Most hacked WordPress sites are found by accident. A customer mentions a strange redirect, the host suspends the account, or Google puts a red warning over your search results. By then the attacker has usually had access for days or weeks.
This guide covers how to confirm a hack quickly and what to do first, in the right order, so you don't destroy the evidence or leave a backdoor behind.
The 9 most common signs
| Sign | What it usually means |
|---|---|
| Google shows "This site may be hacked" or a red "Deceptive site ahead" page | Google found spam pages, malware or phishing on your domain |
| Visitors from Google or on mobile are redirected to spam, but you are not | A redirect that targets search and mobile traffic and hides from logged-in admins |
| Search results show pages in Japanese, or for pills, casinos or replica goods | Thousands of spam pages were added to rank on your domain's reputation |
| An admin user you don't recognise | The attacker created their own login so they can come back |
PHP files inside wp-content/uploads |
Uploads should only hold images and documents. PHP there is almost always a backdoor |
| Your host suspends the account or reports outgoing spam | Scripts on the site are sending email or attacking other servers |
| The site is suddenly slow or CPU usage spikes | Spam pages, crypto miners or attack scripts are running |
Core WordPress files changed (index.php, wp-config.php, .htaccess) |
Code was injected to load malware on every request |
| Unknown scheduled tasks (cron jobs) | The attacker set up a task that reinfects the site after you clean it |
One sign is enough to investigate. Two or more and you should assume the site is compromised.
How to confirm it in 10 minutes
1. Check what Google sees
Search Google for site:yourdomain.com. Scroll a few pages. Any titles you didn't write, or results in another language, mean spam pages were injected.
Then open Google Search Console, and go to Security & Manual Actions → Security issues. If Google flagged the site, it lists the problem and sample URLs.
2. Verify WordPress core and plugin files
If you have SSH access and WP-CLI, these commands compare your files with the official copies from WordPress.org:
cd /path/to/your/site
wp core verify-checksums
wp plugin verify-checksums --all
Any file listed as changed or "should not exist" needs a closer look. Premium plugins that aren't on WordPress.org will show as unverifiable; that alone isn't a problem.
3. Look for PHP files where they don't belong
find wp-content/uploads -type f -name "*.php"
On a clean site this normally returns nothing. Also list PHP files changed in the last 7 days:
find . -type f -name "*.php" -mtime -7 -printf "%TY-%Tm-%Td %p\n" | sort
If you didn't update anything this week but files changed, that is a strong sign of tampering.
4. Search for common malware patterns
grep -rlE "eval\(base64_decode|gzinflate\(base64_decode|str_rot13\(|assert\(\\\$_(POST|GET|REQUEST)" --include=*.php .
Legitimate plugins occasionally use some of these functions, so a match isn't proof. But obfuscated code at the very top of a file, or in a file with a random name, almost always is.
5. Check users, site URLs and scheduled tasks
wp user list --role=administrator
wp option get siteurl
wp option get home
wp cron event list
Look for admins you don't recognise, site URLs pointing to another domain, and cron events with random names.
What to do first, in this order
The order matters. Deleting files before you know how the attacker got in usually means they come back.
Back up the site exactly as it is. Files and database. This is your evidence and your safety net if a cleanup step breaks something. Store it off the server.
Limit the damage. If the site is redirecting visitors or sending spam, put it in maintenance mode or block public access while you work.
Change every password. Hosting control panel, SFTP and SSH, the database user, and every WordPress administrator. Then reset the WordPress secret keys so all existing logins are kicked out:
wp config shuffle-saltsFind the way in. Check your hosting access logs around the time the first bad file appeared. The usual causes are an outdated plugin or theme with a known vulnerability, a stolen or weak admin password, or another hacked site on the same hosting account.
Clean or replace, never just patch. Reinstall WordPress core from a fresh copy, keeping your content:
wp core download --force --skip-contentReinstall every plugin and theme from the official source rather than trying to clean them by hand. Delete anything you don't use. Remove the backdoors you found in
uploads, unknown admin users, and bad cron events. Check the database for injected scripts in posts and in thewp_optionstable.Update everything. WordPress, every plugin, every theme and the PHP version on the server.
Ask Google to review the site. In Search Console, go to Security issues and click Request review, briefly explaining what you fixed.
How to stop it happening again
Keep WordPress, plugins and themes updated, and remove anything you don't use. Most WordPress hacks start with a known, already-fixed vulnerability.
Turn on two-factor authentication for every administrator.
Stop editing PHP files from the dashboard by adding this to
wp-config.php:define( 'DISALLOW_FILE_EDIT', true );Put a web application firewall in front of the site, such as Cloudflare, or a firewall at server level.
Give each site its own hosting account or system user, so one hacked site can't infect the rest.
Take daily off-site backups and test a restore at least once a quarter.
Monitor file changes and uptime so you hear about a problem before your customers do.
When to call a professional
Do it yourself if you're comfortable on the command line, the site is small, and you found the cause. Bring in help if the site processes payments or stores customer data, the hack keeps coming back, several sites on the same server are affected, or the host has suspended the account. In those cases a missed backdoor costs more than the cleanup.
If you'd like us to handle it, our website repair team cleans hacked WordPress sites, closes the hole that let the attacker in, and hardens the server so it doesn't happen again. For ongoing protection, server security monitoring watches for file changes, malware and failed logins around the clock.
