Most WordPress hacks are not loud. Defacements make headlines, but the typical compromise is quiet on purpose: a backdoor that keeps access open, spam pages served only to Google, a card skimmer that skims and stays hidden. The average site owner finds out weeks later, from a browser warning, a hosting suspension email, or a customer complaint.
The earlier you catch it, the smaller the damage. This guide covers the warning signs that a WordPress site has been hacked, then walks through a systematic check with WordSec to confirm or rule out an infection.
12 warning signs your WordPress site may be hacked
Any one of these deserves investigation. Two or more together mean you should assume compromise until proven otherwise.
- Google results you do not recognize. Search
site:yourdomain.comand look for pharmacy spam, casino pages, or Japanese keyword pages you never wrote. - Redirects to strange domains, sometimes only on mobile, or only from search results.
- Browser or search warnings like "This site may be hacked" or "Deceptive site ahead".
- Admin users you did not create. Check Users, filter by Administrator, and question every account.
- Files changing on their own. Modified core files, or new PHP files in
wp-content/uploads. - A sudden traffic pattern change: spikes to pages that do not exist, or a collapse in organic traffic after a spam injection gets your rankings penalized.
- The site got slow overnight with no plugin or content change. Malware that sends spam or mines resources consumes your server.
- Your emails land in spam or your IP appears on blocklists, a classic sign the server is sending spam without you.
- New plugins or themes you never installed, or a plugin folder with a slightly wrong name.
- Login trouble: your password stops working, or password reset emails go missing.
- Popups, ads, or content you never added, sometimes shown only to logged-out visitors.
- Hosting provider warnings about malware, abuse reports, or resource overuse.
Seeing none of these does not guarantee you are clean, which is why the confirmation steps below are worth running on a schedule, not just in a crisis.
Step 1: Run a full malware scan
Install WordSec if it is not already on the site, then open the Scanner module and run a full scan. WordSec scans in seven stages: file integrity, version checks, permissions and ownership, leftover backup and log files, malware signatures, scheduled cron tasks, and the database. That breadth matters here, because infections rarely live in just one place.
The malware stage checks your files against 117 detection rules, and every finding lands in a report where you can act on it directly. If the scan flags files, do not panic and do not start deleting yet, first build the full picture with the steps below.
Step 2: Read the file integrity results carefully
The file integrity stage compares your WordPress core files against the official originals and reports added, deleted, and changed files. This is the single most reliable hack indicator there is:
- A modified
wp-settings.phporindex.phpis a red alert. - Unknown PHP files in
wp-content/uploadsare almost always malicious, uploads should contain media, not code. - Files with names imitating real ones, like
wp-l0gin.php, are attacker droppings.
For any suspicious file, WordSec lets you view the flagged content safely from the dashboard and check it on VirusTotal for a second opinion, without opening the file on the server. The deep dive on this topic is in How to Find Malicious Files in WordPress.
Step 3: Audit your users and sessions
Attackers who get in want to stay in, and a spare admin account is the easiest persistence there is.
- Review every administrator account in Users. Delete anything you cannot explain.
- In WordSec's Login Security module, check the session management view and terminate sessions you do not recognize.
- Check the login attempt logs for successful logins from unexpected countries or at odd hours.
Step 4: Reconstruct events with the Audit Log
The Audit Log module answers the question every incident response starts with: what happened, and when? WordSec tracks 14 action types across 11 object types, including logins, user creation, plugin installs and activations, file uploads, and settings changes.
Scan the timeline around the date things went wrong. A typical compromise reads like a story in the log: a login at 3 AM, a new user created, a plugin uploaded, options updated. That chain also tells you the entry point, which you will need to close.
Step 5: Watch Live Traffic for active abuse
Open Live Traffic and watch requests hitting the site in real time. Signs to look for:
- Repeated POST requests to a single strange PHP file: that is likely a webshell being used right now.
- Bursts of requests to pages that should not exist.
- One IP touching many URLs in sequence: scanner behavior.
You can also browse historical traffic and inspect request and response content safely, which helps confirm what a suspicious endpoint actually does. If you find an active attacker IP, ban it on the spot from the Blocking module.
Step 6: Check how they got in
Most WordPress hacks enter through one of two doors: a vulnerable plugin or theme, or a weak login. Check both:
- Open the Supply Chain Security module and review every plugin and theme: known vulnerabilities, abandoned projects, and outdated versions. Cross-reference anything suspicious against the WordPress vulnerability database.
- Review the login logs from Step 3 for brute-force patterns before the incident date.
Real-world example: the wp2shell pre-auth RCE campaign compromised sites through a vulnerable plugin within days of disclosure. Sites with vulnerability alerts knew immediately; sites without found out from their infections.
Step 7: Check your external reputation
WordSec's security toolbox includes a blacklist and reputation check that queries whether your domain or server IP appears on abuse blocklists, plus an email deliverability test. Both matter after a hack: spam-sending malware gets your IP listed fast, and delisting is part of cleanup.
Confirmed hacked? Move to cleanup
If the evidence stacks up, shift from detection to removal. Follow How to Scan and Remove Malware from WordPress for the full cleanup process. The short version: quarantine or delete flagged files (WordSec supports quarantine, delete, and restore, so mistakes are reversible), remove rogue users, update everything, and rotate every password. WordSec's Argon2 password hashing with salt rotation means you can invalidate stolen credentials in one action.
Make sure you hear about the next one immediately
Detection you have to remember to do is detection that eventually fails. Two settings close that gap:
- Scheduled scans in the Scanner module keep the seven-stage check running automatically.
- The Alarm module pushes real-time alerts to email, Telegram, or Slack across 36 event types, including admin logins, new admin users, and file-related security events. An unknown admin login at 3 AM should be a phone notification, not a surprise three weeks later.
Frequently asked questions
How do I check if my WordPress site is hacked?
Run a full multi-stage scan, review file integrity results against the official core files, audit administrator accounts and active sessions, and read the audit log around any suspicious date. WordSec performs the scan, integrity, log, and session checks from one dashboard on the free plan.
Can a WordPress site be hacked without any visible signs?
Yes, and the profitable hacks are built that way. Backdoors, SEO spam shown only to crawlers, and card skimmers all avoid visible changes. That is why file integrity monitoring and scheduled scans matter: they catch what your eyes cannot.
What is the most common way WordPress sites get hacked?
Vulnerable plugins and themes are the leading entry point, followed by weak or reused passwords on the login. Supply chain monitoring covers the first, and brute-force protection with 2FA covers the second.
Should I delete suspicious files immediately?
Quarantine first, delete later. Quarantining disarms the file while keeping it restorable in case a plugin legitimately needed it. WordSec's scanner offers quarantine, delete, and restore actions per finding.
How often should I scan my site?
Daily, on a schedule. Attackers automate their side, so detection has to be automated too. WordSec's scheduled scans plus real-time Alarm notifications mean the gap between infection and discovery shrinks from weeks to minutes.
Do not wait for the browser warning: install WordSec, run your first full scan today, and put the WordPress Security Checklist 2026 into practice so the next attack finds a closed door.