Most hacked WordPress sites do not announce it. The attackers want the site to keep working, because a working site is more useful to them: it can host spam pages, send visitors elsewhere or be used to attack other sites. That is why owners are often the last to know.
These are the signs we come across most often when we clean up a site:
- Strange pages in Google. Search for
site:yourdomain.com. Pages you never created, often in another language or about gambling, pharmacy or loans, are a classic sign. - Visitors being redirected. Some hacks only redirect people arriving from Google, or only on phones, so the site looks fine when you type the address yourself.
- Admin users you don’t recognize. Check Users in your dashboard. Attackers often add an administrator account with an ordinary-looking name.
- Warnings from your host, Google or your browser. A “This site may be hacked” label in search results, a red browser warning, or an email from your host about malicious files.
- Unfamiliar files. PHP files in your uploads folder, or files with random names in your plugins folder, should not be there.
- The site suddenly slows down or uses far more resources. Hidden scripts can send spam or attack other sites in the background.
- You can’t log in. Passwords that suddenly stop working, or password reset emails you didn’t request.
What to do if you spot one
- Don’t just delete the strange files. Most infections leave more than one way back in. Cleaning up the obvious part while leaving the rest means it comes back, often within days.
- Change passwords for WordPress, your hosting account and FTP/SFTP, from a computer you trust.
- Find out how they got in. Usually an outdated plugin or theme, or a reused password. If the way in stays open, a cleanup will not last.
- Ask for help if you are not sure. A proper cleanup checks every file against known-good copies, not just the ones that look suspicious.
If you think your site might be compromised, choose “My site was hacked” on our contact form and include your website address.