Is My WordPress Site Hacked? 9 Signs and What to Do First

Many small‑business owners notice strange spam links, unexpected redirects, or a Google warning and wonder if their WordPress site has been compromised.

The quickest answer is yes, those are classic hack signs, and you should act now to stop the attack and begin recovery.

How to recognize a hacked WordPress site

Before running any security tools, perform a quick visual inspection of the front‑end and back‑end of the site. A hacked installation often shows obvious anomalies that can be spotted in a few minutes, allowing you to decide whether an immediate shutdown is required.

1. Unknown administrator accounts

Log in to /wp‑admin and open the Users list. If you see accounts you never created—especially ones with the “Administrator” role—this is a strong indicator of compromise. Attackers add their own accounts to maintain persistent access.

2. Unexpected file changes

Compare the current file tree with a clean backup or the original theme/plugin package. Look for new PHP files in /wp‑content/uploads or modified core files such as functions.php. Even a single unknown script can execute malicious code.

3. SEO spam and hidden content

View the page source of several public pages. If you notice invisible text, keyword‑stuffed paragraphs, or links to unrelated domains, the site is likely being used for SEO spam. Search engines may index these hidden sections, harming your ranking.

4. Strange redirects

Navigate to a few internal URLs and watch the address bar. Unexpected redirects to gambling, pharmaceutical, or adult sites are classic signs of a hijack. The redirection may be triggered by JavaScript injected into the header or by .htaccess rules.

5. Google Safe Browsing warnings

Open the site in a fresh browser or use the Google Safe Browsing lookup. If Google displays a “This site may be dangerous” banner, the platform has already flagged malicious activity.

6. Sudden traffic spikes from unknown sources

Check the analytics dashboard for a surge in visits from countries you do not normally serve. Bot traffic often accompanies a compromise, as attackers use the server to launch further attacks or host phishing pages.

7. Unusual server resource usage

Log into the hosting control panel or SSH console and run top or htop. A hacked WordPress site may show high CPU or memory consumption caused by cryptominers, spam bots, or brute‑force scripts running in the background.

8. Modified database entries

Access phpMyAdmin or a similar client and inspect the wp_options table. Look for entries like siteurl or home that have been changed to unfamiliar domains, or new rows that store malicious JavaScript payloads.

9. Email notifications you didn’t request

WordPress sends alerts for password resets, new user registrations, and plugin updates. If you receive messages for actions you never performed, the attacker may be using the site to harvest credentials or to send spam through your mail server.

Identifying any of these nine symptoms should trigger an immediate response: isolate the site, change all passwords, and begin a thorough cleanup. If you need professional assistance, contact us through the contact page for a fixed‑price security audit.

Why WordPress is a common target for attackers

Massive market share creates a big attack surface

WordPress powers roughly one third of all websites on the public internet. That share translates into millions of installations that share the same core codebase, database schema, and default file structure. Attackers therefore focus on WordPress because a single exploit can affect thousands of sites without needing to research each target individually.

The platform’s popularity also means that many hosting providers, small businesses, and hobbyists deploy WordPress with minimal hardening. When a site runs on a shared server or uses default admin credentials, the barrier to entry for an attacker drops dramatically.

Frequent plugin and theme updates introduce new vulnerabilities

WordPress’s extensibility relies on thousands of third‑party plugins and themes. Each component adds its own PHP code, JavaScript, and database queries. Developers release updates regularly to add features or patch security flaws, but site owners often postpone those updates to avoid breaking customizations.

Outdated plugins become a common entry point. For example, a plugin that interacts with an external API may retain an old version of a library with a known remote code execution bug. If the site’s administrator has not applied the latest patch, an attacker can inject malicious payloads through the vulnerable endpoint.

Open‑source nature can be a double‑edged sword

Because WordPress is open source, its source code is publicly available. Security researchers and attackers alike can audit the code, discover weaknesses, and publish proof‑of‑concept exploits. While this transparency helps the community improve security, it also gives malicious actors a clear roadmap.

Moreover, many developers publish plugins on public repositories without rigorous code review. Some plugins may contain insecure functions, hard‑coded credentials, or backdoors left unintentionally. When such plugins are installed on a live site, they effectively open a backdoor for automated scanning tools that probe for known signatures.

Configuration drift and legacy installations

WordPress sites often evolve over years, accumulating legacy code, custom modifications, and abandoned plugins. As the underlying PHP version or server operating system is upgraded, older components may become incompatible, prompting administrators to disable security patches rather than rewrite code.

This “configuration drift” creates hidden entry points that are difficult to detect without a systematic audit. Attackers exploit these gaps by scanning for known file paths (e.g., wp-content/uploads with executable permissions) or by brute‑forcing weak admin passwords that were never updated after the initial setup.

Tip: Before installing any new plugin, check its last update date and read recent reviews. If the plugin hasn’t been updated in over a year, consider an alternative or test it on a staging environment first.

Understanding why WordPress attracts attackers helps you prioritize defenses. Regularly updating the core, plugins, and themes, removing unused extensions, and hardening server configurations are the first lines of protection. If you need assistance with a migration to a more secure stack, Qubitpage offers a free website check and can move your site to its CarphaCom platform, which avoids third‑party WordPress plugins altogether.

First steps to take when you suspect a hack

When you notice unusual behavior—unexpected redirects, unknown admin accounts, or sudden traffic spikes—act quickly. The following checklist limits damage, preserves evidence, and prepares the site for a thorough investigation.

1. Put the site into maintenance mode. Activate a simple HTML maintenance page via your hosting control panel or by adding a .maintenance file to the root directory. This stops visitors and search engines from interacting with potentially compromised pages while you work.
2. Isolate the environment. If you use a VPS or dedicated server, block external traffic with a firewall rule that only allows your IP address. For shared hosting, switch the DNS A‑record to point to a temporary “holding” server that serves the maintenance page, ensuring the live site cannot be reached.
3. Change every password immediately. Update passwords for the WordPress admin account, database user, FTP/SFTP accounts, and any associated cloud services. Use a password manager to generate strong, unique strings and store them securely.
4. Revoke all active sessions. In the WordPress dashboard, go to Users → Your Profile and click “Log Out Everywhere.” This forces all logged‑in users—including potential attackers—to re‑authenticate with the new credentials.
5. Backup the current state. Create a full file system snapshot and a database dump. Store the backup off‑site (e.g., on an encrypted external drive or a separate cloud bucket). The backup serves as forensic evidence and a fallback if cleanup fails.
6. Scan for known malware signatures. Run a quick command‑line scan with grep for suspicious strings such as eval(base64_decode or wp‑config modifications. This gives you an initial view of infected files before deeper analysis.
7. Contact a security specialist. Reach out to a professional service—such as Qubitpage’s custom software development team—via the contact form. Provide the backup, a brief timeline of observed anomalies, and any error logs you have collected.
8. Document every action. Keep a log of the steps you performed, timestamps, and any changes made. This documentation helps the specialist understand the attack vector and is useful for post‑incident reporting.

Following this checklist buys you time, prevents further exploitation, and equips the expert you contact with the information needed for a swift, thorough remediation.

How to scan and clean malware from your WordPress files

Use a reputable scanning tool

Start by running a server‑side scanner that can read the entire file system. Tools such as ClamAV or the commercial Maldet package are common choices because they operate directly on the host and do not rely on WordPress plugins that might already be compromised. Install the scanner via SSH, update its signature database, and execute a recursive scan of the public_html directory. The command line output will list any files that match known malware signatures, along with their paths and severity levels.

When the scan finishes, quarantine the flagged files in a separate folder instead of deleting them immediately. This lets you verify false positives later and provides a safety net if a core WordPress file is mistakenly marked.

Manual file comparison

After the automated scan, compare the current WordPress core files with a clean reference copy. Download the exact version of WordPress you are running from wordpress.org, extract it on your local machine, and use a diff utility (for example diff -r on Linux or WinMerge on Windows) to compare each file in wp-includes and wp-admin against the reference.

Any differences that are not part of a legitimate customization—such as added code at the top of wp-config.php or unknown PHP files in wp-content/uploads—should be examined closely. Remove or replace altered core files with the clean versions from the reference package. For theme and plugin directories, repeat the diff process against the original theme/plugin archives you obtained from their developers.

Restore from a clean backup

If you maintain regular backups, restoring the site is often faster and safer than trying to clean every infected file manually. Locate the most recent backup taken before the suspicious activity began. Using your hosting control panel or a command‑line tool like rsync, overwrite the compromised directory with the backup contents.

After the restore, run the scanner again to confirm that no malicious remnants remain. Finally, change all passwords (WordPress admin, database, FTP/SFTP) and regenerate the authentication salts in wp-config.php to invalidate any stolen credentials.

Tip: Keep a copy of the clean WordPress core on your server (e.g., in /var/www/wordpress-clean) and schedule a nightly diff check. This early warning system catches unauthorized file changes before they can cause damage.

When to use Qubitpage’s website repair service

If the infection is extensive, if you lack command‑line access, or if you prefer to delegate the technical work, Qubitpage offers a dedicated website repair service. Starting at 149 €, the service includes a full security audit, malware removal, and a hardening step that replaces compromised files with clean versions. The team also configures daily backups and DDoS protection as part of the managed hosting package.

Contact Qubitpage via the contact page to request a free website check and receive a fixed quote before any work begins.

Comparing DIY cleanup vs. professional help

When a WordPress site shows signs of compromise, the first decision is whether to tackle the problem yourself or to enlist a specialist. The choice influences how quickly the site is restored, how much you spend, and the likelihood of a clean, lasting fix. Below is a practical comparison that highlights the trade‑offs.

DIY cleanup relies on publicly available tools, community guides, and personal troubleshooting. It can work for simple infections, but it demands time, a solid grasp of server basics, and the discipline to follow each step without missing hidden backdoors. Professional help, such as Qubitpage’s website repair service, brings dedicated expertise, a proven workflow, and a guarantee that the site will be returned to a secure state.

If you have limited time, lack confidence with server commands, or need a guarantee that the site will not be compromised again, the professional route is usually faster and safer. Qubitpage’s repair service also bundles a security clean‑up with optional ongoing maintenance, which can be added via the contact page for a seamless handover.

For small, non‑critical blogs where budget constraints dominate, a DIY approach may be acceptable, provided you follow a strict checklist: back up the database, run a malware scanner, replace core files, and change all passwords. However, remember that missing a single malicious snippet can undo all effort, leading to repeated downtime and potential loss of visitor trust.

Ultimately, the decision hinges on your ability to allocate the necessary hours, your comfort with technical details, and the value you place on a rapid, reliable resolution. The table above offers a quick reference to weigh those factors before you act.

Preventing future WordPress hacks

Keep the core, themes and plugins up to date

WordPress releases security patches every few weeks. Schedule a weekly check or enable automatic updates for minor releases. When a theme or plugin receives a new version, apply it within 24 hours; many compromises exploit known vulnerabilities that have already been fixed.

Use strong, unique credentials

Replace the default “admin” username with a custom account name. Generate passwords of at least 12 characters that combine upper‑case, lower‑case, numbers and symbols. Store them in a reputable password manager and enable two‑factor authentication (2FA) for every user with dashboard access.

Deploy a dedicated security plugin

Install a reputable security extension that offers firewall rules, login‑attempt throttling and file‑integrity monitoring. Configure the plugin to block XML‑RPC requests unless they are required for a specific integration, and to limit access to the wp‑admin directory by IP address where possible.

Restrict file permissions and server access

Set directory permissions to 755 and file permissions to 644. Prevent PHP execution in the wp‑content/uploads folder by adding a .htaccess rule. If you use SSH, disable password authentication and rely on key‑based login only.

Choose managed hosting with built‑in hardening

Qubitpage’s managed hosting plans run on dedicated VPS instances in a European data centre and include SSL, daily backups, DDoS protection and continuous monitoring. The Business tier (29 €/month) already bundles the AI auto‑blog feature, while the Shop tier (45 €/month) adds e‑commerce‑specific safeguards such as secure payment gateway configurations. All plans receive automatic core updates and a weekly security scan, reducing the administrative burden on site owners.

Regular backups and quick restoration

Configure daily automated backups through Qubitpage’s hosting dashboard. Store at least two backup copies: one on the same VPS for rapid restores and another off‑site (e.g., an external S3 bucket). Test the restoration process quarterly to ensure that a clean version can be redeployed within an hour of a breach.

Monitor activity and limit exposure

Enable logging of admin logins, file changes and plugin installations. Review the logs weekly for unfamiliar IP addresses or sudden spikes in activity. If a site does not require XML‑RPC, disable it entirely in the functions.php file to eliminate a common attack vector.

Consider professional security audits

When a site handles sensitive data or high transaction volumes, a quarterly audit by a security specialist can uncover hidden risks. Qubitpage offers custom security assessments as part of its consultation service, ensuring that hardening measures align with the latest threat landscape.

By combining disciplined update routines, strong authentication, a reputable security plugin, and Qubitpage’s managed hosting environment, WordPress owners can dramatically lower the likelihood of future compromises.

Frequently asked questions

What does a Google Safe Browsing warning mean for my WordPress site?

A Google Safe Browsing warning appears when Google’s crawlers detect malicious code, phishing pages, or unwanted software on a site. The warning is shown in search results and can deter visitors, causing an immediate drop in traffic. It also signals that the site may be blacklisted, which can affect search rankings until the issue is resolved. Removing the offending content and requesting a review in Google Search Console are the first steps to clear the warning.

Can I remove hack code without losing my content?

Yes, you can clean a hacked WordPress installation while preserving posts, pages, and media. Start by backing up the database and the /wp-content folder, then replace core files with a fresh WordPress copy and delete unknown plugins or themes. Use a trusted security scanner to locate injected scripts, and manually delete them from the database or file system. After cleaning, reinstall legitimate plugins and themes, then run a final scan to confirm the site is clean.

How long does it take to restore a hacked WordPress site?

The restoration timeline depends on the severity of the breach and the availability of backups. A simple malware infection may be cleared in a few hours if you have a recent clean backup and know which files are compromised. More extensive compromises—such as database injections or backdoor accounts—can require several days of forensic analysis, code replacement, and security hardening. Planning for a short downtime window and communicating with users helps manage expectations.

Is it safe to use free security plugins on WordPress?

Free security plugins can provide basic protection, such as firewall rules, login throttling, and malware scanning, but they often lack advanced features like real‑time threat intelligence or premium support. For small blogs, a reputable free plugin may be sufficient, but larger or ecommerce sites should consider a paid solution that offers regular updates and dedicated monitoring. Always verify the plugin’s update frequency and reviews before installing.

When should I switch from WordPress to a Qubitpage‑built site?

Consider migrating if you need a fully custom e‑commerce solution, AI‑generated content, or a platform without third‑party WordPress plugins. Qubitpage’s CarphaCom platform builds sites with Next.js and MedusaJS, providing native integrations for Stripe, PayPal, and local Romanian couriers, and includes optional AI auto‑blogging. The migration is straightforward through the WordPress‑to‑CarphaCom service for a fixed fee, and the resulting site runs on a managed hosting plan with daily backups and DDoS protection.

Take action now to secure your site

Start by changing every password that grants access to your WordPress installation, including admin, FTP/SFTP, database, and hosting accounts. Use a password manager to generate unique, long phrases and enable two‑factor authentication wherever possible. Next, scan the file system with a reputable security plugin, delete any unknown files, and replace core WordPress files with fresh copies from the official repository.

Review the list of installed plugins and themes; deactivate and remove anything you no longer use or that hasn’t received updates in the last six months. Replace outdated components with actively maintained alternatives, and keep the remaining ones up to date through the dashboard or automatic updates.

Finally, harden your server configuration: enforce HTTPS with a valid SSL certificate, limit login attempts, and restrict file permissions to the minimum required. Schedule regular backups to a secure off‑site location and test restoration procedures monthly. These steps create multiple layers of defense that dramatically reduce the risk of a future breach.

Need a professional audit or a migration to a more secure platform? Explore Qubitpage’s website services for a fast, fixed‑price solution.