Your website looks a bit strange. Maybe Google is showing a warning, a customer says they were sent to a dodgy site, or traffic has suddenly dropped. Is your WordPress site hacked?
WordPress powers more than 40% of the web, which makes it the biggest target for automated attacks. The good news is that a hacked site can almost always be cleaned and secured. This guide covers the 12 most common warning signs, what to do straight away, and how to stop it happening again.
Quick answer: if you see a Google hacked warning, unexpected redirects, spam pages in search results or admin users you don't recognise, your WordPress site has very likely been hacked. Change your passwords, take a backup for evidence and get the site cleaned as soon as possible.
12 warning signs your WordPress site is hacked
1. Google warns visitors that your site may be hacked
You see "This site may be hacked" under your listing in Google, or Chrome shows a red "Deceptive site ahead" screen. Google has detected malware or spam and is protecting searchers. This one hurts traffic fast, so act straight away.
2. Visitors are redirected to other websites
People land on your site and get sent to a scam, pharmacy, gambling or fake prize page. Redirect malware often only targets mobile users or visitors from Google, so it may look fine when you type the address yourself.
3. Strange pages show up in Google
Search site:yourdomain.com.au in Google. If you see pages in Japanese, pages selling cheap brands or pharmacy products, your site has been injected with spam pages. This is called a Japanese keyword hack or pharma hack.
4. Unknown admin users
Go to Users in WordPress and look for administrators you did not create. Attackers often add a hidden admin account so they can get back in later.
5. You can't log in
Your password suddenly stops working, or the login page redirects somewhere else. The attacker may have changed your password or email address.
6. Your host has suspended the site or sent a warning
Hosts scan their servers for malware. If they find it, they may suspend your account or limit it to stop it spreading to other sites.
7. The site is suddenly slow or crashing
Malware can use your server to send spam, mine cryptocurrency or attack other websites. That uses up server resources and makes the site slow or unstable.
8. Spam emails are being sent from your domain
Customers report strange emails from your address, or your emails start landing in spam. A hacked site is often used to send bulk spam.
9. Unfamiliar files or code on the server
Files with random names such as wp-xyz.php, PHP files inside the uploads folder, or long blocks of scrambled code at the top of theme files are classic signs of a backdoor.
10. Pop-ups and ads you did not add
Visitors see pop-ups, fake virus warnings or ads that are not part of your site. Malicious JavaScript has been injected into a plugin, theme or the database.
11. A sudden drop in traffic or sales
Google may have blocklisted the site, or spam pages may have pushed your real pages down. Check Google Search Console for a Security issues report.
12. Security plugin or antivirus alerts
Your security plugin flags modified core files, or a visitor's antivirus blocks your site. Do not ignore these warnings.
Get your hacked site cleaned →
How to check your site in 5 minutes
- Search site:yourdomain.com.au in Google and scroll through the results for spam pages.
- Open your site on your phone using mobile data, not Wi-Fi, and check for redirects.
- Check Users in WordPress for unknown administrators.
- Open Google Search Console and look at Security and manual actions.
- Run the free website health check to spot missing HTTPS, noindex tags and other red flags.
- Check Google Safe Browsing by searching "Google transparency report site status" and entering your domain.
What to do if your WordPress site has been hacked
- Don't panic, and don't delete everything. You may need the infected files to find out how the attacker got in.
- Change every password. WordPress admins, hosting, FTP/SFTP, database and email accounts.
- Take a full backup of files and database before you change anything, and label it as infected.
- Tell your host. They can often confirm the infection and see the server logs.
- Clean the site properly. Remove malware from files and the database, replace WordPress core, reinstall plugins and themes from clean sources, and remove backdoors.
- Close the gap. Update everything, remove unused and nulled plugins, and fix whatever let the attacker in.
- Request a review from Google in Search Console once the site is clean, so the warning is removed.
Deleting the obvious spam page is not a fix. If the backdoor stays, the hack usually returns within days.
Why WordPress sites get hacked
- Outdated plugins, themes or WordPress core with known security holes
- Nulled or pirated premium plugins that come with malware built in
- Weak, reused or leaked passwords, and no two-factor login
- Old PHP versions and cheap shared hosting with poor isolation
- Too many admin users, including old staff and agencies
- No firewall, so bots can hammer the login page
You can read more about everyday WordPress issues in common WordPress problems and fixes, and why a firewall helps in why use Cloudflare.
How to protect your site from now on
- Update WordPress, plugins and themes every week
- Delete plugins and themes you are not using
- Use strong unique passwords and turn on two-factor login
- Limit login attempts and change the default admin username
- Keep automatic off-site backups for at least 30 days
- Put the site behind a firewall such as Cloudflare
- Run a security scan every month
If you would rather not manage this yourself, the WordPress Security Hardening and Backups package sets it all up for A$349, and the 6 month support and maintenance plan keeps it updated for you.
Need help with a hacked website?
iScreenviewer offers fixed-price malware cleanup for an entire site from A$499. It includes a full scan of your files and database, removal of malware, backdoors and spam pages, clean copies of WordPress core, plugins and themes, security hardening, a Google review request if your site has been flagged, and a report of what was found and fixed. Most sites are cleaned within 1 to 3 business days of receiving access.
Frequently asked questions
How do I know if my WordPress site has been hacked?
Common signs include Google showing a "This site may be hacked" warning, visitors being redirected to spam or scam sites, unknown admin users, strange files on the server, spam pages in Google results, a sudden traffic drop and your host suspending the account. If you see any of these, assume the site is compromised until it is checked.
Can a hacked WordPress site be fixed?
Yes. In most cases the site can be cleaned, the backdoors removed and the security gaps closed without rebuilding. The key is removing every infected file and database entry, not just the visible symptom, otherwise the hack comes back.
Will restoring a backup fix a hacked site?
Only if the backup was taken before the hack and you also fix how the attacker got in. Many hacks sit hidden for weeks, so recent backups are often infected too. After restoring, change every password and update all plugins and themes.
How did my WordPress site get hacked?
The most common causes are outdated plugins or themes, nulled (pirated) plugins, weak or reused passwords, old PHP versions and insecure hosting. Most attacks are automated bots scanning thousands of sites for known weaknesses, not a person targeting your business.
How much does WordPress malware removal cost?
iScreenviewer offers fixed-price malware cleanup for an entire site from A$499, including a full scan, malware and backdoor removal, security hardening and a Google review request if your site has been flagged.
How do I stop my WordPress site being hacked again?
Keep WordPress, plugins and themes updated, remove anything you do not use, use strong unique passwords with two-factor login, limit login attempts, keep off-site backups and use a firewall such as Cloudflare. A security hardening service sets all of this up for you.