7 Signs Your WordPress Site Has Been Hacked (and What to Do)

Most hacked WordPress sites do not announce it. The first sign is often a customer telling you something looks wrong. Here are seven warning signs to watch for, what to do if you spot them, and how to reduce the risk of it happening again.

7 signs your WordPress site may be hacked

1. Visitors are redirected to other websites. If your pages send people to spam or unfamiliar sites, something is injecting code.
2. Google shows a security warning. A red warning page or a note in search results that the site may be hacked is a serious sign.
3. Your hosting company suspends your account. Hosts often act when they detect malware or spam being sent from your site.
4. Strange pages or keywords appear in search results. Spam pages in a language you do not use are a classic symptom.
5. Unknown admin users appear. Check Users in your dashboard for accounts you do not recognise.
6. The site is suddenly slow or crashes. Malware can use your server resources.
7. Emails from your domain land in spam. Attackers sometimes use hacked sites to send junk mail.

What to do straight away

1. Stay calm and do not delete everything. You may need the evidence to find the cause.
2. Take a backup of the current state. It lets you recover anything that is lost during cleanup.
3. Change all passwords. That means WordPress admin, hosting, FTP or SFTP, and the database.
4. Remove unknown users and check that your own account is still safe.
5. Update WordPress, themes and plugins, and delete anything you no longer use.
6. Scan the site with a reputable security scanner to find infected files.
7. Restore a clean backup if you have one, or have the infection removed properly by a specialist.
8. Ask Google and your host to review the site once it is clean, so warnings are removed.

Cleaning only the visible damage is a common mistake. If the hole the attacker used stays open, the site gets infected again. If you want a professional to handle it, see our WordPress security and malware removal service.

How to prevent it

• Keep WordPress, themes and plugins updated, or have a team do it through a maintenance plan.
• Delete unused plugins and themes.
• Use strong, unique passwords and two-factor authentication.
• Limit login attempts.
• Keep tested off-site backups.
• Choose reputable hosting and use a firewall.

Need help?

If you think your site is compromised, send us your web address and we will do a free initial check and tell you what we find.