Is your WordPress site hacked? 8 warning signs most owners notice too late

Why every hour counts

A hacked WordPress site rarely goes down in a dramatic way. Far more often it keeps working, but no longer only for you: it also serves unwanted ads, redirects, malware or entirely foreign spam pages. Visitors or Google often notice before you do, while your own analytics show nothing unusual.

That is why a few simple signs are worth checking regularly. None of them proves a compromise on its own, but when two or three appear together, treat the site as if the damage has already happened.

The 8 most common warning signs

The list below summarises the symptoms seen most often in practice. It is not exhaustive.

• A security warning in search or in the browser. The “Security issues” report in Google Search Console, or a warning screen about a dangerous site, is a serious external signal.
• An unknown administrator. Check the Users list: a new admin that nobody created is a top-priority alert.
• Redirects or pop-ups, especially on mobile or for visitors arriving from search. This type of malware often hides from a logged-in administrator.
• Foreign pages in search results. A site:yourdomain.com search shows suspicious, foreign-language or pharmacy, casino and fashion-ad titles.
• A sudden slowdown or resource overrun. Your host warns about CPU or I/O limits although traffic has not grown.
• Unknown or modified files. An executable .php file in wp-content/uploads, or a randomly named file, is especially suspicious.
• Spam leaves your domain, or bounce messages arrive. You receive delivery errors for emails you never sent.
• You cannot log in, or unexpected password-reset emails arrive. Someone else is trying, or has already changed your account.

The first 60 minutes: in order, and calmly

The worst result of panic is that the evidence disappears, or the attacker simply gets back in. This order helps.

• Minutes 0–10: do not clean up in a hurry. Take a full copy of the current state (files and database) and keep the logs. If your host offers snapshots, use one.
• Minutes 10–20: limit the damage. Put the site in maintenance mode and, if the attack is active, ask your host to isolate it.
• Minutes 20–35: change passwords from a clean device. WordPress admins, hosting panel, FTP/SFTP, database, email and everything stored in wp-config.php, including the security keys.
• Minutes 35–50: find the way in. An outdated plugin or theme, a weak password, stolen access? The logs can show when and from where files were modified.
• Minutes 50–60: decide how to recover. Restore from a known clean backup and update at once, or have a specialist clean the site. A mixture of the two is rarely a good idea.

Why deleting one suspicious file is not enough

Attackers usually leave back doors in several places: a hidden administrator, a modified core file, a scheduled task or code injected into the database. If you delete only the visible file, it can return within hours.

That is why the safest route is usually restoring a known clean backup, then updating and changing passwords at once. Use the logs to find the right restore point: you need the state from before the compromise.

Afterwards: so it does not happen again

Cleaning up is only half the job. These steps reduce the attack surface and the cost of the next incident.

• Update WordPress core, plugins and themes, and delete what you do not use; deactivated code can still be attacked.
• Turn on two-factor authentication for every admin and grant minimal permissions.
• Keep backups separate from the server and test a restore at least once.
• Set up error-log and file-change monitoring so the next suspicious change does not stay unnoticed for weeks.
• If search showed a security warning, request a review in Search Console once the site is clean.