8 Signs Your WordPress Site Is Infected (and What to Do)
Not sure if your WordPress site is hacked? These 8 warning signs will tell you fast, plus exactly what to do next.
Your site is behaving strangely and you have a sinking feeling something is wrong. You are not overreacting. WordPress sites are targeted constantly, and infections often hide in plain sight for weeks before causing obvious damage. This checklist walks you through the 8 clearest signs your site has been compromised, what each one means, and what to do about it right now.
Sign 1: Google Is Showing a 'This Site May Be Hacked' Warning
If visitors see a red warning page from Google before reaching your site, Google's Safe Browsing system has flagged your domain for malware or phishing content. This is one of the most damaging signs because it stops traffic immediately. Check your own status at Google Safe Browsing. If you are flagged, you need to clean the site and then submit a review request through Google Search Console under Security Issues.
Sign 2: Your Hosting Provider Suspended Your Account
Reputable hosts scan for malware and will suspend accounts that are sending spam, hosting phishing pages, or consuming abnormal resources. A suspension email from your host is a strong signal of infection. Do not just ask them to reactivate the account. Ask them which files triggered the suspension, then clean those files before requesting reinstatement.
Sign 3: You Notice Unfamiliar Admin Accounts
Go to Users > All Users in your WordPress dashboard and look for administrator accounts you did not create. Attackers routinely add a hidden admin user so they can re-enter the site even after a surface-level cleanup. Delete any account you do not recognise. Then change the passwords on every remaining admin account and revoke any application passwords listed under your profile.
Sign 4: Your Site Is Redirecting Visitors to Spam Pages
Redirect hacks are among the most common WordPress infections. Visitors land on your URL and are immediately sent to a pharmacy site, a fake login page, or adult content. You may not see the redirect yourself because attackers often target only logged-out visitors or mobile users. Test by opening your site in a private browser window, or ask a colleague on a different network to check. The malicious code is usually injected into your theme's functions.php file, the .htaccess file in your root directory, or a rogue plugin.
Sign 5: Your Site Has Slowed Down Dramatically
A sudden, unexplained drop in speed can indicate that your server is running cryptomining scripts or sending bulk spam emails on behalf of an attacker. Legitimate performance issues usually have a traceable cause like a new plugin or a traffic spike. If your site slowed down overnight with no changes on your end, treat it as a security concern, not just a performance problem, until you can rule out infection.
Sign 6: A WordPress or Plugin Scanner Flags Suspicious Files
Running a WordPress plugin scanner or a server-side scan is one of the most reliable ways to confirm an infection. The Wordfence Security plugin (available free on WordPress.org) can check your WordPress site for vulnerabilities, scan plugin and theme files against known clean versions, and flag files that have been modified or injected. After installing it, go to Wordfence > Scan and run a full scan. Review every result marked as a critical issue before dismissing anything. A wp exploit scanner approach like this catches injected code that is invisible to the naked eye.
Sign 7: Search Engines Are Indexing Pages You Never Created
Search for your domain in Google using the operator site:yourdomain.com and look through the results. If you see pages in Japanese, Russian, or other languages you never published, or pages promoting pills, gambling, or counterfeit goods, your site has been hit by SEO spam injection. Attackers create thousands of hidden pages to hijack your domain's authority. These pages are often invisible when you are logged in, which is why the Google search test is so useful.
Sign 8: Your wp-config.php or Core Files Have Been Modified
wp-config.php is the most sensitive file on your WordPress install. It holds your database credentials and security keys. If a file scanner or your host reports that this file was recently modified and you did not touch it, treat that as a confirmed breach. Core WordPress files like those in the wp-admin and wp-includes folders should never be modified. Any changes there almost certainly indicate injected malware.
What to Do If You Spot Any of These Signs
- Back up everything immediately, even the infected version. You may need it for forensic comparison later.
- Put your site in maintenance mode to protect visitors while you investigate.
- Change all passwords: WordPress admin accounts, your hosting control panel, FTP/SFTP, and your database user.
- Run a plugin scan using a tool like Wordfence to identify modified or injected files.
- Remove unfamiliar plugins, themes, and admin users that you did not install.
- Restore clean versions of any flagged core files from a fresh WordPress download at wordpress.org.
- Check Google Search Console under Security Issues for a full list of flagged URLs.
- Request a Google review once the site is clean to lift the Safe Browsing warning.
- Harden your site after cleanup: update all plugins and themes, enforce strong passwords, and consider a managed WordPress hosting environment with built-in security monitoring.
Malware removal is painstaking work. Attackers often plant multiple backdoors so the infection returns within days if even one is missed. If you have gone through these steps and the problem persists, or if you simply do not have the time to do this safely, the team at TheAppSense handles this every day. See the WordPress Malware Removal service for a done-for-you cleanup with a reinfection guarantee.
A hacked WordPress site is stressful, but it is fixable. The key is catching it early. Bookmark this checklist, run a plugin scan at least once a month, and keep every plugin, theme, and WordPress core version up to date. Most infections exploit known vulnerabilities in outdated software, which means the single most effective thing you can do today is hit Dashboard > Updates and apply everything that is waiting.
How do I know for sure if my WordPress site is hacked?
The most reliable method is to run a WordPress plugin scanner like Wordfence, check Google Search Console for security alerts, and search site:yourdomain.com in Google to look for pages you never created. Any one of these returning suspicious results is a strong confirmation.
Can I clean a hacked WordPress site myself?
Yes, if you are comfortable working with files via FTP or your hosting file manager, following a structured process, and restoring clean core files. If you are not confident, or if the infection keeps returning, it is safer to use a professional malware removal service than to risk leaving a backdoor in place.
Will reinstalling WordPress fix a hack?
Reinstalling WordPress core files removes infected core files, but it does not clean your database, your wp-content folder, or your wp-config.php file. Malware is frequently hidden in themes, plugins, and the database, so a core reinstall alone is rarely enough.
How did my WordPress site get hacked in the first place?
The most common causes are outdated plugins or themes with known security vulnerabilities, weak admin passwords, nulled (pirated) themes or plugins that contain pre-installed malware, and compromised hosting credentials. Keeping everything updated and using strong unique passwords eliminates the majority of attack vectors.
How long does it take Google to remove the 'site may be hacked' warning after cleanup?
After you submit a review request in Google Search Console, Google typically responds within a few days to a couple of weeks. The timeline depends on how quickly their crawlers verify that the malicious content is gone. Make sure the site is fully clean before submitting, or the review will be denied.