13 signs your WordPress site is hacked (and what to check first)

The tricky part about a hacked WordPress site is that it usually keeps working. Pages load. Customers place orders. The malware sits quietly in a plugin folder, or a fake admin user waits in the users table, and the first obvious sign is often Google flagging the site or the host suspending it. By then the cleanup is much more expensive than the check would have been.

This is a practical list of the signs we actually look for, roughly ordered from quickest to check to most involved. You can check most of them in an afternoon with nothing more than your WordPress admin, an FTP client, and a healthy dose of suspicion.

The quick signs (check these first)

1. Unknown admin users

Go to Users → All Users and look for accounts you did not create. Attackers commonly create a user with a plausible name like "wp_admin" or "support" and the Administrator role. If you find one, do not just delete it yet — note the creation date, because it helps narrow down when the break-in happened.

2. New scheduled posts or drafts you did not write

Check Posts and Pages for drafts, scheduled posts, or published content you did not create. Spam injected into old posts is common: an attacker edits a 2019 article to include links to pharma or gambling sites. Sort your content list by "last modified" and look at the most recent changes.

3. Plugins or themes you did not install

The Plugins screen shows everything installed, including inactive plugins. Attackers sometimes upload a malicious plugin as a .zip via the theme/plugin editor or an old vulnerable plugin's file manager. Anything you do not recognize deserves a close look, especially plugins with generic names.

4. Site redirecting, or opening pop-ups

If the site sends visitors to another domain, shows unexpected pop-ups, or looks fine to you but "different" to customers on their phones, that is almost always injected JavaScript. The script is typically loaded from a domain you do not control, added either to your theme's header/footer files or to a legitimate script's file.

5. Google's warning in search results

Search for your site on Google. If results show "This site may be hacked" or "This site may harm your computer," Google has already detected something. You can also check Google Search Console for a manual action or security issues report — it often tells you exactly which URLs are affected.

6. Emails from your own site that you never sent

Spam sent through your server is a classic sign. Your host's mail logs will show it, but often the first hint is a sudden spike in bounces or your domain landing on a blacklist. A quiet mailbox with a screaming mail queue is worth investigating.

The file-level signs

These require FTP, SFTP, or your host's file manager.

7. Recently modified core files

WordPress core files almost never change on their own outside an update. Look at wp-config.php, index.php, .htaccess, and the files in wp-includes/ and wp-admin/. Note the modification timestamps — a wp-config.php modified months after your last known change is a red flag, and sometimes the modification date alone tells you the exact hour of the attack.

8. Strange files with innocent names

Look for files like wp-content/uploads/feed.php, or images with PHP inside: shell.php.gif is old-school, but uploads/2026/03/avada.php still works just as well. Sorting uploads by file type and looking for anything executable (.php, .phtml) usually finds the backdoor. A backdoor's whole purpose is to let the attacker back in after you clean the visible damage, so this check matters more than deleting the spam content.

9. Cron jobs you did not set up

Under Tools → Site Health or in the file system, WordPress uses wp-cron for scheduled tasks. Attackers who get deeper access sometimes add real system cron jobs through a compromised host account. If your host shows cron entries running curl or wget against odd URLs, that is not WordPress behaving normally.

The database-level signs

phpMyAdmin or WP-CLI both work for these.

10. New options with encoded values

The wp_options table is a favorite hiding spot. Look at the most recently modified options (option_id ordered by date) for long values that look like eval(base64_decode(...)) or random letters. The siteurl and home values should contain exactly your domain — a subtle redirect is a known attack.

11. Injected user roles or hidden users

Sometimes a hacked user is hidden from the users list entirely: the wp_usermeta capabilities entry gives a user the Administrator role while a plugin hides them from the admin view. A direct database count of wp_users versus what the Users screen shows is a quick sanity check.

12. Strange links inserted into posts

Search your content for eval(, base64_decode, or domains you do not recognize. phpMyAdmin's search across the wp_posts table works for smaller sites; on larger ones WP-CLI's wp db search is faster.

13. Your backups stopped working

A quiet but effective attack disables the backup plugin or corrupts the backup schedule first, so you cannot simply restore. Check that your last backup is recent, that it is actually newer than the suspicious file timestamps you found, and that the backup file is readable.

What to do if you find something

Work in this order, and work from a known-clean copy of files wherever possible:

1. Take the site offline if it is actively harming visitors (a maintenance page is better than serving malware).
2. Make a full backup before you touch anything, even if the backup contains malware — you will want the forensics later.
3. Note every suspicious timestamp. They tell you when to look in your access logs.
4. Replace core files, plugins, and themes with fresh downloads rather than trying to clean files in place. Reinstalling from the official source is faster and safer than hunting edits.
5. Reset all passwords: WordPress admins first, then database, then hosting/FTP. Revoke API keys and application passwords.
6. Re-check after cleanup from a different network, in an incognito browser window, and via Google Search Console's inspection once the site is clean.

None of this is specific to any one hosting provider or security plugin, and you do not need to buy anything to do any of the checks above. If you want someone to check these things for you, a targeted external assessment is exactly what we do with CheckWebSecurity: verify what your site exposes and report findings you can act on.

---

Want to see what your site exposes today? CheckWebSecurity assesses your website's external perimeter — headers, TLS configuration, and exposure — and reports findings with plain-language explanations. Start a free check.

Related: WordPress security scanning without plugins · How website security checks work