How to tell if your WordPress site has been hacked: fifteen checks that actually work

Something has made you suspicious. Maybe the site felt slow this morning, or a customer mentioned something odd, or you saw a login notification you did not expect. Maybe you just read about somebody else getting hacked and thought you had better check.

The frustrating thing about that moment is that there is no single button marked “am I hacked”. Loading your homepage tells you almost nothing, because the infections that matter are built to look normal to you specifically.

So here is what actually works, in the order we run it. The first four checks take about ten minutes between them and catch most of what is out there. The rest are for when you want to be certain.

The ten minute version

1. Search your own site in Google

Search for site:yourdomain.com. This shows only pages Google has indexed for your domain.

Two things to look at. First the page count: if you have a twelve page website and Google reports 9,000 results, that is your answer. Second, scroll through for anything in a language you do not publish in, or products you do not sell. Pharmaceuticals, replica goods and Japanese text are the classics.

Clean result: roughly the number of pages you would expect, all recognisable.

2. Check Search Console security issues

In Google Search Console, open Security & Manual Actions. If Google has spotted a compromise, it says so here, and it usually gives you example URLs.

While you are in there, look at Indexing > Pages and check the graph. A sudden vertical climb in indexed pages on a specific date is one of the clearest signals there is, and it dates the infection for you.

Clean result: “No issues detected”, and an indexing graph without cliffs.

3. Look at your administrator accounts

In WordPress, go to Users and filter by Administrator. Read every single one.

Any account you did not create, or that belongs to a developer who finished eighteen months ago, needs dealing with. Attackers frequently give these accounts ordinary looking names precisely so a quick glance skips over them. Check the email address on each account as well as the username, because the username can look entirely reasonable while the email points somewhere else.

When our own site was compromised in August, two administrator accounts had been created that nobody recognised. That was one of the clearest signals we had.

Clean result: every administrator is a person you can name.

4. Visit your site as a stranger

Take your phone off the office wifi, search for your business in Google, and click the result. Do not type the address in.

This one check defeats most conditional malware, which hides from logged in administrators and from direct visits but shows itself to search visitors on mobile. If you get redirected somewhere unexpected, you have found it, and our guide to the WordPress redirect hack covers what happens next.

Clean result: your site, looking like your site.

If you only do one of these, do this one. Almost every owner who tells us their site is fine has tested it while logged in, on a desktop, by typing the address directly. That is the one visitor the malware is written to fool.

If you want to be thorough

5. Check whether Google is warning about you

Search for your business name and look underneath the result for “This site may be hacked”. Then click through and watch for a full red interstitial. Each of the four warnings Google shows means something different, and we have written up what each one means and how to get it removed.

6. Look at your plugins list

Anything nobody remembers installing is worth investigating, as is anything with no author, no version number or a description that reads oddly. Also note which plugins have updates waiting, because the one that let them in is usually somewhere in that list.

7. Check your email is still arriving

Send yourself an invoice or a contact form notification from the site to an address on a different provider. Compromised sites are frequently used to send bulk spam, which gets the domain blacklisted, and the first business symptom is often that your quotes stop reaching people rather than anything visible on the website.

8. Look at when files were last modified

Through your hosting file manager or over SFTP, sort the WordPress folders by modification date. You are looking for files changed on a date when nobody touched the site. Core WordPress files that changed outside an update window are a strong signal.

One detail worth knowing: if a group of files all share the exact same timestamp, down to the second, that was a script rather than a person.

9. Open the mu-plugins folder

Look in wp-content/mu-plugins. Most sites either do not have this folder or have one or two files in it that a developer added deliberately.

It matters because anything placed here runs on every request and never appears in the WordPress plugins list. There is no activate toggle and nothing to see in the dashboard. It is one of the most common hiding places for a backdoor, and almost nobody checks it. This is precisely where we found a backdoor on a client site, which we documented in this write-up of a live infection.

10. Check the REST API namespaces

This is the technical one, and it is the check that found the infection in the post above.

Visit yourdomain.com/wp-json in a browser. You will get a wall of technical text. Look for the namespaces list near the top. Every entry should correspond to WordPress itself or to a plugin you recognise. An entry with a plausible but unfamiliar name, something like a fake update or fix plugin, is a backdoor advertising itself.

It is an odd place to look, which is exactly why attackers are relaxed about it.

11. Check your post revision history

Open a few of your important pages in the editor and scroll to Revisions. WordPress keeps a history of every change, including changes made by somebody who should not have been there. If a page was edited on a date nobody was working, the revision history will show you what changed and under which account.

It is an underused check and it is often the fastest way to date an infection precisely.

12. Check your site address settings

In Settings then General, confirm the WordPress Address and Site Address are both your own domain, and that the administration email is yours. Changing the admin email is a quiet way to intercept password resets, and changing the site address redirects the whole site in one move.

13. Look for PHP files in your uploads folder

Open wp-content/uploads in your hosting file manager and search for .php. There should be no results. Your media library holds images and documents, not executable code, so anything with a .php extension in there was put there by somebody else.

14. Check who has access to your Search Console

In Search Console, open Settings then Users and permissions. Attackers often add themselves as a verified owner so they keep access after a cleanup. If there is an owner you cannot name, that is a finding in its own right, and it needs removing along with the verification token they used.

15. Get a second opinion from outside the site

Run the domain through Google’s Safe Browsing site status page, Sucuri SiteCheck and VirusTotal. All three are free, none of them requires access to your site, and because they look from the outside they are not fooled by anything hiding on your server.

Symptoms, and what they usually mean

What you are seeing	Most likely cause
Customers redirected, site fine for you	Conditional redirect hack
Foreign language pages in Google	Japanese keyword hack, usually Balada Injector
Pharmaceutical pages or keywords in your titles	Pharma hack
Red browser warning	Safe Browsing flag, phishing or malware
Homepage replaced entirely	Defacement
Host suspended the account	Outbound spam or resource abuse
Emails suddenly landing in junk	Domain blacklisted, often after spam sending
Site suddenly slow	Cryptomining, spam sending, or an unrelated performance problem
White screen or critical error	Usually a plugin conflict or PHP change, not a hack
Cannot log in, password rejected	Credentials changed, or a login page injection

That last but one row is worth dwelling on. A white screen or a “There has been a critical error on this website” message feels like the worst thing that can happen, and it is almost never a compromise. It is usually an update that disagreed with something. We took one of those apart line by line in this post about a 3:27am outage.

If a check comes back badly

Two things not to do, both of which feel like the responsible reaction.

• Do not start deleting files that look suspicious. You will miss some, and you will have destroyed the trail to the rest.
• Do not restore an old backup over the top. It removes the evidence and restores the vulnerable plugin that let them in, so you get reinfected and now have no idea how.

Do change your hosting and administrator passwords, take a full copy of the site as it currently stands, and tell your host. Then get the cleanup done properly, either yourself or by someone who does it regularly. Our WordPress malware removal service covers the whole job including the search recovery afterwards.

Frequently asked questions

My security plugin says the site is clean. Is that enough?

It is evidence, not proof. Scanners match against known malicious code, so they are strong on common infections and weak on anything new, heavily obfuscated, or sitting in the database rather than in a file. The infection we found on a client site had been partially detected: one of the two files was flagged, the other was not.

How does a website get hacked in the first place?

Overwhelmingly through an out of date plugin or theme with a publicly known vulnerability. After that, weak or reused administrator passwords, and then shared hosting where a different site on the same server was compromised first. Targeted attacks on small business websites are rare. Automated scanning is constant.

How long do these usually go unnoticed?

Longer than owners expect. A defacement is found in minutes because it is obvious. A cloaked spam injection can run for months, and the first sign is often a customer complaint or a drop in enquiries that gets blamed on the market.

Is a small business website really a target?

You are not a target. That is the point. Nobody chose your site. A scanner tested millions of sites for one specific weakness, yours matched, and the exploit ran automatically. Size is irrelevant to a process that never looked at who you are.

Can I check without touching the site?

Yes. Checks one, two, four and five are all done from outside, using Google and your phone. You do not need to log in to anything except Search Console, and you cannot break anything by doing them.

---

Something came back that you did not like?

Send us what you found and we will tell you what it means. If it is nothing, we will say so. If it is a compromise, we will give you a fixed price to clean it and close the way in before it gets worse.

Marketing the Change is a digital marketing agency based in Liverpool. We manage WordPress sites for clients across the UK, which means we occasionally find things like this. When we do, we write about it.

\n\n