Here is the frightening part about WordPress hacks: most hacked sites look completely normal to the owner. The infection is designed to be invisible to you while staying fully active for your visitors, for search engines, and for Google’s crawlers. Owners routinely discover compromises days, weeks, or even months after they happened, by which point the damage includes destroyed rankings, blacklisting, and eroded customer trust.
So you cannot rely on “looking at the site.” You have to actively check the signals that show up where you do not normally look: what Google shows, what your visitors experience, and what is happening inside your files.
This guide covers the 10 warning signs of a hacked WordPress site, organized by where you spot them: what you see, what your customers see, and what Google sees. It ends with three quick checks you can run in the next ten minutes.
What You See: Signs in Your Dashboard and Files
1. Unknown admin users in your WordPress dashboard
Go to Users in your WordPress admin and look for administrator accounts you did not create, often with random-looking names. Attackers create backdoor admin accounts so they can get back in even if you change your own password. Also check whether your own admin email address has been changed. If you find an account you do not recognize, treat the site as compromised.
2. Strange files or recently modified core files
Hackers plant malicious PHP files with innocent or random names (things like wp-x1.php, or files pretending to be fonts or images) in places like /wp-content/uploads/, where PHP files should never exist. They also modify core WordPress files and theme files such as functions.php, often injecting obfuscated code (long strings of garbled characters, or suspicious uses of eval() and base64_decode()). If your file manager or hosting panel shows files you do not recognize, or core files modified on dates nobody on your team was working, that is a serious red flag.
3. You can no longer log in
If your password suddenly stops working and password resets fail, an attacker may have changed your credentials or deleted your account to lock you out while they use the site themselves. A lockout alone can also be a glitch, but combined with any other sign on this list, it means compromise.
4. Your site has become noticeably slower or crashes
Malware often uses your server for its own purposes: sending spam, attacking other sites, or mining cryptocurrency. The result is unexplained slowness, CPU spikes in your hosting panel, or crashes that started suddenly with no plugin or traffic change to explain them. One oddity alone could be a plugin conflict; persistent, unexplained load deserves a scan.
5. Your security plugin is disabled or a scanner flags malware
If your security plugin has been deactivated without your input, that is rarely an accident: malware disables defenses first. Likewise, if a scan by Wordfence, Sucuri, or a similar tool flags malware or modified files, believe the scanner. Wordfence’s official hacked-site guide lists this among its core warning signs. Do not install multiple security plugins at once to “double check”; they conflict with each other and can make the situation worse.
What Your Customers See: Signs in the Visitor Experience
6. Visitors are redirected to spam sites (but you are not)
This is the classic WordPress redirect hack, and it is deliberately sneaky. The malware redirects visitors to spam, gambling, pharmacy, or phishing pages, but excludes logged-in admins, so everything looks fine when you check your own site. There are variants: automatic redirects on every visit, redirects only when clicking links, redirects only on mobile devices, and redirects only for visitors arriving from Google.
If a customer tells you your site sent them somewhere strange, believe them immediately, even if you cannot reproduce it. Test in a private/incognito window, on your phone with Wi-Fi off, and ideally ask someone on a different network to check.
7. Spam content or defacement on your pages
Sometimes the hack is visible: your homepage replaced with a message or an image, strange text injected into posts, pop-ups or ads you never added, or contact forms suddenly drowning in spam. Defacement is the loudest kind of hack, and also the least common; most attackers prefer to stay quiet. Either way, unexpected content you did not publish means the site’s integrity is gone.
What Google Sees: Signs in Search Results
8. Google shows a “This site may be hacked” warning
If your listings in Google search results carry a “This site may be hacked” notice, or visitors see a red “Deceptive site ahead” warning in Chrome, Google’s Safe Browsing system has flagged your site for malware, phishing, or spam. This is a confirmed problem, not a suspicion. Traffic typically collapses at this point, because almost nobody clicks through a warning screen.
9. Spam pages indexed under your domain that you never created
Attackers inject hundreds of spam pages into hacked sites to piggyback on the domain’s authority: the infamous “Japanese keyword hack” (pages of Japanese text selling counterfeit goods), pharma spam pages selling pills, or casino and adult content. You will never see these pages in your dashboard; they exist to be found by search engines.
The fastest free check: go to Google and search site:yourdomain.com (with your real domain). Google shows every page it has indexed for your site. If you see Japanese characters, pharma keywords, or pages you never created, your site is hacked. Every WordPress owner should run this search monthly.
10. A sudden collapse in organic traffic
If your traffic falls off a cliff in Google Analytics or Search Console with no algorithm update or site change to explain it, check the Security Issues section in Search Console immediately. Google either blacklisted the hacked pages or de-ranked them. A traffic collapse is often the first symptom owners notice, because everything else about the hack was invisible to them.
The 10-Minute Confirmation Checklist
If one or more signs above sound familiar, run these three checks right now, in this order:
Check 1: Google Safe Browsing. Open Google’s Safe Browsing transparency report page and enter your domain. It shows any active security warnings within seconds. This is the same system Chrome and Google Search use, so it is authoritative.
Check 2: The site: search. Search Google for site:yourdomain.com and scan the first few pages of results for anything you did not publish: foreign-language text, pharma terms, gambling, or URLs with strange parameters.
Check 3: An external malware scan. Run your URL through an external scanner such as Sucuri’s free SiteCheck. External scans see your site the way Google and attackers see it, from the outside, which catches cloaked hacks that hide from logged-in admins. This matters because most hacks are specifically designed to look normal to the site owner.
How to read the results: one weird issue alone can be a plugin conflict or a server glitch. Two or more signs together mean you should treat the site as compromised and move to containment: put the site in maintenance mode, change all passwords from a clean device, disable any unknown admin accounts, and contact your hosting provider. Do not restore from an old backup without checking whether the backup itself is clean.
FAQs
What are the first signs my WordPress site is hacked?
The earliest signs owners usually notice are a sudden traffic drop, a Google “site may be hacked” warning in search results, customers reporting strange redirects, or unknown admin users in the dashboard. The hack itself usually started earlier; these are just the first visible symptoms. The site:yourdomain.com search and an external scan are the fastest ways to confirm.
Why does my site look normal but Google shows spam?
Because the hack is cloaked: it shows different content to different visitors. Logged-in admins (you) see the normal site, while Google’s crawler and regular visitors see injected spam or get redirected. This is deliberate. Never rely on browsing your own site as a security check; use external scans and Google’s own tools instead.
Can a hacked WordPress site infect my visitors?
Yes. Redirect hacks send visitors to phishing pages designed to steal their credentials, and some infections serve browser exploits or unwanted downloads. This is why Google blacklists hacked sites so aggressively: an infected site is a danger to everyone who visits it, and a liability for your business reputation.
My host suspended my account for malware. What does that mean?
It means your hosting provider’s automated scans detected malicious activity from your account, such as outbound spam or phishing pages, and pulled the site offline to protect others on the server. Check your email for the suspension reason, then contact their support. You will need to clean the site and demonstrate it is safe before they restore it.
Is one strange symptom enough to confirm a hack?
Not always. A single redirect glitch can be leftover tracking code, and one slow day can be a busy server. But a single suspicious redirect to a spam site, or one unknown admin account, is already a serious red flag worth investigating immediately. Two or more signs together mean containment, not further investigation.
I confirmed my site is hacked. What now?
Contain first, clean second. Put the site in maintenance mode, change all passwords (hosting, WordPress, database, FTP) from a clean device, remove unknown admin accounts, and open a ticket with your host. Then clean thoroughly: reinstall WordPress core and all plugins/themes from trusted sources, scan the database, and rotate every credential. If customer data or payments may have been exposed, or the infection is deep, professional cleanup is the safer path. Ongoing website maintenance with monitoring, updates, and off-site backups is what prevents the next one.
Conclusion
A hacked WordPress site rarely announces itself. The signs hide in three places: your dashboard (unknown users, strange files, lockouts, slowness, disabled security), your visitors’ experience (redirects they see but you do not, injected content), and Google’s view (warnings, spam pages in the index, traffic collapse). The site: search, Safe Browsing check, and an external scan take ten minutes and catch what browsing your own site never will.
Run those checks monthly, keep WordPress, themes, and plugins updated, and keep tested off-site backups. Most WordPress hacks exploit outdated components and weak credentials, not sophisticated zero-days, which means basic hygiene prevents the large majority of compromises.
If you have confirmed a hack, or you would rather have professionals watching your site around the clock, our website maintenance plans cover security monitoring, updates, and cleanups, so a compromise gets caught in hours, not months.
About the author: Muhammad Waqas Dilzak is co-founder of SWAF Digital and an SEO specialist with 10+ years of experience across SEO, AI search optimisation, and WordPress.
