Why hacked sites are hard to spot
Most website owners imagine a hack as a defaced homepage with a message from the attacker. That almost never happens anymore. Modern infections are built to make money quietly for as long as possible: sending your visitors to scam sites, using your domain’s reputation to rank spam pages, or harvesting card details from your checkout. The longer they go unnoticed, the more they earn.
So attackers hide. Many infections only show their effects to visitors arriving from Google, only on mobile, only to people who aren’t logged in, or only once per visitor. You can check your own site every day from your office computer and see nothing wrong, while a customer on their phone gets redirected to a fake prize page.
That’s why the signs below include things to check outside your normal view of the site, and why a single “it looks fine to me” isn’t enough.
Signs in Google search
1. Google shows spam titles or pages you didn’t create
Search Google for site:yourdomain.com and scroll through the results. Look for pages you don’t recognise: pharmacy products, replica handbags, casino terms, or titles in Japanese or other languages your business doesn’t use. This is the classic sign of an SEO spam infection (often called the Japanese keyword hack), which creates thousands of pages on your domain to borrow its rankings.
Sometimes the pages exist; sometimes they’re only shown to Google’s crawler (cloaking), so clicking them shows your normal site or a 404. Either way, the listing in Google is the evidence.
2. “This site may be hacked” under your listing
If Google detects hacked content, it can add a warning under your search result. Searchers see it before they ever reach your site, and many won’t click.
3. A message in Search Console’s Security issues report
If you have Google Search Console set up, open Security & Manual Actions → Security issues. If Google has detected malware, hacked content or phishing, it’s listed here with example URLs. If you don’t have Search Console, set it up now; it’s free and it’s the most reliable early warning you’ll get.
Signs your visitors see
4. Redirects to other websites
A customer tells you your site “went somewhere weird”. Take it seriously, even if you can’t reproduce it. Test on a phone using mobile data (not your office Wi-Fi), open the site from a Google search result rather than typing the address, and try a private browsing window. Injected redirects frequently check all of these conditions.
5. Browser warnings: “Deceptive site ahead” or a red warning screen
Chrome, Safari and Firefox use Google Safe Browsing and similar lists. A full-screen red warning means your site has been flagged for malware or phishing. Visitors will almost all turn back.
6. Pop-ups, ads or links you didn’t add
Unexpected pop-ups, “allow notifications” prompts, ads, or hidden links in the footer (sometimes only visible in the page source) are signs of injected code.
We investigate, clean files and database, close the backdoors and request Google’s review.
Signs inside WordPress and your hosting
7. Administrator accounts you don’t recognise
In WordPress, go to Users and filter by Administrator. Any admin account nobody can explain is a serious sign. Note its username and, if you can see it, when it was created, but don’t delete it yet: the creation date helps establish when the attack happened. Some infections also hide admin users from this list, so a clean list isn’t conclusive.
8. Plugins or files you didn’t install
A plugin you’ve never heard of, sometimes with a plausible name like “WP Core Helper”, or unfamiliar PHP files in your site’s root folder or wp-content/uploads/ (which should normally only contain images and documents) are common backdoors.
9. Your host suspends the site or emails a malware notice
Hosts scan accounts for known malware and for spam being sent from your server. A suspension notice usually includes file paths, which are valuable evidence. Keep the email.
10. Your site is suddenly slow, or your hosting resources are maxed out
Malicious scripts that send spam, mine cryptocurrency or attack other sites use CPU and memory. An unexplained jump in server load, or resource-limit errors with no increase in real visitors, deserves a look.
11. You can’t log in, or your password has changed
If your administrator password no longer works and you didn’t change it, or WordPress emails you about a password or email change you didn’t make, assume compromise.
12. Emails from your domain are bouncing or flagged as spam
If your server starts sending spam, mail providers block it, and suddenly your legitimate emails (contact form notifications, order confirmations) stop arriving too.
Signs that often have innocent explanations
Not every oddity is a hack. Before panicking, consider the common innocent causes:
| What you see | Possible innocent cause |
|---|---|
| Site slow or erroring | Hosting resource limits, a heavy plugin, a traffic spike, a failing update |
| Admin user you don’t recognise | A developer or agency you worked with years ago, or a plugin’s support account |
Strange pages in site: search | Old pages from a previous version of the site, tag archives, attachment pages |
| Emails not arriving | Missing SPF/DKIM records or a mail plugin setting |
| Layout broken | A plugin or theme update, or a caching problem |
One of these alone is worth checking. Several together, especially combined with redirects, spam in Google or warnings, point strongly to a compromise.
A 15-minute self-check
If you suspect something, work through this list. You don’t need technical skills for most of it:
- Search Google for
site:yourdomain.comand look through several pages of results. - Check Search Console’s Security issues report (and set up Search Console if you don’t have it).
- Visit your site on a phone using mobile data, from a Google search result, in a private window.
- Check Google Safe Browsing’s site status tool for your domain.
- In WordPress, review Users (administrators) and Plugins (including inactive ones).
- Read any recent emails from your host, Google or WordPress itself.
- If you have hosting file access, look for recently modified PHP files and any
.phpfiles insidewp-content/uploads/.
Write down what you find, with screenshots and times. It will make any cleanup faster.
What to do in the first 30 minutes
- Don’t delete or reinstall the site. It destroys the evidence of how the attacker got in, and reinstalling WordPress core doesn’t clean the database or your uploads folder.
- Take a full backup as it is now. Files and database, infected or not. It’s evidence and a safety net.
- Change passwords from a different, trusted device: hosting account first, then WordPress administrators, SFTP/FTP and the database user. If you reuse any of these passwords elsewhere, change those too.
- Don’t delete the suspicious admin accounts yet. Note them.
- Put up a maintenance page if visitors are being redirected to harmful sites and you can do so safely.
- Contact whoever will clean it up, with your notes and screenshots.
What you should not do is install three security plugins, run their “auto-clean” buttons and hope. Automated cleaners remove known patterns in files; they often miss database injections and backdoors, and the infection returns days later.
What a proper cleanup involves
A thorough cleanup follows a set order: contain the damage, investigate how the attacker got in, clean the files, clean the database, close every backdoor and reset every credential, patch and harden whatever was exploited, request reviews from Google and any blocklists, then monitor. Skipping the investigation or the hardening is the main reason cleaned sites get reinfected.
We describe the full process, and what we’d need from you, on our WordPress malware removal page.
How to make it much less likely next time
Most WordPress compromises we see trace back to a small number of causes:
- Outdated plugins and themes with publicly known vulnerabilities. Keep them updated, tested first, and remove anything you don’t use.
- Weak, reused or shared passwords. Use unique passwords and turn on two-factor authentication for every administrator.
- “Nulled” premium plugins downloaded free from unofficial sites. They frequently contain backdoors.
- Old, forgotten installs in subfolders (
/old/,/test/) that nobody updates. - No backups, or backups that only go back a few days, so there’s no clean copy to compare against.
A routine of tested updates, backups and monitoring prevents most of these. Our website maintenance checklist covers what to do and how often, and our website security page explains layered protection.
Official reference: the WordPress developer documentation’s hardening guide and Google’s guide to recovering a hacked website.
Frequently asked questions
Can a WordPress site be hacked without me noticing?
Yes, and most are. Modern infections are designed to stay hidden, often showing spam or redirects only to search visitors or mobile users, so owners checking from their own computer see nothing wrong.
Will Google tell me if my site is hacked?
Often, through the Security issues report in Search Console and sometimes a warning in search results. But Google doesn’t detect everything, and not every infection triggers a warning.
Is it safe to just restore a backup?
Only if the backup predates the infection and you also close the way the attacker got in. Otherwise the same vulnerability is still there, and you may restore a backdoor too.
Does a security plugin prevent hacks?
It helps, as one layer. Most hacks exploit outdated plugins or stolen passwords, so updates, unique passwords with two-factor authentication, and backups matter just as much.
About this guide
We build, repair, move and maintain WordPress and WooCommerce websites for businesses in the UAE, US, UK and Canada. This guide reflects how we approach the problem in client work, checked against the official documentation linked in the text. Published 16 October 2026.
Found an error or something out of date? Tell us and we’ll correct it.
