How to check if WordPress site is hacked
If your website suddenly slows down, redirects visitors, or behaves strangely, it may be compromised.
This guide shows practical ways to confirm a WordPress hack, identify common infection patterns, and respond before search engines, users, or payment systems are affected.
What a hacked WordPress site usually looks like
A WordPress compromise does not always mean a visible defacement.
In many cases, attackers aim for stealth: spam links, hidden redirects, malicious JavaScript, backdoors, or SEO spam that remains unnoticed for weeks.
Sites built on WordPress are often targeted through weak passwords, outdated plugins, vulnerable themes, or exposed admin accounts.
Common signs include unexpected admin users, unfamiliar files, sudden performance issues, search engine warnings, and changes to content you did not make.
The challenge is that one symptom alone does not prove a hack, so the best approach is to check several indicators together.
Fast signs your WordPress site may be hacked
- Unexpected redirects: Visitors land on spam, phishing, or casino pages instead of your content.
- New admin accounts: You find users with administrator privileges that no one created.
- Changed homepage or posts: Titles, links, or content are edited without permission.
- Browser or search warnings: Google, Chrome, or antivirus tools flag the site as unsafe.
- Odd outbound traffic: Hosting logs show unknown IPs or repeated login attempts.
- Performance drops: Pages suddenly become slow because malware is consuming server resources.
- Spam in comments or forms: Bots or injected scripts generate unusual submissions.
- Suspicious files: New PHP files appear in wp-content, uploads, or theme directories.
Check the most likely infection points
Review administrator accounts
Start in the WordPress dashboard under Users.
Look for usernames you do not recognize, recently added accounts, or accounts with admin rights that should not have them.
Attackers commonly create a second admin so they can return after cleanup.
Also inspect profile details such as email addresses, display names, and creation dates if your membership or security plugin records them.
If you use multisite, check network super admins as well.
Inspect plugins and themes
Outdated plugins and themes are among the most common entry points.
Open the plugins and themes screens and note anything inactive, abandoned, or recently installed without your approval.
Pay special attention to nulled premium plugins, especially those downloaded from unofficial sources.
Check whether any plugin settings were modified, especially SEO, redirect, page builder, caching, or security plugins.
Malware often hides inside plugins because they execute code on every page load.
Look for file changes in wp-content
The wp-content directory is where many hacks leave traces.
Suspicious patterns include PHP files inside uploads folders, unfamiliar .ico or .jpg files that are actually scripts, and files with random names such as class-api.php or temp-update.php.
Core WordPress folders rarely need arbitrary new PHP files.
Compare current files against a clean WordPress download.
If you have access to version control or hosting snapshots, review recent changes to identify when the first unauthorized file appeared.
Review the database for injected content
WordPress stores posts, settings, widgets, and many plugin configurations in the database.
Hackers may inject hidden links into post content, add malicious scripts to site options, or alter widget text.
Search for unfamiliar domains, base64-looking strings, iframe tags, and odd JavaScript snippets.
Table names such as wp_posts, wp_options, and wp_users are common places to inspect.
If your site uses a custom database prefix, search every table that stores content or settings.
How to verify whether the issue is a hack or a configuration problem
Not every strange behavior is caused by malware.
A broken redirect can result from a plugin conflict, a bad caching rule, or a misconfigured CDN.
The difference is that a hack usually leaves multiple artifacts: unauthorized files, unknown logins, altered content, or external connections to suspicious domains.
Check the site from different devices and networks, clear browser cache, and compare what you see with incognito mode.
Then inspect server logs, security logs, and DNS settings.
If only one device shows the problem, it may be a local browser issue; if the problem appears everywhere, the site itself is more likely compromised.
Use security tools to scan WordPress properly
Security scanners can help confirm suspicious behavior, but they work best when paired with manual inspection.
Wordfence, Sucuri, iThemes Security, and MalCare can scan files for malware signatures, modified core files, and known backdoors.
Many managed hosts also include malware detection in their control panels.
When scanning, focus on these results:
- Modified WordPress core files
- PHP files in uploads or cache folders
- Known malicious domains or hashes
- Suspicious scheduled tasks or cron jobs
- Remote code inclusion or eval-based patterns
If the scanner flags a file but does not explain why, compare it to a clean copy from WordPress.org or the plugin author’s repository before deleting anything.
Check search engines and reputation signals
Google Search Console is one of the most useful places to confirm a hack.
Look for manual actions, security issues, hacked content warnings, or sudden indexing changes.
If Google has flagged your pages, the site may already be serving spam or malicious redirects to search bots.
Also check browser reputation tools, Safe Browsing status, and your hosting provider’s abuse notifications.
If your domain has been blacklisted or your email provider reports suspicious sending activity, malware may be using the server for spam.
Inspect logs for proof of intrusion
Server logs can reveal brute-force attempts, strange user agents, and unauthorized file access.
Review login attempts, POST requests to admin endpoints, and requests to unexpected PHP files.
A sudden spike in requests to wp-login.php or xmlrpc.php may indicate automated attacks, especially if followed by a successful login.
Look for uploads of executable files, access to unusual plugin paths, and requests coming from unfamiliar countries or IP ranges.
Hosting logs, access logs, and error logs together often show the timeline of compromise more clearly than the dashboard does.
What to do immediately if you confirm a hack
- Put the site in maintenance mode or restrict access.
- Change all passwords. Update WordPress admin, hosting, FTP/SFTP, database, and email passwords.
- Remove unknown admin accounts.
- Back up the current state. Keep a copy for forensics before cleanup.
- Restore from a clean backup if available. Make sure the backup predates the compromise.
- Reinstall clean copies of WordPress core, plugins, and themes.
- Scan and replace infected files. Delete backdoors and suspicious scheduled tasks.
- Reset salts and security keys. This logs out stolen sessions.
- Submit cleanup requests to Google and other reputation services.
If payments, memberships, or customer data are involved, treat the incident as a security event and notify the relevant stakeholders according to your legal and contractual obligations.
How to reduce the risk of another hack
After cleanup, harden the site so the same weakness is not reused.
Keep WordPress, plugins, and themes updated.
Remove anything unused.
Use unique passwords and enable two-factor authentication for all privileged accounts.
Limit login attempts, disable unnecessary XML-RPC access, and choose reputable plugins from trusted vendors.
It also helps to use least-privilege roles, daily backups stored offsite, a web application firewall, file integrity monitoring, and regular malware scans.
For business sites, managed WordPress hosting with automatic patching and isolated accounts can materially reduce exposure.
WordPress hack indicators you should never ignore
- Unknown admin or editor accounts
- Hidden links added to old posts
- PHP files inside uploads or image folders
- Redirects affecting search traffic only
- Login success from unfamiliar IP addresses
- Google Search Console security alerts
- Spam emails sent from the same hosting account
When you know how to check if WordPress site is hacked, you can move from guesswork to evidence.
That means comparing files, reviewing users, checking logs, and validating scan results before the problem spreads to search rankings, customers, or email reputation.