If your WordPress site is acting strange, showing spam content, or redirecting users unexpectedly, it may be compromised. Hacked sites often have hidden users, unknown files, or unusual server activity.
Tools like “Wordfence”, “Sucuri”, and “Google Search Console” can help detect malware, file changes, or blacklisting. In this guide, you’ll learn how to spot signs of a hack, scan your site, and take steps to secure it.
Common Signs of a Hacked WordPress Site
Following are few common signs of a hacked WordPress site.
- Unexpected Redirects: Visitors are redirected to spam, gambling, or adult sites.
- Unknown Users in Admin: Check for unfamiliar users with admin privileges.
- Strange or Modified Files: Unusual PHP files in “/wp-content/”, “/wp-includes/”, or the root directory.
- Spike in Resource Usage: Hosting shows CPU or bandwidth spikes without more traffic.
- Google Warnings: Google shows warning for the site in search results like:
“This site may be hacked”
Or there are Google Search Console alerts. - Disabled Plugins or Themes: Plugins deactivated or theme files altered without your action.
- Injected Links or Content: Spammy links in footer, posts, or new pages/posts you didn’t create.
- Emails Being Sent from Site: Your site may be sending spam emails (check with host or mail logs).
How to Check If It’s Compromised
Here is how you can check for a compromised WordPress website.
Use a Security Plugin
Install “Wordfence”, “iThemes Security”, or “Sucuri Security” and run a site wide scan. They can detect Malware, Modified core files, and Known vulnerabilities.
Check File Integrity
Use “Wordfence” or manually compare core WP files with fresh ones from wordpress.org. Look inside “/wp-config.php” and “.htaccess”. Also look for any unknown PHP files in “/wp-content/”.
Scan with Online Tools
“Sucuri SiteCheck Tool” is good with it. “VirusTotal” can scan your site or individual files.
Check Logs & Server Activity
Check access logs and error logs via cPanel or your hosting dashboard. Look for unusual login attempts, suspicious POST requests or PHP scripts in uploads directory.
What to Do If WordPress is Hacked?
These are few steps that you should take in order to clean a hacked WordPress website.
- Change all passwords (admin, FTP, database)
- Take a full backup before changes
- Remove suspicious files and code
- Reinstall WordPress core files
- Consider hiring a security expert or using an online Cleanup Service
Share your experiences in the comments.