A hacked WordPress site rarely announces itself. Attackers want to stay hidden for as long as possible so they can send spam, redirect your visitors, or mine your traffic for profit. That means the damage is usually well underway by the time you notice something is off. The good news: compromised sites almost always leak tells. If you know what to look for, you can catch an intrusion early — before Google blacklists you and your customers stop trusting your brand.
Below are ten concrete signs that your site is already compromised, followed by what to do first and why speed matters more than almost anything else.
You do not need to confirm all ten signs. A single confirmed indicator — one rogue admin account, one unexpected redirect — is enough to treat the site as compromised and start containment immediately.
The 10 signs your WordPress site is compromised
1. Unexpected redirects
You (or worse, your visitors) type your address and land on a sketchy pharmacy, gambling, or adult site. Redirect hacks are one of the most common WordPress infections. They often trigger only for visitors coming from Google or only on mobile devices, which is why the site can look perfectly normal when you load it directly. Always test in an incognito window and from your phone on cellular data.
2. Spammy pages or posts you did not create
Attackers inject hundreds or thousands of hidden pages — often selling counterfeit goods or pharmaceuticals — to piggyback on your domain's reputation in search results. Check your total page and post counts, and search Google for site:yourdomain.com to see if pages appear that you never published.
3. Google flags you: "This site may be hacked"
If a gray warning label appears under your listing in search results, Google's crawlers have already detected injected content or spam. It is a public signal that erodes trust the moment potential customers see it — and it is one of the clearest confirmations that something is wrong.
4. New admin users you did not add
Open Users → All Users and look for administrator accounts you do not recognize, especially ones with odd usernames or generic email addresses. A rogue admin gives an attacker a permanent, legitimate-looking way back in even after you clean the site.
5. Sudden, unexplained slowdowns
Malware consumes resources. If your site suddenly crawls, times out, or your host emails you about excessive CPU usage, a compromise may be running background tasks — sending spam email, brute-forcing other sites, or serving hidden pages — on your dime.
6. Your host or a blacklist has flagged you
Being added to a blacklist like Google Safe Browsing or Spamhaus means browsers may show a red interstitial warning before anyone can reach your site, and your emails may start bouncing. Blacklisting is downstream of an infection — by the time it happens, the hack has usually been active for a while.
7. Strange files in your WordPress directories
Look for files with random names, PHP files inside /wp-content/uploads/ (which should only hold media), or core files with recent modification dates you cannot explain. These are frequently backdoors or web shells left behind so the attacker can return.
8. Unfamiliar scheduled tasks (cron jobs)
WordPress runs scheduled events through WP-Cron. Malware often adds its own tasks to re-infect the site, phone home, or send spam on a timer. A cron entry you do not recognize is a strong sign of persistence — and a reason a "cleaned" site keeps getting re-infected.
9. Security plugin or file-integrity alerts
If a security plugin reports that core files have changed, or that files were added or modified outside of an update, take it seriously. WordPress core files should match the official distribution exactly. Any difference is worth investigating.
10. Customers or your inbox tell you first
Sometimes the earliest warning is a customer emailing that your site "sent them somewhere weird," a flood of password-reset emails, or spam complaints tied to your domain. When the outside world notices before you do, assume the compromise is well established.
Cloaking is standard. Many infections deliberately hide from logged-in administrators and from direct visits, showing the malicious payload only to search-engine referrals or first-time visitors. That is why "it looks fine to me" is never proof the site is clean.
What to do first
If you have confirmed even one sign, resist the urge to start deleting files at random. Move in a deliberate order so you contain the damage without destroying the evidence you need to find the root cause.
- Take a full backup right now — files and database, exactly as they are. You need a snapshot of the infected state before you change anything.
- Put the site into maintenance mode or take it offline to stop serving malware to visitors and to prevent further blacklisting.
- Change every password — WordPress admin accounts, hosting control panel, database, and FTP/SFTP. Force a logout of all sessions.
- Remove unrecognized admin users, but note their details first so you can trace how they got in.
- Scan and identify the malicious files and the entry point. Cleaning the symptoms without closing the door means you will be reinfected within days.
- Update everything — WordPress core, themes, and plugins — and delete anything you are not actively using.
- Request a review from Google Search Console and any blacklists once the site is verifiably clean.
Restoring a pre-hack backup can bring the site back temporarily, but if the vulnerability that let attackers in is still present — an outdated plugin, a weak password, a leftover backdoor — you will be compromised again. Fix the root cause, not just the visible damage.
Why speed matters
Every hour a compromised site stays live, the cost climbs. Google can blacklist the domain, which tanks your search visibility for weeks even after cleanup. Your host may suspend the account to protect its network. Attackers dig in deeper, planting additional backdoors so a partial cleanup fails. And every visitor who hits a redirect or a browser warning is a customer who may never come back. A fast, thorough response is the difference between a quiet cleanup and a reputation problem that follows your brand for months.
If you are already seeing these signs, professional help pays for itself quickly. Wurdey handles hacked WordPress cleanup and thorough malware removal — not just scrubbing the visible payload, but finding the entry point, removing backdoors, and getting you delisted. To prevent the next incident, ongoing maintenance packages keep core, themes, and plugins patched, while proactive WordPress security hardening closes the gaps attackers exploit in the first place.
- A single confirmed sign — a rogue admin, an unexpected redirect, a Google warning — is enough to treat the site as hacked.
- Many infections cloak themselves, showing malware only to search visitors or new users, so "it looks fine to me" proves nothing.
- Back up the infected state, change all passwords, and identify the entry point before deleting anything.
- Fix the root cause, not just the symptoms — restoring a backup over an unpatched hole leads straight back to reinfection.
- Speed is everything: fast action limits blacklisting, host suspension, and lasting damage to your reputation.
When a client comes to us with a suspected compromise, we contain the site first, take a forensic snapshot, then find and close the entry point so the fix actually holds. If you think your site might be hacked, don't wait for it to get worse — get in touch with Wurdey and we'll take it from here.
Next step
Rather not do all this yourself?
Wurdey care plans handle updates, backups, security and monitoring for one monthly price, hosting included, from $49 a month. Free migration, and a real team on the other end.