Signs Your WordPress Site Has Been Hacked, and What to Do First

The short answer: the most common signs of a hacked WordPress site are spam pages or links you didn’t create, visitors being redirected to other sites, admin users you don’t recognize, and warnings from Google or your host. If you see any of them, don’t delete things at random. Take a backup of the site as it is, change every password, and then clean it properly. That means finding every backdoor, not just the visible damage.

Most hacked small-business sites aren’t defaced with a dramatic message. They’re used quietly, to host spam, redirect visitors, or send email, often for weeks before anyone notices. Knowing what to look for is most of the battle.

What are the signs a WordPress site has been hacked?

• Spam in search results. Search site:yourdomain.com on Google. Pages about pills, casinos, or knock-off products, often in other languages, are a classic sign.
• Redirects. Visitors land on a scam page instead of your site. This sometimes happens only on mobile, or only when arriving from Google, so you may not see it yourself.
• Admin users you don’t recognize. Check Users in your dashboard. A new administrator account is a serious red flag.
• Warnings. A “This site may be hacked” label in Google, a browser warning page, or a message in Google Search Console’s Security Issues report.
• Host notices. Your hosting company suspends the account or warns you about malware or outgoing spam.
• Odd behaviour. The site is suddenly slow, the dashboard looks different, or files appear that nobody added.

What should I do first?

1. Don’t panic-delete. Removing random files can break the site and destroys the trail that shows how the attacker got in.
2. Back up the site as it is. Yes, the hacked version. It’s your safety net and your evidence.
3. Change every password. All WordPress admins, your hosting account, SFTP/FTP, and the database. Use new, unique passwords, and turn on two-factor login wherever you can.
4. Check your users. Remove any account you don’t recognize, after noting its details.
5. Get help if the site matters to your business. A half-done cleanup is often worse than none, because it leaves you thinking you’re safe.

Why isn’t deleting the bad files enough?

Because attackers expect you to find the obvious damage. Once they’re in, they usually leave several ways back: hidden admin accounts, small “backdoor” files tucked among legitimate ones, or code injected into a theme or plugin. If even one survives, the site gets reinfected days or weeks later, often in a slightly different way.

In a cleanup I handled recently, the visible problem was just the start. There were several separate backdoor files and a hidden administrator account. Removing the spam alone would have left the attacker with at least three ways back in.

What does a proper cleanup involve?

• Finding how the attacker got in, usually an outdated plugin or a reused password, and closing that gap
• Comparing WordPress core, theme, and plugin files against clean copies, and replacing anything modified
• Searching the uploads folder and database for injected code and spam content
• Removing rogue users and resetting every credential
• Updating everything and removing plugins that aren’t used
• Asking Google to review the site once it’s clean, if it was flagged in Search Console

If you have a clean backup from before the hack, restoring it can be a good shortcut. But you still need to close the hole that let the attacker in, or it’ll happen again.

How do I stop it happening again?

Most WordPress hacks come through outdated plugins and weak or reused passwords. The prevention is unglamorous: keep everything updated, remove what you don’t use, use strong unique passwords with two-factor login, and keep daily backups you can actually restore. I go into the update side in what happens if you don’t update WordPress.

That routine is exactly what PowerUp’s Maintenance plan covers, with updates, security monitoring, and a monthly report, for $50/month. Daily backups come with Hosting.

If you think your site has been hacked right now, get in touch. You’ll hear back from me, usually the same day.