A hacked WordPress site rarely announces itself with a dramatic message. More often it’s a slow, creeping wrongness — a redirect here, a strange file there — that’s easy to miss until real damage is done. Here are five warning signs your site may be compromised, and the first steps to take if it is.
1. Unexpected redirects or pop-ups
You (or a visitor) click a link on your site and land on a sketchy page selling something you’ve never heard of. Or ads and pop-ups appear that you never added. Malicious redirects are one of the most common symptoms of a hacked WordPress site, and they often only trigger for certain visitors — for example, people arriving from Google, but not you when you log in directly. That’s exactly why they go unnoticed for so long.
2. New admin users you didn’t create
Log in and check Users → All Users. If there’s an administrator account you don’t recognise — often with a random name or a gibberish email — treat it as a serious red flag. Attackers create their own admin accounts so they can get back in even after you change your password. An unfamiliar admin is one of the clearest signs someone else has the keys to your site.
3. Unknown files or modified core files
WordPress core, theme, and plugin files shouldn’t be changing on their own. If you notice strange PHP files in your uploads folder, or a security scan flags that core files have been modified, that’s a strong indicator of an infection. Malware frequently hides in innocent-looking file names, which is why a scan usually finds what a manual look misses.
4. A sudden traffic drop or a Google warning
If your search traffic falls off a cliff, or visitors see a red “this site may be hacked” warning in Google, your site may have been flagged for distributing malware or spam. Search engines protect their users aggressively, so a compromised site can be de-listed or warning-labelled fast — and earning that trust back takes time.
5. The site is slow, or sending spam
Compromised sites are often quietly put to work — mining, sending spam email, or serving malware to others — which drags performance down. If your site suddenly feels sluggish for no reason, or your host emails you about spam being sent from your account, don’t just blame bad hosting. It can be a symptom of an infection using your server’s resources.
What to do first
If you spot these signs, act in this order:
- Put the site into maintenance mode so visitors aren’t exposed while you work.
- Change every password — WordPress admin, hosting, database, and FTP — and enable two-factor authentication.
- Scan the site with a reputable security plugin or your host’s malware scanner to locate infected files.
- Restore from a clean backup taken from before the infection, if you have one.
- Update everything — WordPress core, themes, and plugins — and delete anything you’re not actively using.
- Harden the site so it doesn’t happen again: limit login attempts, remove unused accounts, and keep automatic backups running.
The takeaway
Most WordPress hacks succeed because of an out-of-date plugin and a weak password — both entirely preventable. Catching the warning signs early turns a potential disaster into a manageable clean-up. And once a site is genuinely clean and hardened, the goal is simple: keep it that way, so you never have to read an article like this in a panic.
