Google has detected a compromise and what type.

Next, look inside. Review your admin users for any account you do not recognize. Connect over SFTP and check whether core files were modified recently, since a fresh modification date on a core file you never edited is a strong signal. Scan file contents for the code patterns attackers commonly hide: base64_decode, eval, gzinflate, and unusual include statements, especially inside wp-config.php, .htaccess, or files in the uploads folder. Finding obfuscated code where none belongs confirms what the external scan suggested.

If the external scan is clean, Google reports no issues, your admin users are all legitimate, and no core files show unexpected changes, you are probably looking at a caching, hosting, or plugin problem rather than a hack. That is a genuinely useful outcome, because it stops you from tearing apart a site that was never breached.

What should you do first if your site is hacked?

Once the hack is confirmed, contain it before you clean it. The instinct to immediately restore a backup or start deleting files is the wrong first move, because you can lose evidence, reintroduce the infection, or lock yourself out mid-cleanup. Work the containment sequence in this order.

First, put the site into maintenance mode so visitors do not see a defaced page or get exposed to malware. If you can reach the dashboard, a maintenance plugin does this in seconds. If you cannot, add a rule to the top of your .htaccess file over FTP that redirects all visitors except your own IP address away from the site.

Second, force everyone out and lock the doors. Reset all passwords, starting with administrators, and reset your hosting and database passwords too. Then rotate the secret keys in wp-config.php using the official WordPress key generator, which invalidates every active session and kicks out any attacker who is still logged in. Changing passwords alone does not end an existing session, so this step matters.

Third, contact your host and open a high-priority ticket. Tell them the site is compromised and ask for any scan logs or information they have about suspicious files, since they can often see server-level activity you cannot. A good host is one of your most useful allies in a cleanup. Only once the site is contained do you move to actually removing the infection.

How do you clean a hacked WordPress site?

Cleaning means removing every trace of the infection, then confirming it is gone, without reintroducing it. Before you change anything, make a backup of the current infected state. That sounds odd, but it preserves evidence and gives you a fallback if cleaning breaks something, as long as you never restore that copy to a live site.

Run a deep scan with a security plugin such as Wordfence, Sucuri, or MalCare, which inspects files and the database more thoroughly than an external scanner. Remove or replace the malicious files it finds. Replace WordPress core with fresh copies from wordpress.org, review wp-config.php and .htaccess for injected code, and check the uploads folder for the executable PHP that should not be there. If the database itself is heavily infected and you cannot tell legitimate content from injected content, restoring from a known-clean backup made before the hack is often the safer path.

Here is the honest tradeoff on doing this yourself. A technically confident owner can clean a straightforward infection with the steps above, and it saves money. But hacks hide backdoors, and missing one means the attacker walks back in days later. If you are not fully sure you have found everything, professional removal is worth the cost precisely because the failure mode of a DIY clean is silent and expensive. After cleaning, re-scan until you get a clean result, then ask your host to rescan and, if Google flagged you, request a review in Search Console.

How do you keep it from happening again?

Preventing reinfection means closing the entry point the attacker used, not just removing what they left behind. Cleaning a site without hardening it is like mopping the floor while the roof still leaks. The single most common way sites get reinfected is that the original vulnerability was never fixed, so this step is not optional.

Update WordPress core, every plugin, and every theme to the latest version immediately, since outdated software is the most common attack vector. Delete any plugin or theme you are not actively using, because dormant code is still exploitable. Rotate all credentials again now that the site is clean, enable two-factor authentication on every admin account, and add a firewall through a security plugin to block malicious traffic before it reaches your site. Ask your host what hardening they offer at the server level too. The goal is simple: make sure the door the bot walked through is locked before you reopen the site.

What are the most costly mistakes people make?

The expensive mistakes in hack recovery are the ones that feel like progress but quietly undo your work.

Watch for these four, because we see each one turn a one-time hack into a recurring nightmare:

  • Restoring an infected backup. If the backup was made after the breach, it carries the malware straight back in. Always scan a backup before you restore it.
  • Cleaning without fixing the entry point. Remove the malware but leave the vulnerable plugin, and the attacker returns through the same hole.
  • Rushing back online. A few extra hours in maintenance mode to secure the site properly beats another full compromise a week later.
  • Ignoring it because the site still loads. A hacked site that looks fine to you may be redirecting visitors, sending spam, or hosting malware that gets you blacklisted. Working does not mean cleaning.

When should you call a professional?

Call in help when the stakes or the complexity outrun your comfort level. Specifically, get professional help if the infection keeps returning after you cleaned it, if your host suspended your account, if your site is still flagged as unsafe after cleanup, if you do not have time to do the work carefully, or if you are worried about hidden backdoors you might have missed. Any one of these is a reasonable reason to hand it off.

There is no failure in doing so. A hacked business site loses trust and revenue every hour it stays compromised, and a missed backdoor means paying for the cleanup twice. If the site matters to your livelihood and you are unsure you have found everything, a professional who does this daily is almost always cheaper than a second breach. Knowing when to escalate is part of handling security well, not a shortcoming.

Key takeaways

The most reliable signs your WordPress site is hacked are admin users you did not create, redirects to spam sites, Google security warnings, and content or files you never added, while a slow site alone is usually something else. Confirm any suspicion with an external scanner and a file check before you act. When a hack is real, contain it first with maintenance mode and a full credential and secret-key reset, then clean it with a deep scan or a known-clean backup, and finally close the entry point by updating everything and hardening the site. The costliest mistakes are restoring an infected backup and cleaning without fixing the vulnerability that let the attacker in.

Frequently asked questions

Can a small WordPress site really get hacked?

Yes. Most hacks are automated, not targeted, so site size does not protect you. Bots scan the web continuously for weak passwords, outdated plugins, and known vulnerabilities, then exploit whatever they find regardless of how much traffic a site gets. A small personal site with an outdated plugin is just as exploitable as a large one, which is why keeping software updated matters for everyone.

How do I know if it is a hack or just a plugin bug?

Confirm with outside tools before assuming either. Run an external scanner like Sucuri SiteCheck and check Google Safe Browsing for a security warning. Review your admin users and check whether core files were modified recently. If the scans are clean, no unknown admins exist, and nothing was modified, a caching issue or plugin conflict is the more likely cause than a hack. Confirmation removes the guesswork.

Will I lose my site or my data if it is hacked?

Usually not, if you act carefully. Most hacks can be cleaned without losing content, especially if you have a clean backup from before the breach. The real risk comes from panic: deleting files blindly or restoring an infected backup can cause more damage than the hack. Back up the current state before cleaning, work methodically, and data loss is uncommon in a well-handled recovery.

Can I clean a hacked WordPress site myself?

Sometimes. A technically confident owner can clean a straightforward infection by scanning, removing malicious files, replacing core files, and hardening the site. The risk is hidden backdoors, which cause reinfection if missed. If the hack keeps returning, your host suspended you, or you are unsure you found everything, professional malware removal is worth the cost because a missed backdoor means cleaning the site twice.

How long does it take to recover from a WordPress hack?

It varies by severity. A straightforward infection caught early can be confirmed, cleaned, and hardened in a few hours. A deep compromise with database infection, multiple backdoors, or a host suspension takes longer, sometimes a day or more, plus time for Google to lift a blacklisting after you request a review. Fixing the entry point properly is what keeps recovery from repeating.

How did my WordPress site get hacked in the first place?

Most commonly through an outdated plugin, theme, or WordPress core version with a known vulnerability, a weak or reused password, or a compromised hosting account. Attackers rarely target a specific site. Bots find the weakness automatically and exploit it. Identifying and closing that entry point during recovery is essential, because leaving it open is the top reason sites get reinfected after cleanup.

Worried your site is compromised and want it handled right?

If you have spotted the signs and would rather have experts confirm, clean, and secure the site than work through it under pressure, that is what we do. Survyc is an AI-first digital agency that handles WordPress security, malware removal, and hardening for agencies and their clients, working as an embedded part of your team. We find the entry point, remove every backdoor, and hand the site back secured, not just patched. Tell us what you are seeing at info@survyc.com.