How to Know If Your WordPress Site Has Been Hacked
If your WordPress website is behaving strangely, it is worth checking the issue quickly. Some hacks are obvious, such as pop-ups, redirects or browser warnings. Others are quieter and may only show up as unknown admin users, strange files, spam pages in Google, server errors or a sudden drop in traffic.
This checklist is designed to help you work out whether your WordPress site has been hacked, what symptoms to look for, and when to escalate the issue to a developer or security professional.
Key takeaways
- Unexpected redirects, pop-ups, design changes or new pages can indicate that your WordPress site has been compromised.
- SEO symptoms are often the first clue. Check Google results for spammy titles, strange URLs or pages you did not create.
- Admin access matters. Unknown WordPress users, password reset emails or failed login spikes can point to an attempted or successful intrusion.
- Server and email problems can also be related to malware, especially if your domain has been blacklisted or your server resources spike.
- Do not rely on one symptom alone. Use several checks before deciding whether the site is hacked or simply experiencing a technical fault.
- Once you have confirmed a likely hack, move quickly to secure access, preserve a backup and follow a structured response process.
Quick check: is your WordPress site hacked?
Start with the visible signs, then move into the admin area, Google Search Console and server-level checks. A hacked website will not always show every symptom, but if you notice several of the signs below, treat the situation as urgent.
1. Your site redirects to an unknown website
One of the clearest signs of a hacked WordPress site is an unexpected redirect. You may type your domain into the browser or click through from Google, only to be sent to a different website after a few seconds.
This can happen on every visit, only on mobile, only from Google, or only for first-time visitors. Conditional redirects are common because they help the hack stay hidden from the website owner while still affecting users and search engines.
2. Strange pop-ups, ads or banners appear
Unexpected pop-ups, banner ads, download prompts or adult/pharmaceutical content can mean that malicious scripts have been added to your site. These scripts may be injected through a plugin vulnerability, compromised theme file, database injection or third-party script.
3. Your homepage or key pages look different
A full website defacement is easy to spot, but many WordPress hacks are more subtle. Look for unfamiliar text, links, buttons, images, hidden content blocks or design changes that no one on your team published.
4. Spam links or hidden pages have been added
Hacked WordPress sites are often used for SEO spam. Attackers may add hidden links to gambling, adult, pharmaceutical or fake product websites. They may also create hundreds of new pages that are not visible in your normal WordPress menus.
To check this, search Google for site:yourdomain.com.au and scan the results for page titles, snippets or URLs you do not recognise. Also check your WordPress posts, pages and media library for unfamiliar content.
5. Google shows a warning for your website
Google may display warnings such as ‘This site may be hacked’, ‘This site may harm your computer’ or ‘Deceptive site ahead’ when it detects malware, phishing, social engineering or other security issues. Verified site owners may also see alerts in the Google Search Console Security Issues report.
If users are seeing warnings in Chrome or Google Search, do not ignore them. Warnings can damage clicks, conversions and trust very quickly.
6. Your Google results have strange titles or descriptions
A common SEO-related symptom is search result hijacking. Your actual website may look fine, but Google may show spammy titles, foreign-language snippets, strange product terms or pages you never created.
This can happen when attackers inject content into your database or create pages that are only shown to search engine crawlers. This type of compromise can damage rankings and organic traffic even if regular users do not immediately notice the problem.
7. You cannot log in to WordPress
If your WordPress login no longer works, your admin user may have been deleted, disabled or replaced. Before assuming a hack, check whether the issue is caused by a forgotten password, plugin conflict or hosting problem. However, if login failure happens alongside other symptoms, treat it seriously.
8. Unknown admin users appear in WordPress
Go to Users > All Users in WordPress and review all accounts with Administrator access. If you see users you do not recognise, remove them only after you have captured enough information for investigation. Also check Settings > General to confirm the administration email address is correct.
After removing suspicious access, change passwords for WordPress, hosting, FTP/SFTP, database, email and any connected admin tools.
9. WordPress core files, plugins or themes have changed unexpectedly
Unexpected file changes can indicate malware, backdoors or injected scripts. Security plugins can help detect file changes, but a developer may need to compare files against clean versions of WordPress core, plugins and themes.
Avoid deleting files randomly if you are unsure what they do. Removing the visible malware without fixing the entry point can lead to reinfection.
10. Suspicious cron jobs or scheduled tasks appear
Cron jobs are scheduled tasks that run automatically on your server. WordPress uses scheduled tasks for normal activity, but attackers can use them to recreate malicious files or re-open backdoors after a cleanup.
Check your hosting control panel or ask your host to review scheduled tasks if you see suspicious activity that keeps returning.
11. Server logs show unusual activity
Server logs can reveal repeated login attempts, strange POST requests, unfamiliar IP addresses, unusual user agents or requests to files that should not exist. Logs are especially useful when the website looks normal but you suspect something is happening in the background.
12. Your website becomes very slow or unstable
A slow or crashing website is not always hacked. It may be caused by hosting limits, plugin conflicts or traffic spikes. However, sudden resource usage, repeated downtime, database errors or high CPU usage can be linked to malware, bot traffic or brute-force attacks.
13. Your email stops working or your domain is blacklisted
If your domain or mail server is used to send spam, your emails may start bouncing or getting blocked. This can happen when attackers gain access to mail accounts, forms, server scripts or website files.
Email blacklisting is not just inconvenient. For many businesses, it can interrupt enquiries, invoices, bookings and customer support.
How to confirm the issue before taking action
Before you make major changes, confirm whether the symptoms point to a hack or another technical issue. A good confirmation process includes:
- Checking the site in an incognito browser and on mobile.
- Searching Google with site:yourdomain.com.au to identify spam pages or strange snippets.
- Reviewing Google Search Console for security issues, manual actions and unusual indexing patterns.
- Checking WordPress users, recent posts, recent pages and plugin/theme changes.
- Running a malware scan using a reputable security tool.
- Asking your host to check server logs, file changes and resource usage.
What to do if the signs point to a hack
Once you have enough evidence that the website is compromised, switch from diagnosis to response. Start by changing passwords, revoking unknown users, preserving a backup for investigation and asking your host whether the site needs to be temporarily taken offline.
For a full step-by-step process, follow our guide on what to do if your website is hacked. If you need practical help cleaning and securing the site, eCBD provides WordPress hack repair for hacked, infected or compromised websites.
How to reduce the risk of this happening again
Prevention depends on layered protection. Keep WordPress core, plugins and themes updated, remove unused plugins, use strong passwords and MFA, restrict admin access, maintain off-site backups and set up monitoring.
It is also worth reviewing the common WordPress security threats that lead to most compromises and using reputable WordPress security plugins as part of a broader maintenance process. For business-critical websites, a managed website maintenance plan can help with updates, backups, uptime monitoring and security checks.
FAQs
How can I check if my WordPress site has been hacked?
Check for redirects, pop-ups, unknown admin users, strange Google results, Search Console warnings, suspicious files, spam pages, email blacklisting and server log anomalies. A single symptom may be a technical issue, but multiple symptoms should be investigated quickly.
Can my WordPress site be hacked even if it looks normal?
Yes. Many hacks are designed to stay hidden. Attackers may inject hidden links, create spam pages, add backdoors or show different content to Google than they show to normal users.
Should I delete suspicious files straight away?
Not always. If you delete files without understanding the cause, the malware may return. First preserve a backup for investigation, then clean the site and patch the vulnerability that allowed access.
Do I need a developer to confirm a WordPress hack?
For simple symptoms, you may be able to confirm the issue yourself. For file-level malware, backdoors, database injections, server cron jobs or repeated reinfections, it is safer to involve a developer or security specialist.
What is the first thing I should do after confirming a hack?
Secure access. Change passwords, revoke suspicious users, contact your host, preserve a backup for investigation and decide whether the site should be temporarily taken offline to protect visitors.
