← All articles

Incident response · 2026-07-11

How to Tell if Your WordPress Site Is Hacked (10 Signs)

A hacked WordPress site often looks normal to you while quietly serving spam, redirects or malware to everyone else. Here are 10 reliable signs your WordPress site is hacked — and how to confirm it in a couple of minutes.

Quick check: run a free MageArgus scan for web-reachable indicators, then verify on the server if anything looks suspicious.

By the numbers
  • Search-engine warnings are how many owners first learn they're hacked — Google Safe Browsing
  • SEO spam and redirects are among the most common WordPress infections — Sucuri

10 signs your WordPress site is hacked

  1. Google warns visitors ("deceptive site") or your host suspends the account.
  2. Unexpected redirects — visitors from search land on another site.
  3. Spam pages or posts for pharma/casino/replica keywords you never created.
  4. Unknown admin users or users you didn't add.
  5. Unfamiliar plugins/themes, or files modified without a deploy.
  6. New PHP files in wp-content/uploads.
  7. Homepage defaced or odd content injected into the footer/header.
  8. Sudden traffic or resource spikes from spam or a backdoor.
  9. Outbound spam email from your server / blocklisted IP.
  10. Security plugin or scan alerts you didn't expect.

Confirm it quickly

Verify core and plugin files, and check for rogue admins:

wp core verify-checksums
wp user list --role=administrator
grep -rIl 'eval(\|base64_decode\|str_rot13' wp-content/ 2>/dev/null

Search your site on Google (site:yourdomain.com) to spot injected spam pages, and check Search Console for security issues.

What to do next

If you confirm any of these, don't just delete the obvious file. Follow the WordPress malware removal guide: back up, replace core/plugins from clean sources, remove backdoors, reset secrets, patch, and re-scan.

Frequently asked questions

My site looks fine to me — could it still be hacked?

Yes. Many infections are cloaked to hide from logged-in admins and show only to search engines or new visitors. Check in an incognito window, from mobile, and via a scan — not just from your usual browser.

Is a Google 'deceptive site' warning always a hack?

Almost always it means malicious or spam content was found on your pages. Clean the site, then request a review in Google Search Console to clear the warning.

Related reading

Scan your store free →