Is my WordPress site hacked? Signs and fixes

Published 14 Oct 2026

WordPress runs a large share of the web, which makes it a constant target for automated attacks. Most hacks don't happen because someone picked your site. A bot found an outdated plugin or a weak password and used it. Here is how to tell if it has happened to you and what to do about it.

Signs your site may be hacked

  • Visitors get redirected to spam, gambling or fake prize pages, often only on mobile or only when they arrive from Google. This makes it easy to miss when you visit the site directly.
  • Strange search results. Search site:yourdomain.com and look for pages you never created, often in other languages or selling pharmaceuticals, replica goods or loans.
  • Browser or Google warnings. Chrome shows a red "Deceptive site ahead" screen, or Google adds "This site may be hacked" under your listing.
  • Admin users you don't recognise under Users in the dashboard.
  • Your host suspends the site or emails you about malware or high resource use.
  • Emails from your domain bounce or land in spam, because the server is being used to send spam.
  • Unfamiliar files in your hosting file manager, such as random-looking PHP files in the uploads folder.
  • The site suddenly slows down or uses far more server resources than usual.

One sign on its own isn't proof. A slow site is usually just a slow site. But redirects, spam pages and unknown admin accounts are strong indicators.

How to confirm it

  1. Run your address through a free external scanner such as Sucuri SiteCheck. It checks for known malware and blocklisting.
  2. Check the Google Safe Browsing status for your domain.
  3. If you have Google Search Console, look at the Security Issues report.
  4. Install a security plugin such as Wordfence and run a full scan. It compares your core files with the official WordPress versions and flags changes.

What to do if it is hacked

Work through these in order. Don't skip the backup, even though the backup contains the infection, because you may need it for comparison later.

  1. Take a full backup of files and database as they are now.
  2. Change every password: hosting, FTP or SFTP, database, WordPress admin accounts and the email account linked to the site. Do this from a computer you trust.
  3. Remove unknown admin users.
  4. Replace WordPress core files with fresh copies. In the dashboard, go to Updates and choose "Re-install version". This replaces core files without touching your content.
  5. Reinstall plugins and themes from the official sources rather than cleaning them. Delete any you don't use. Delete any "nulled" or pirated premium plugins entirely, since these are a common way malware gets in.
  6. Clean the uploads folder. It should contain images and documents, not PHP files. Any .php file in wp-content/uploads deserves a close look.
  7. Check the database for injected scripts in posts, options and widgets. Search for <script and unfamiliar domain names.
  8. Generate new security keys in wp-config.php, which logs everyone out.
  9. Scan again to confirm the site is clean.
  10. Request a review in Search Console if Google flagged the site, so the warning is removed.

Cleaning a site properly is fiddly. If you miss one backdoor file, the attacker can get straight back in, often within days. If the site keeps getting reinfected, that is usually why.

How to stop it happening again

  • Keep everything updated. Outdated plugins are the most common way in. Turn on automatic updates for plugins you trust, or check weekly.
  • Use fewer plugins, and only from developers who still maintain them.
  • Use strong, unique passwords and turn on two-factor authentication for every admin account.
  • Don't use "admin" as a username.
  • Keep off-site backups that run automatically, so you can restore a clean copy.
  • Use a host that isolates accounts and runs a supported version of PHP.

Hacked sites often slow down too. If yours still feels sluggish after a clean-up, see why websites are slow. And if Google dropped your pages during the hack, this guide to getting back on Google will help.

Not sure where to start?

The free CrawlCare scan checks security headers, HTTPS, mixed content and broken links from the outside, and tells you what your site is built with. It won't replace a malware scan, but it gives you a quick picture of the basics. If you would rather someone else handled the clean-up, our services page explains how hack repairs work.

Further reading