Most hacked WordPress sites do not look hacked. The home page loads, the logo is in place, and nothing seems wrong. Yet the site may be sending visitors somewhere else or hosting pages you never made. This guide lists the common warning signs and the safe checks you can do yourself, without any technical skills.
The most common warning signs
No single sign proves a hack. Several together are a strong hint. Watch for these:
- Unexpected redirects. Visitors click your link and land on an unrelated site. Sometimes this only happens on phones or only when people arrive from Google, so you may not see it yourself.
- Strange pages or links. Pages about products or topics you never wrote, or odd links tucked into your footer or old posts.
- New admin users. An account you do not recognise, especially one with the Administrator role.
- Changes you did not make. Your theme looks different, plugins appear that you did not install, or settings have changed.
- Slow or unstable performance. A site that was fine yesterday and now crawls can be running unwanted code.
Warnings from browsers, search engines and your host
Outside tools often notice a problem before you do. A red warning page in your browser, a message in Google results saying the site may be harmful, or a notice in Google Search Console are all worth taking seriously. Your hosting company may also email you to say your account was suspended or flagged for malware.
Other outside signs include a sudden drop in traffic, customers telling you your emails land in spam, or bounce messages for emails you never sent. If your site is sending spam, the mail server may have been misused.
Five safe checks anyone can do
None of these change anything on your site. They only look.
- Search Google for your own site. Type site:yourdomain.com into Google, using your real domain. Scan the results. Titles in another language, pages about pills, casino or fake brands, or a long list of pages you do not recognise are red flags.
- Read your search snippets. Search for your business name. If the title or description under your link looks spammy or has changed, that is a sign something is injecting content.
- Check your users list. In the WordPress dashboard, open Users. Look at every Administrator. Do you know each person? If not, note the name but do not delete anything yet.
- Open Google Search Console. If your site is verified there, look for the Security issues report. It will tell you if Google has detected hacked content or malware. If you have never set up Search Console, that is a good thing to do after the emergency passes.
- Test in a private window and on your phone. Open your site in a private browser window, and on a phone using mobile data. Some redirects only appear to first time visitors or on mobile.
What not to do straight away
When people panic, they often make recovery harder. Try to avoid these:
- Do not delete everything. Wiping the site can destroy the evidence of how the attacker got in, and the same hole stays open.
- Do not restore an old backup blindly. The backup may already contain the problem, or the attacker may walk back in the same way.
- Do not ignore the warning. Hoping it goes away usually lets the damage grow, and search engines may keep warning visitors.
- Do not reuse your old passwords. If you change passwords, make them new and unique. Do it from a computer you trust.
- Do not pay random strangers who message you. Be careful of anyone who contacts you out of the blue offering a quick fix.
For a calm, step by step plan, read what to do in the first hour after your website is hacked. It covers the order of actions so you do not need to repeat them here.
When to call an expert
You do not need to be sure it is a hack before asking for help. Reach out to a professional if any of these are true:
- Google or your browser is showing a security warning for your site.
- Your host has suspended the account or sent a malware notice.
- You found admin users, files or pages you cannot explain.
- The site takes orders, bookings or customer details, so the risk to others is higher.
- You cleaned something and the problem came back.
Cleaning a site properly means finding every hidden file and closing the way in. That is detailed work, and it is easy to miss something. Our website malware removal page explains what this involves, and emergency website recovery is the route for a site that is hacked or down right now.
How to lower the chance of it happening again
Most WordPress hacks come through out of date plugins, themes or weak passwords. Keeping everything updated, using strong unique passwords, limiting admin accounts and keeping tested backups removes most of the easy routes in. The WordPress security documentation is a good place to read more. If you are unsure what ongoing care should cover, see what website maintenance includes.
At WebXSentry, Emergency Recovery is a one-time engagement for hacked or down sites. Our monthly plans are Essential at $99, Business at $199 and Priority at $399, with 2, 6 or 12 hands-on hours. Security scans, a firewall and backups are part of the plans, they run month to month, and there is a 30-day money-back guarantee. Our engineers work Monday to Saturday on India time, and a person replies by your next business morning.
What to do next
Run the five checks above today. They take about fifteen minutes. If anything looks wrong, write down what you saw, take screenshots, and follow the first hour guide. If you would like a second pair of eyes first, you can request a free website maintenance audit.
