How to Tell if Your WordPress Site Is Hacked

A hacked WordPress site doesn’t always look hacked to its owner. Attackers may show spam only to Google, or redirect people arriving from search on a phone, while a logged-in admin sees the normal site. If you’re wondering how to tell if your WordPress site is hacked, I’m Andrei, and this is the 15-minute check I’d start with.

How to check if your WordPress site is hacked in 15 minutes

Start outside WordPress. An attacker may leave your dashboard looking ordinary, so checking only from your admin account can miss the problem.

Search Google for site:yourdomain.com. Replace the example with your domain. Look for pages you never made, strange titles, or results in Japanese advertising pills or casino games. Open suspicious results carefully; a title alone isn’t a diagnosis. Google may show deleted pages too, so check whether those URLs still load.
Visit like a customer from search. On your phone, open a private browser window, find your site through Google and tap the result. Don’t type the address for this test. Some redirects trigger only for search visitors, phone users, or people who aren’t logged in. If you land on a scam page, record the URL and take a screenshot.
Open Google Search Console. Select your property and check Security & Manual Actions > Security issues, then Security & Manual Actions > Manual actions. A notice means Google has spotted a problem. No notice doesn’t clear your site; Google might not have found the injected page.
Check Google’s Safe Browsing site status. Search for the Google Transparency Report’s Safe Browsing site status page and enter your domain. It’s useful if a browser has warned a customer away, but it isn’t a full file scan.
Check administrator accounts. In WordPress, go to Users > All Users and filter for administrators. Recognise everyone? Ask the people managing your site before removing an account. An unfamiliar admin, especially a recent one, deserves investigation.
Look through plugins. Check Plugins, including Plugins > Must-Use and Drop-ins. Note anything you didn’t install or can’t identify. Must-use plugins are easy to overlook; an unfamiliar name isn’t proof of trouble, since your host may have installed it.
Verify files if you have WP-CLI access. Run these commands from your WordPress installation. They compare WordPress core and plugins from WordPress.org with official checksums:

wp core verify-checksums
wp plugin verify-checksums --all

Check any mismatch, but don’t assume it’s malware. These commands can’t verify premium or custom plugins against WordPress.org checksums.

Look for PHP files in uploads. With shell access, run find wp-content/uploads -name "*.php" from the WordPress directory. Uploads normally holds images and documents, not executable PHP. Don’t run or delete a file you find; record its path and ask your host or a security specialist to examine it.

A scanner can help with the first pass. Our malware scanner checks the usual hiding places; it doesn’t inspect every file. A clean scan isn’t proof all is well, especially if only Google visitors see the warning.

Malware can hide an administrator from the Users screen. If the count looks wrong, check the users table directly if you have database access. For example, wp db query "SELECT ID, user_login, user_registered FROM wp_users ORDER BY user_registered DESC" lists accounts by registration date. Your table prefix may not be wp_, so confirm it first.

Signs your WordPress site has been hacked

No single symptom settles it. Look for changes you can’t explain, especially when several appear together.

What visitors and Google notice

People clicking a Google result reach a spam or scam site, but your typed-in address works. Test on mobile too.
Google shows “This site may be hacked,” or a browser displays “Deceptive site ahead.” Treat either warning as urgent, even if your homepage looks fine.
Your host sends a malware notice or suspends the site. Ask which files or activity triggered it.
Customers report spam from your domain. Save a message, including its headers if possible, for your mail provider to trace.

What changes inside WordPress

Unknown administrators and plugins are flags, including plugins under Plugins > Must-Use. Less obvious: your password stops working, you keep getting logged out, or new-user registration is enabled with administrator as the default role. Check Settings > General for that role and an unexpected site URL. Check each admin profile for application passwords you don’t recognise. Ask others with access before calling a change hostile.

What changes on the server

PHP files under wp-content/uploads, odd PHP filenames in the site root, and unexpected edits to .htaccess or wp-config.php warrant a look. So do unknown cron jobs, unexplained recent file changes, or sudden CPU and traffic spikes. Legitimate updates change files too; compare dates with your update log, host alerts and developer’s work.

What shop owners should watch

Running WooCommerce? Inspect checkout. Extra JavaScript could be a card skimmer; changed payment settings or order-notification email addresses could divert money or order details. A customer reporting card fraud after buying from you calls for prompt investigation, not an assumption that your checkout caused it. Preserve evidence and contact your payment provider if payment data may be involved.

A 2026 example: the plugin that hid an admin

Patchstack reported a campaign seen since October 4, 2026 that used script injection in Ninja Forms submissions and WPC Product Bundles WooCommerce orders. When an admin opened an affected submission or order, it installed a fake plugin called “WP Smart Thumbnails.” The attack created one visible administrator and another hidden from Users, plus a secret login link and file manager. Some parts sat as must-use plugins under wp-content/mu-plugins. That’s why I check the database and must-use plugins when the dashboard looks too tidy. Updating the affected plugin stops new attacks through that route; it won’t remove planted backdoors.

What a clean check does and doesn’t tell you

If Google, your phone test and the dashboard look normal, that’s reassuring. It isn’t a certificate of health. Search results lag, redirects can target narrow groups, and hidden accounts won’t appear on the Users screen. Keep your notes for comparison. If a customer sends a suspicous link or screenshot, follow it even if every other check is clean.

Found a suspicious file? Pause before deleting it

A file called image-cache.php in uploads looks odd. Find out what it does and whether something recreates it. Record its full path and modification time, ask your host for access logs around then, and compare it with a known clean backup if available. Don’t open unfamiliar PHP through your browser to “see what happens.” And capture a snapshot before removing a suspected backdoor, or you may lose your best clue to how the attacker got in.

False alarms

Not every broken-looking site has been hacked. Check these explanations first:

Slow pages: Check host resource graphs and traffic. An import or backup may explain a spike; unexplained requests to odd URLs need digging.
A plugin conflict: If trouble began after an update, note which plugin changed and test on staging. Don’t disable checkout plugins on a live shop just to experiment.
An expired SSL certificate: A certificate warning isn’t a malware warning. Check its dates and ask your host to renew it.
An old page showing up: A cache or Google’s index may show a deleted page. Check whether the live URL exists and contains spam.

I found something: what to do next

First, don’t panic-delete. WordPress.org’s hacked-site guidance starts with tracking what happened. Record dates, URLs, filenames, unfamiliar accounts and warnings. Take a backup or host snapshot as it is now before changing anything, even if it contains malware. That copy can help you work out what happened.

Then change all passwords: WordPress administrator accounts, hosting panel, FTP or SFTP, and database credentials. Replace the secret keys and salts in wp-config.php; that logs everyone out. Check your computer too. Stolen saved passwords are a commmon way back in, so a clean WordPress install won’t help if your laptop is compromised.

Tell your host what you found. Clean files once you know what’s malicious; reinstall WordPress core and plugins from clean copies instead of editing infected ones. Find the entry point, such as an outdated plugin, or the attacker may return. If Google flagged the site, request a review after cleanup. My guide to what Google does after it detects malware explains the warnings.

For the full process, use my step-by-step guide to fixing a hacked WordPress site. If you’d rather hand it over, I offer WordPress hack cleanup.

Your 5-minute check today

Don’t have 15 minutes? Search Google for site:yourdomain.com, scan the titles, then open Users > All Users and check the administrators. Write down any result or account you can’t explain. Those two screens give you somewhere concrete to start.

How to Tell if Your WordPress Site Is Hacked: A 15-Minute Check