Early Signs Your WordPress Site Has Been Hacked

· 6 min read
Hooded figure in a dark room in front of a computer screen

The hacked site people picture — defaced homepage, a message from the attacker — is rare. Modern attacks want to stay hidden for as long as possible, because a compromised site is more useful to an attacker when nobody knows. It sends spam, redirects visitors, hosts phishing pages or boosts someone else’s search rankings, quietly, for weeks.

That means the early signs are subtle. Catching them early is the difference between a quick clean-up and a site Google has flagged as dangerous.

Signs visitors (or Google) notice

Redirects you don’t see yourself. Visitors arriving from Google or on a phone get sent to a scam, pharmacy or gambling site, while you — logged in, on desktop, typing the URL directly — see the normal site. Attackers target exactly the visitors you’re least likely to be.

Strange results in Google. Search site:yourdomain.com. If you see pages you never created — often in another language, about pills, replica goods or casinos — someone is injecting spam pages into your site.

Browser or Google warnings. “Deceptive site ahead” or “This site may be hacked” next to your search listing. At this point it’s been going on a while.

Search Console alerts. Google Search Console has a Security issues report and will email you if it detects malware or spam. If your site isn’t connected to Search Console, set it up — it’s free and often the first to know.

Signs you notice in the admin

Users you don’t recognize, especially administrators. Check Users and sort by role.

Plugins you didn’t install, sometimes with generic names that look like system components.

Changed files or settings. The site URL, the admin email, or the homepage setting changed without anyone on your team doing it.

You can’t log in, or your password reset email never arrives because the admin email was changed.

Signs on the server side

Sudden spikes in resource usage — CPU or entry processes at the limit with no traffic increase to explain it.

Outgoing spam. Your domain’s email starts bouncing, landing in spam everywhere, or you get notices about blacklisting — the site may be sending spam on its own.

Unknown files in wp-content/uploads that end in .php. The uploads folder should hold images and documents, not code.

Malware scanner alerts. On a server running a scanner like Imunify360, infected files are flagged — and often cleaned — automatically.

What to do in the first hour

  1. Don’t delete things at random. You can remove evidence that shows how they got in.
  2. Change passwords — WordPress admins, cPanel, FTP/SFTP, database, and the email accounts tied to them. Do it from a device you trust.
  3. Turn on 2FA for every admin account, if it wasn’t on already.
  4. Contact your host. They can see server-level logs, scan files and check whether other sites on the account are affected.
  5. Check for a clean backup, but don’t restore blindly — if you restore without closing the way in, they’ll be back the same day.
  6. Find the entry point. Usually an outdated plugin, a leaked password or a nulled theme. Fix that, or the clean-up won’t last.

After the clean-up

  • Update everything — WordPress, plugins, themes and PHP.
  • Delete plugins and themes you don’t use.
  • Review users and remove access that’s no longer needed.
  • If Google flagged the site, request a review in Search Console once it’s clean.

Most of the prevention side is in what’s on you in hosting security, and keeping things current is covered in updating WordPress without breaking your site.

How HOSTEMCLOUD handles it

Every server runs Imunify360, which scans for malware and blocks common attacks before they reach WordPress. Every UNITY plan also includes hack recovery: if your site is compromised, we clean it up and help you close the door it came through.

Frequently asked questions

Why can’t I see the redirect when I visit my own site?

Many infections hide from logged-in users and from direct visits. Test from a phone on mobile data, not logged in, arriving from a Google search.

Can a site be hacked even with an SSL certificate?

Yes. SSL encrypts the connection; it doesn’t protect the site’s software. A padlock and malware can coexist.

Do I need to rebuild the whole site after a hack?

Usually not. A proper clean-up removes the malicious code and closes the entry point. Rebuilding is only needed in rare cases where the site’s files can’t be trusted at all.

Want malware scanning and hack recovery included by default? Get started with UNITY.

← Back to blog