- WordPress security guide
Is My WordPress Site Hacked? 12 Signs to Check Right Now
By Khokon · Updated September 2026 · 8 min read
Something feels wrong with your site, and you are not sure what. Maybe a customer said it sent them somewhere strange. Maybe Google shows words you never wrote. This guide shows you how to tell if your WordPress site has been hacked: the 12 signs I see most often when I clean hacked WordPress sites, how to check each one in a few minutes, and what to do if you find one.
Short answer: how to tell if your WordPress site has been hacked
- If visitors get sent to spam sites, your site is almost certainly hacked
- If Google shows Japanese or drug words for your site, it is hacked
- If Google or your browser shows a red warning, it is hacked
- If you only see one small sign, check the list below before you panic
12 signs your WordPress site is hacked
Some signs are loud, like a red warning page. Others are quiet and easy to miss. Hackers prefer quiet, because the longer nobody notices, the more they can use your site. So do not skip the small ones.
Visitors get sent to another site
Someone clicks your link and lands on a spam shop, a fake prize page or an adult site. This is a redirect hack. It often fires only on phones, or only for people coming from Google. That is why you may never see it yourself.
How to check: on your phone, search for your business on Google and tap your own result. Try it in a private browser window too.
Japanese or drug words in your Google results
Google shows pages under your site name with Japanese text, cheap brand names or pill names. Your site looks normal when you open it, because the spam is shown only to Google. This is usually the Japanese keyword hack.
How to check: type site:yourdomain.com into Google and scroll through the results. Read more about the Japanese keyword hack →
"This site may be hacked" under your link
Google adds this small line under your result when it finds spam on your site. Many people click away when they see it, so your traffic drops quietly.
How to check: search for your business name on Google and look under your own link.
A red warning page before your site
Chrome, Safari or Firefox shows a full red page that says “Deceptive site ahead” or “This site may harm your computer”. Almost nobody clicks past it. This is the loudest sign, and it needs fixing today.
How to check: open your site in Chrome. You can also enter your domain on Google’s Safe Browsing site status page.
A security message in Search Console
Google Search Console is where Google talks to site owners. If it found malware or spam, it tells you there, often before your visitors notice.
How to check: open Search Console and click Security Issues in the menu. Anything other than “No issues detected” means trouble.
Your host warns you or suspends your site
Hosting companies scan their servers. If they find malware in your files, they send an email, block some files or turn off your site to protect other customers.
How to check: search your inbox and spam folder for messages from your host with words like malware, suspended or abuse.
Found one of these six? Do not wait for it to get worse. Send me your URL and I will tell you how serious it is, for free.
Admin users you did not create, or you are locked out
Hackers often add their own admin account so they can get back in later. Some change your password so you cannot log in at all.
How to check: in your dashboard, open Users and filter by Administrator. Every name there should be someone you know.
Files or folders you never uploaded
Strange PHP files, folders with random names, or files changed on a day you did nothing. The uploads folder is a favorite hiding place, because it should only hold images and documents.
How to check: in your hosting file manager, open the uploads folder and look for any file ending in .php. There should be none.
Your site sends spam emails
Customers tell you they got strange emails from your domain, or your own emails start bouncing. A hacked site can be used to send thousands of spam messages, which gets your domain blocked.
How to check: ask your host if your account is sending unusual mail, and check your domain on a free email blacklist checker.
Popups, ads or links you did not add
Visitors see popups or ads you never set up. Or there are hidden links to casino or pill sites in your footer, invisible to people but visible to Google.
How to check: open your site in a private window, then right click and view the page source. Search it for words like casino, viagra or loan.
Your site is suddenly very slow
Your site did not change, but it crawls. Your host may say you are using too much server power. Malware often runs hidden jobs in the background, like sending spam or mining crypto.
How to check: ask your host for your resource usage, and compare today with last month.
A sudden drop in Google traffic
Your visits fall off a cliff in a few days, with no change on your side. Google may have found spam or a warning and pushed your pages down.
How to check: in Search Console, open the Performance report and look at the last three months. Then check the queries for words you never use.
How to check your whole site in 10 minutes
If you want one quick routine, do these five checks in order. Together they catch most hacks I see.
Search your site on Google
Type site:yourdomain.com and look for pages or words that do not belong.
Check Google Safe Browsing
Enter your domain on Google’s Safe Browsing site status page. It tells you if Google flags your site as unsafe.
Open Search Console
Look at Security Issues. Then open Settings, Users and permissions, and remove any owner you do not know.
Run a free outside scan
Tools like Sucuri SiteCheck scan your public pages for known malware and blacklists. They cannot see inside your files, so a clean result does not mean a clean site.
Check users and files
Look for unknown admin users in WordPress and for .php files in your uploads folder.
What to do first if your site is hacked
Found a sign? Take a breath. A hacked site can almost always be fixed. What you do in the first hour decides how easy the cleanup will be.
Do not delete anything yet
Deleting files at random can break your site and destroy the clues that show how the hacker got in.
Take a backup, even of the hacked site
Download a copy from your hosting panel. If something goes wrong during cleanup, you can always go back to this point.
Change your passwords
Change your hosting, WordPress admin, FTP and database passwords. Use long, unique passwords and turn on two factor login where you can.
Tell your host
Let them know you are dealing with it. Many hosts give you time before they suspend the site, and some can tell you which files look infected.
Get it cleaned properly
Removing the visible spam is not enough. The backdoor must go, the hole must be closed, and Google must be asked to review your site. That is the part most people miss.
What not to do
Do not restore an old backup without checking it. It may hold the same backdoor
Do not trust one plugin scan. Plugins often miss hidden code and the database
Do not ignore a Google warning. It will not go away on its own
Do not reuse the same passwords after the cleanup
How WordPress sites get hacked
Knowing how it happened helps you stop it from happening again. These are the causes I find most often.
Old plugins and themes
The most common cause by far. A known security hole stays open until someone updates.
Pirated themes and plugins
Free copies of paid tools often come with a backdoor already inside.
Weak or reused passwords
Bots try thousands of passwords a day. Without two factor login, one guess is enough.
Old sites on the same hosting
A forgotten test site on the same account can infect your main site.
Nobody watching
Small sites get hit most because nobody checks them every week.
Found signs? I can clean it this week
I have cleaned hacked WordPress sites for 15 years. I find the malware, close the backdoor, remove Google warnings and harden your site so it stays clean. If it gets infected again within 60 days, I clean it again for free.
Questions about hacked WordPress sites
Can a hacked site look completely normal?
Yes. Many hacks show spam only to Google or only to visitors on phones. Your site can look perfect to you while customers and Google see something else. That is why the checks in this guide matter.
Will Google tell me if my site is hacked?
Sometimes. If you use Search Console, Google may send a message under Security Issues. But it often finds out late, after your visitors have already seen the problem.
Does a security plugin catch everything?
No. Plugins are good at finding known malware in files. They often miss well hidden backdoors, code inside the database and spam that is shown only to Google.
Should I restore a backup?
Only if you know the backup is clean and you know how the hacker got in. Otherwise the same backdoor comes back with it, and the site gets hacked again.
How much does it cost to fix a hacked WordPress site?
Most services charge between $149 and $599 for one cleanup. My price is $149 flat, or $249 for a 12 hour emergency cleanup, with a 60 day guarantee.
Written by Khokon. WordPress consultant for 15 years. I clean hacked sites, build websites and look after them every month. More about me →