Most WordPress sites aren’t hacked with a dramatic ransom note. They’re hacked quietly — a hidden redirect here, some spam pages there — and the owner doesn’t find out for weeks, often from a customer or from Google rather than from any warning of their own. So the honest answer to how to tell if your WordPress site is hacked is that you have to know what the quiet signs look like, because a compromise is designed not to announce itself. This guide walks through the symptoms that actually matter, how to confirm what you’re seeing, and what to do the moment you know.
A quick reassurance first: not every glitch is a hack. A blank screen or a plugin conflict can look alarming and be completely innocent. The goal here isn’t to make you paranoid — it’s to help you tell a real compromise apart from an ordinary bad day.
The warning signs that usually mean trouble
Google or your browser is warning people
This is the one you can’t ignore. If visitors see a red “this site may be hacked” or “deceptive site ahead” screen, or your search listings suddenly show odd text in a foreign language or for products you don’t sell, your site has almost certainly been compromised and search engines noticed before you did. A sudden collapse in search traffic can be the same story — Google quietly de-listing pages it flagged as malicious.
Redirects you didn’t set up
You (or a visitor) click through to your site and land somewhere else entirely — a sketchy pharmacy, a betting site, an app store page. Sometimes it only happens on mobile, or only for visitors arriving from Google, which is exactly why an owner testing from their own desk often can’t reproduce it. If customers report being bounced somewhere strange, believe them and investigate.
Pages, posts, or users you never created
Attackers love to plant content. Look for published pages or posts you don’t recognize — often spammy, often in another language. Check your users list for admin accounts nobody on your team created; a rogue administrator is a classic way an intruder keeps a door open even after you change your password. New content and new admins are two of the clearest tells.
The site is suddenly slow, or your host emailed you
A compromised site is frequently put to work — sending spam, mining, or attacking other sites — which eats resources and drags performance. If your site got sluggish for no reason you can explain, that’s worth a look. And if your host sends a notice about malware, unusual outbound email, or resource abuse, treat it as real and act on it rather than assuming it’s a false alarm.
Strange files, or changes you didn’t make
Odd files in your WordPress directories, especially ones with random names, or WordPress’s own files that have been modified, are strong indicators. You won’t usually see these from the dashboard — they show up in a file scan or in your hosting file manager — but if you’re already poking around and find them, that’s a red flag, not a coincidence.
Email from your site stops landing
If your contact form or order emails suddenly go to spam everywhere, or stop arriving, your domain may have been used to blast spam and gotten itself blacklisted. It’s an easy symptom to misread as an email problem when the root cause is a compromise.
How to confirm it before you panic
Seeing one symptom doesn’t always mean the worst. Here’s how to check quickly and calmly:
- Run a public scanner. Free online tools will check your homepage for known malware and blacklist status in seconds. It’s not exhaustive, but a clear hit is a strong confirmation.
- Test the way a visitor arrives. Open your site in a private/incognito window and from your phone on cellular data, and try clicking in from a Google search result. Hacks that hide from logged-in admins often reveal themselves this way.
- Check Google Search Console if you have it. The Security Issues report tells you directly whether Google has flagged your site and often points at the affected pages.
- Look at your users and recent content in the dashboard for anything you didn’t create.
- Ask your host. A good host can see behind-the-scenes signals — outbound spam, malicious processes, modified files — that you can’t, and can often tell you in one conversation whether something’s genuinely wrong.
If you want the fuller picture of how sites get to this point in the first place, why WordPress sites get hacked explains the handful of ways nearly all compromises actually happen — and most of them are preventable.
What to do the moment you’re sure
If you’ve confirmed a compromise, speed and order matter more than heroics. The wrong move — deleting things at random, or restoring an old backup without closing the hole first — can make cleanup harder. The right sequence is: get the site into a safe state, take a backup of the current (infected) state for reference, scan and clean thoroughly, find and fix the way in so it can’t simply happen again, and then ask Google to review and clear any warning. We lay that out step by step in how to fix a hacked WordPress site so you’re not improvising under pressure.
The single most important part is that middle step people skip: finding and closing the entry point. Cleaning the visible mess without closing the hole that let someone in just means you’ll be cleaning it again next week. If you’re weighing whether to tackle it yourself or bring in help, DIY versus professional malware removal is an honest look at where the line is.
The better position: not finding out from a customer
Here’s the uncomfortable truth in all of this. Every sign above is a symptom you noticed after the fact — and most owners don’t notice for weeks, because they log into their site a few times a year, not a few times a week. That gap between “compromised” and “discovered” is where the real damage lives: the lost search rankings, the flagged domain, the customers who hit a warning screen and left.
Managed hosting is what shrinks that gap. On our plans, malware scanning runs on an ongoing basis so an infection is caught early rather than by a customer, and a layered firewall with a live list of known attackers turns away the automated attacks that cause most compromises before they land. Updates to WordPress itself, plugins, and themes are applied and — every time we update your site — verified to confirm it still looks and works right, which closes the outdated-plugin hole that lets most intruders in. Off-site, monitored backups 3 times a day (locked for 90 days against changes or deletion, even by ransomware) mean that if the worst does happen, a bad day is a restore rather than a rebuild. And support is there any hour the moment something feels off, with a first reply within 15 minutes.
If you’d rather harden the site before anything goes wrong, our WordPress security checklist is the practical place to start.
Not sure, and don’t want to be?
If you’ve read this far because something feels wrong, don’t sit on it — the cost of a compromise grows every day it’s ignored. Take a look at our managed WordPress plans, where the scanning, the firewall, the verified updates, and the monitored backups run in the background so a quiet compromise doesn’t get the chance to become a loud one. If your site has been hacked, move it to us: we clean it as part of the move and keep it clean, and the migration is on our team. Your move starts as soon as you sign up: Start my move.