Quick answer: Signs your WordPress site has been hacked include Google Safe Browsing warnings, unknown admin accounts in wp-admin → Users, modified functions.php, PHP files inside /wp-content/uploads/, unexpected redirects, and sudden traffic drops. Confirm with the Google Safe Browsing Transparency Report, scan with WPScan or Wordfence, and check functions.php for obfuscated base64 code.
A client messaged me on a Friday evening: "Something feels off with my site. Pages are loading slowly and Google is showing a warning when people search for us." Twenty minutes later I was looking at a WordPress installation that had been silently compromised for eleven days. The attacker had injected a pharma spam redirect into the theme's functions.php, planted a PHP webshell in the uploads folder, and added a backdoor admin account — all while the site kept "working normally" on the surface.
This is the most common pattern I see. WordPress sites get hacked and the owner has no idea for days, weeks, sometimes months. By the time it's discovered, the damage is done: SEO rankings destroyed by Google's spam classifier, blacklisting by web hosts, and customer trust eroded. This post tells you exactly how to check whether your WordPress site has been hacked, what the signs look like, and what to do about it.
Warning Signs Your WordPress Site Has Been Hacked
1. Google Is Showing a Security Warning
If people searching for your brand see "This site may be hacked" or "Deceptive site ahead" in Chrome, you have a confirmed problem. Google's Safe Browsing system has flagged your site for malware, phishing, or spam content.
Check immediately: Google Safe Browsing Transparency Report — enter your domain and it shows any active warnings within seconds.
2. Your Hosting Provider Suspended the Account
Shared hosts scan for malware automatically. If your site shows a suspension page or you received an email from your host about "malicious content," the malware is already confirmed. Don't restore from a backup immediately — first identify what got in, or it will happen again.
3. Unexpected Redirects
If visitors are being sent to pharmacy sites, adult content, or fake tech support pages — especially on mobile but not desktop — you have a mobile redirect hack. Attackers target mobile visitors specifically because site owners usually test on desktop.
To test: use your phone on mobile data (not your office WiFi), clear browser cache, and visit your site. Then check via Google's Mobile-Friendly Test which renders your page as Google would see it.
4. New Admin Accounts You Didn't Create
Log into WordPress → Users → All Users. If you see admin accounts with names like admin1, admin2, random strings, or addresses you don't recognize — your site is compromised. Attackers create backdoor accounts to maintain access even after you change your password.
5. Your Site Is Sending Spam Email
Your hosting provider will often flag this first. Signs include:
- Bounce messages from addresses you didn't email
- Customers receiving spam claiming to be from your domain
- Your domain appearing on email blacklists
Check your domain against MXToolbox Blacklist Checker.
6. Google Search Console Shows Manual Actions or New URLs
Check Google Search Console → Security & Manual Actions → Manual Actions. A manual action means a Google reviewer has confirmed spam or malware. Also check Coverage → Excluded — if you see hundreds of URLs you didn't create (pharma keywords, foreign-language spam pages), those have been injected by attackers.
7. Your Site Loads Slowly or Has Unusual Server Load
Malware often runs crypto miners, sends spam, or participates in DDoS botnets in the background. Sudden increases in CPU usage in your hosting control panel — without corresponding traffic increases — are a red flag.
How to Check If Your WordPress Site Is Hacked
Step 1: Run an External Malware Scan
Before touching anything, get an objective external assessment:
- Sucuri SiteCheck (free): sitecheck.sucuri.net — scans your public-facing pages for malware signatures, blacklist status, and outdated software
- VirusTotal: enter your domain at virustotal.com — checks against 90+ security vendors simultaneously
- Google Safe Browsing: transparencyreport.google.com/safe-browsing/search
External scanners only see what's publicly visible. They'll catch injected scripts, redirects, and defacement but they miss malware that only activates under specific conditions (logged-out mobile users, referral from Google, etc.).
Step 2: Check Your Files via cPanel or SSH
Log into cPanel → File Manager or connect via SSH. Look for:
Recently modified files — attackers always modify or create files. In File Manager, sort by "Last Modified." If core WordPress files like wp-login.php, wp-includes/functions.php, or anything in wp-admin/ was modified recently and you didn't do it, that's your smoking gun.
Via SSH:
# Files modified in the last 7 days
find /home/youraccount/public_html -name "*.php" -mtime -7 -ls
# PHP files in uploads folder (should never be there legitimately)
find /home/youraccount/public_html/wp-content/uploads -name "*.php"
# Files containing common malware strings
grep -rl "eval(base64_decode" /home/youraccount/public_html/
grep -rl "preg_replace.*\/e" /home/youraccount/public_html/
grep -rl "\$_POST\['cmd'\]" /home/youraccount/public_html/
PHP files in the uploads directory are almost always malicious — WordPress has no legitimate reason to put PHP there.
Step 3: Scan With a WordPress Security Plugin
Wordfence (free tier) runs a file integrity check against the official WordPress repository — it flags any core or plugin file that doesn't match what it should be:
- Install Wordfence → Scan → Start New Scan
- Review results: "Files Added by WordPress" and "Files Modified in WordPress Core" are the critical sections
MalCare is faster for large sites and uses server-side scanning so it doesn't slow your site.
Step 4: Check Your Database for Injected Content
Attackers frequently inject spam links or malicious JavaScript into your database — posts, options, widget content. The WP Admin panel won't show these obviously because they're hidden in serialized data or conditionally displayed.
Via phpMyAdmin in cPanel:
-- Check wp_options for suspicious URLs or scripts
SELECT option_name, option_value FROM wp_options
WHERE option_value LIKE '%<script%'
OR option_value LIKE '%eval(%'
OR option_value LIKE '%base64%';
-- Check wp_posts for spam links
SELECT ID, post_title, post_content FROM wp_posts
WHERE post_content LIKE '%viagra%'
OR post_content LIKE '%cialis%'
OR post_content LIKE '%casino%'
LIMIT 50;
Step 5: Review Admin Users and Recent Logins
# List all WordPress admin users via WP-CLI
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
# Check recent failed logins (if using a security plugin that logs them)
wp db query "SELECT user_login, user_registered FROM wp_users ORDER BY user_registered DESC LIMIT 10;"
Any admin account you didn't create needs to be deleted immediately. Change all other admin passwords before deleting them, or the attacker's account may automatically recreate itself via a backdoor.
Confirmed Hacked — What to Do Now
1. Take the Site Offline Temporarily
Put your site in maintenance mode or have your host suspend it. This prevents:
- Further spread of malware to visitors
- Continued damage to your SEO reputation
- Attackers continuing to use your server for their operations
2. Change Everything
Before cleaning:
- WordPress admin passwords (all users)
- Hosting cPanel/WHM password
- FTP/SFTP credentials
- Database password (and update
wp-config.php) - SSH keys — audit and remove any you don't recognize
3. Clean or Restore
Option A — Restore from a clean backup: If you have a backup from before the compromise, restore it. Then immediately update WordPress, all plugins, and themes to current versions before going live again. If you restore without updating, you'll be re-infected through the same vulnerability within days.
Option B — Manual clean: If you don't have a clean backup or the backup is also compromised:
- Download fresh copies of WordPress core from wordpress.org and overwrite your core files (do not touch
wp-content/) - Delete and reinstall all plugins from official sources
- Replace theme files from the original source — do not trust your existing theme files
- Manually scan and clean
wp-content/uploads/— delete any PHP files found there - Clean the database of injected content
For professional cleanup, my team at XURO.NET handles WordPress malware removal including identifying the original entry point and patching it.
4. Identify and Patch the Entry Point
Cleaning without finding how they got in means you'll be reinfected. Common entry points:
- Outdated plugin with known CVE: Check your installed plugin versions against the WPScan Vulnerability Database — this is the #1 cause
- Compromised admin credentials: Brute force or credential stuffing attack — a password that was leaked in another breach
- Nulled/pirated plugins or themes: These almost always contain backdoors by design
- Vulnerable hosting configuration: Outdated PHP version, world-writable directories, weak file permissions
# Check PHP version (should be 8.1+ minimum)
php -v
# Check for world-writable directories
find /home/youraccount/public_html -type d -perm -o+w
# Check wp-config.php permissions (should be 600 or 640)
ls -la /home/youraccount/public_html/wp-config.php
5. Harden Before Going Back Online
Once clean, implement these before you relaunch:
- Install a security plugin: Wordfence or iThemes Security for real-time firewall and login protection
- Enable two-factor authentication on all admin accounts
- Limit login attempts — 5 failures should trigger a temporary lockout
- Move
wp-adminto a non-default URL or restrict access by IP - Set proper file permissions: directories 755, files 644,
wp-config.php600 - Enable automatic updates for minor WordPress releases
- Set up daily malware scanning with email alerts
6. Submit for Google Review
If Google flagged your site, you need to request a review after cleaning. In Google Search Console → Security & Manual Actions → Manual Actions → Request Review. Be specific about what you found and what you fixed. Google typically reviews within 1–3 days.
For blacklisting from other providers: Sucuri Blacklist Removal Guide covers the major blacklists and their review processes.
How Long Does Google Take to Remove the Warning?
After a successful manual action review in GSC, Google typically removes the "This site may be hacked" warning within 24–72 hours. Safe Browsing warnings in Chrome can take up to a week to clear globally as the list propagates to all users.
During this period your organic traffic will be severely impacted — users see the warning and most don't proceed. This is why fast response matters.
How to Prevent This From Happening Again
The majority of WordPress compromises are entirely preventable. These are the controls that actually matter:
Updates: 60%+ of WordPress infections exploit known vulnerabilities in outdated plugins. Enabling auto-updates for plugins, themes, and minor WordPress core releases eliminates most of this attack surface.
Backups: Daily backups stored off-site (not just on your hosting account). If your host is compromised, local backups are also compromised. Services like UpdraftPlus to Google Drive or Amazon S3 work well.
Monitoring: Get email alerts when core files change, new admin users are created, or the site goes down. Wordfence's free tier covers most of this.
Hosting quality: Shared hosting accounts on servers without PHP isolation mean one compromised site can infect every site on that server. CloudLinux with CageFS, or managed WordPress hosting with proper isolation, prevents cross-account contamination.
Passwords: Every admin account should use a unique, randomly-generated password of 20+ characters. A password manager makes this practical. Credential stuffing — attackers trying passwords from other breached sites — is a growing attack vector.
FAQ
How do I check if my WordPress site is hacked?
Start with three free external scans: run Sucuri SiteCheck, check the Google Safe Browsing Transparency Report, and look at Google Search Console → Security & Manual Actions. Then check inside: log into wp-admin → Users for admin accounts you didn't create, sort your files by "Last Modified" in cPanel, and look for PHP files in wp-content/uploads/. If any of those turn something up, treat the site as compromised and follow the cleanup steps above.
How do I know if my WordPress site has been hacked if it looks fine?
A site that looks normal to you can still be hacked — many attacks hide from the logged-in admin. Test from a fresh browser on mobile data (not your office WiFi) to catch mobile-only redirects, check for a sudden traffic drop in analytics, watch for unexpected CPU spikes in cPanel, and confirm your domain isn't on an email blacklist with MXToolbox. Run an external scan regardless of how the site looks.
I found malware. Should I just delete everything and reinstall?
Only if you have a clean backup. Deleting without a backup means losing your content. If you don't have a backup, you'll need to manually clean the infection — which requires correctly identifying all affected files and database entries. Incomplete cleanup leaves backdoors that re-infect you immediately.
My host removed the suspension but said they cleaned it. Is that enough?
Hosts typically remove the specific malware files they detected but don't perform comprehensive forensic analysis. They identify the symptom but rarely the root cause. You should still audit admin users, check for backdoors in wp-content/uploads/, verify all core files, and identify the original entry point — even if the host says the site is clean.
How much does professional WordPress malware removal cost?
Typical rates run $150–$500 for a single site cleanup depending on complexity. Ongoing security management (which prevents future incidents) runs $50–$200/month. The cost of cleanup is always less than the cost of extended downtime, lost rankings, and customer trust damage.
Key Takeaways
- Run Sucuri SiteCheck and check Google Safe Browsing before doing anything else
- Check for PHP files in
wp-content/uploads/— these are almost always malicious - Search your database for spam keywords and injected JavaScript
- Look for admin accounts you didn't create and delete them immediately
- Change all credentials — WordPress, cPanel, FTP, SSH — before cleaning
- Identify the entry point before going back online or you'll be reinfected
- Request a Google manual action review after confirming the site is clean
- Enable auto-updates and daily malware scanning to prevent recurrence
- Store backups off-site — if your host is compromised, on-server backups are too
I'm Zahid Abbasi — cPanel- and LiteSpeed-certified, 15+ years cleaning up and hardening WordPress sites. The full version of this guide with more detail lives on xuro.net. If your site's compromised and you need help now, reach out here.
Top comments (1)
Hi, I saw your post about checking if your WordPress site is hacked. I'd be happy to help you explore options for securing your site. Clypify can help you streamline your content workflow and optimize your posts for better visibility. Free plan at clypify.com — no card needed.