By Hridoy Ahmed | Last updated: October 2026 | 7 min read
Short answer: Your WordPress site may be hacked if visitors are redirected, spam pages appear, you find admin users you did not create, or Google or your host shows a security warning. Check Google Search Console’s Security issues report, review your admin users and run a malware scan. If you find a problem, take a backup first.
In this guide: Common signs | Safe checks | What to do first | What not to do | Common mistakes | FAQ
A hacked site does not always look broken. Many attacks are hidden so the owner does not notice. This guide shows what to look for. I only cover detection and cleanup here, not attack methods.
If you need help right now, see my WordPress malware removal service.
Common signs
- Visitors are sent to other websites, sometimes only from Google results or on mobile
- Spam content or strange pages on your site, or odd titles in Google results
- Admin users you did not create
- Google shows a security warning or “This site may be hacked”
- Your host suspended your account or sent a malware notice
- New files or plugins you did not install
- A sudden traffic drop or a very slow site
- Spam emails sent from your domain
Safe checks you can do
- Search Console. Open the Security issues report. It lists problems Google found.
- Users. Go to Users in WordPress and check every administrator.
- Plugins and themes. Look for unknown or nulled items. Remove software you do not use.
- Google search. Search for your domain name with the site: operator and look for odd pages.
- Test as a visitor. Open your site from a Google result in a private window, on mobile data. Some malware hides from logged-in admins.
- Scan. Use a reputable malware scanner and compare WordPress core files with the official versions.
What to do first
- Take a full backup of the site as it is now.
- Change passwords for WordPress admins, hosting, FTP/SFTP and the database.
- Tell your host. They may have logs.
- Update WordPress, plugins and themes.
- Clean the infection, or ask an expert to do it.
If Google shows a warning, read how to remove the “This site may be hacked” warning. To prevent the next attack, follow my WordPress security checklist.
What not to do
- Do not only delete the visible spam. Hidden access may remain.
- Do not restore an old backup without checking when the infection started.
- Do not ignore the cause. The same hole will be used again.
Common mistakes
- Waiting because the site “looks fine”
- Cleaning the files but not the database
- Using nulled themes or plugins
- Not changing passwords after cleanup
FAQ
Can a hacked site look normal?
Yes. Some malware hides from logged-in users and shows spam only to visitors or search engines.
Will a security plugin find everything?
Not always. Scanners are useful but can miss hidden or new threats.
Should I take my site offline?
If visitors are at risk, putting the site in maintenance mode can help while you clean it.
Think your site is hacked? Message me and I will check it. See my WordPress malware removal service.
About the author: Hridoy Ahmed is an SEO specialist and WordPress security expert based in Dhaka, Bangladesh. He has 8+ years of experience and works with clients worldwide.