What Are the Signs a WordPress Site Was Hacked?
Why These Signs Matter
Most WordPress compromises aren't immediately obvious — attackers often prefer staying hidden to maximize how long they can exploit the access, whether for spam injection, malware distribution, or using the server's resources. That's why the warning signs tend to be indirect (a ranking drop, a flagged site) rather than something dramatic and immediately visible.
Specific Things to Check
- An unfamiliar user account, particularly one with Administrator role, that nobody on the team created — check Users regularly, not just when something already seems wrong.
- A browser warning or a flag in Google Search Console about malware or a security issue, which are often the first external signal something is wrong.
- Unexplained ranking or traffic drops, sometimes from search engines detecting spam content or malicious redirects injected into the site.
- Unfamiliar files in the WordPress directory, particularly in uploads folders (which shouldn't contain PHP files at all) or oddly named files in the plugins/themes directories.
- Content behaving differently for different visitors — a classic technique where malware shows spam/malicious content to search engine crawlers or specific referrers while showing the normal site to a site owner checking directly, specifically to delay detection.
- Unexpected outgoing emails or server resource usage reported by the hosting provider, sometimes the first sign the server itself is being used to send spam.
If You Spot Any of These
- Don't ignore an isolated single sign — investigate promptly rather than waiting to see if more accumulate.
- Run a proper malware scan covering files and database, not just a surface-level plugin check.
- Follow proper containment and cleanup steps if compromise is confirmed, covered in more detail elsewhere.
Suspect your site may be compromised and need it checked urgently? See WordPress bug fix.