We Found Live Malware on a WordPress Site This Week. Here’s Exactly What It Looked Like.

It started with a routine security check.

The site looked fine. No warnings in the browser, no defaced pages, no spam links in the footer. A visitor would have noticed nothing. The client had noticed nothing. But buried in the WordPress REST API response, in a list of technical namespaces most people never look at, was a name that had no business being there: wp-fixplugin/v1.

That one anomaly unravelled a two-component malware infection that had been live for two days. Both files were placed on the server in the same second. One had already been partially detected by a security scanner. The other had not been detected at all.

Here is exactly what we found, how it worked, and what you should check on your own site right now.

How WordPress Sites Get Hacked (It is Probably Not What You Think)

The most common thing we hear from site owners after a hack is some version of: “Why would anyone target us?”

They would not. That is the point.

The vast majority of WordPress compromises are not targeted attacks at all. Automated scanners probe millions of WordPress sites continuously, looking for known vulnerabilities in specific plugin versions. When a scanner finds a match, it does not stop to consider whether the site belongs to a multinational or a local business. It runs the exploit and moves on. The whole process takes seconds.

This is why the timestamp on the two malicious files in the incident we investigated was identical. Not the same minute, not the same hour: the same second. A human browsing a file system does not work that way. An automated deployment script does.

The entry point is almost always a plugin that has not been updated. Plugin developers issue security patches regularly, often in response to publicly disclosed vulnerabilities. Once a vulnerability is public, every site still running the old version becomes a target. The window between disclosure and exploitation is often measured in hours, not days.

Signs Your WordPress Site Has Been Hacked

The infection we found left no visible traces. But that is not always the case. Here are the most common indicators that a WordPress site has been compromised:

• Google is showing a warning. If visitors see “This site may be hacked” or a red warning page before reaching your site, Google has already flagged it. Check Search Console for manual actions.
• Your site redirects to somewhere else. Visitors land on a different site entirely, often a spam page or a phishing site. This is one of the most common signs of a WordPress hack.
• Spam emails are being sent from your domain. If contacts are receiving emails you never sent, or your domain ends up on an email blacklist, your site or server may be the source.
• You cannot log in. Your password stops working, or your account no longer exists. Attackers often change admin credentials after gaining access.
• New admin accounts you do not recognise. Go to Users and filter by Administrator. Any account you did not create yourself needs investigating immediately.
• Your host has suspended the account. Reputable hosts scan for malware and suspend sites that are actively attacking other servers or distributing malicious code.
• Pages or posts you did not write. Injected spam content, often in languages you do not recognise, is a common side effect of search engine spam attacks.

The absence of these signs does not mean your site is clean. The malware we found showed none of them. Its entire purpose was to stay hidden.

What the Malware Actually Did

This infection used two files working together. Removing one without the other would have left the site still compromised.

Component One: The Remote Control Door

The first file was placed inside a folder called mu-plugins.

Most WordPress users have never heard of this folder, which is exactly why attackers use it. mu-plugins stands for “must-use plugins.” Files placed here load automatically on every page request and do not appear anywhere in the WordPress admin panel. There is no plugins list entry, no activate/deactivate toggle, no version number. The folder is functionally invisible to anyone who does not know to look for it.

The file registered three hidden REST API endpoints:

• /wp-fixplugin/v1/update: accepts an encrypted payload along with a key and encryption parameters. In plain terms, the attacker can send an encrypted instruction from anywhere in the world and have it executed on the server.
• /wp-fixplugin/v1/status: a heartbeat check, confirming the backdoor is still active.
• /wp-fixplugin/v1/remove: a self-destruct, allowing the attacker to clean up their tracks on command.

This is a command-and-control backdoor. With the right key, whoever placed it there could run any code on the server, read any file, modify any database record, or pivot to other sites hosted on the same account. The Jetpack security scanner, which had run a full scan of the site that morning, did not flag this file.

Component Two: The Hidden Administrator

The second file was disguised as a plugin called “WordPress Cache Optimizer.” Cache optimisation is a legitimate, boring, entirely plausible reason for a plugin to exist. It is exactly the kind of name a site owner skims past without a second thought.

This one Jetpack did catch, with two separate threat signatures. The plugin did two things. First, it created a secret administrator account on every page load, ensuring that even if the account were deleted, it would simply be recreated the next time someone visited the site. Second, it hooked into WordPress’s own user query system to strip that account from every list, every search, and every admin screen. The user existed in the database. It simply did not appear anywhere a site owner would look.

The two components worked together: the hidden admin account provided a persistent login if the backdoor were ever removed, and the backdoor provided remote code execution if the hidden account were ever deleted. Redundant access, two different methods.

How to Check Your Own WordPress Site Right Now

These checks take less than five minutes and require no specialist tools.

• Check the REST API namespace list. Go to yourdomain.com/wp-json/ in your browser. Look through the list of namespaces. You should be able to match every one to a plugin or theme you recognise. Anything unfamiliar is worth investigating.
• Check your mu-plugins folder. Go to yourdomain.com/wp-content/mu-plugins/. If your server has directory listing enabled, you will see the files inside. Any file you do not recognise, particularly a large one, is a red flag.
• Run a Jetpack scan. If you have Jetpack installed, go to Jetpack and trigger a scan. It will not catch everything, as this case demonstrates, but it covers a significant proportion of known malware signatures.
• Check your user list carefully. In WordPress admin, go to Users and filter by Administrator. Count them. Any account you do not recognise deserves immediate attention.
• Look at your active plugins list critically. Any plugin with a generic name you do not remember installing is worth scrutiny. “Cache Optimizer,” “Performance Booster,” and “Security Enhancer” are exactly the kinds of names attackers use.

If Your WordPress Site Has Already Been Hacked: What to Do First

Order matters here. Done wrong, a cleanup can leave a site still compromised.

1. Do not just change passwords and hope for the best. If the attacker placed a backdoor file, changing passwords will not remove it. The file will still be there and still work.
2. Identify and remove the malicious files first. Check mu-plugins, check your plugin folders, and run a scanner. Only then is the server actually clean.
3. Find and delete any accounts you did not create. Once the file hiding them is removed, they should become visible in your user list.
4. Change all passwords after the cleanup, not before. Resetting passwords while a backdoor is still active is pointless. The attacker can simply create a new account or use the backdoor to reset credentials again.
5. Check server access logs. Your host can tell you when and how the malicious files were uploaded. This tells you which plugin or credential was the entry point, so you can close it properly.
6. Restore from backup if in doubt. If you cannot be certain the site is clean, a known-good backup is faster and more reliable than trying to find every file an attacker may have modified.

What Good WordPress Security Actually Looks Like

None of this requires expensive tools or a dedicated security team. Most WordPress compromises are entirely preventable.

• Keep every plugin updated. This is not optional. The gap between a vulnerability being disclosed and automated scanners exploiting it is shrinking. Plugins on old versions are open doors.
• Fewer plugins means a smaller attack surface. Every plugin you are not actively using is a potential entry point with no benefit in return. Deactivate and delete anything you do not need.
• Enable your firewall. Jetpack includes a Web Application Firewall that many sites have installed but never switched on. Either enable it or use an alternative like Wordfence.
• Disable directory listing. Your server should not allow visitors to browse your file structure. Add Options -Indexes to your .htaccess file, or ask your host to disable it.
• Have someone check the site properly once a year. A scan and a manual review of users, plugins, and the REST API namespace list takes about an hour and catches things automated tools miss.

Frequently Asked Questions

Has my WordPress site been hacked?

Common signs include: Google showing a warning to visitors, your site redirecting to another domain, new administrator accounts you do not recognise, spam being sent from your email domain, or your host suspending your account. That said, sophisticated malware often leaves none of these signs. If you are unsure, check your mu-plugins folder, your full user list, and the REST API namespace list at yourdomain.com/wp-json/.

Why does WordPress get hacked so much?

WordPress itself is not the problem. The core software is well-maintained and patched quickly when vulnerabilities are found. The issue is scale and the plugin ecosystem. WordPress powers around 43% of all websites, which makes it worth automating attacks against. And with thousands of third-party plugins, each with their own update cycles and security track records, there are a lot of potential entry points. One unpatched plugin on one site is all it takes.

Is WordPress safe from hackers?

WordPress core, kept up to date, is reasonably safe. The risk comes from plugins and themes, particularly ones that are not updated regularly or that have known vulnerabilities. A WordPress site with a small number of well-maintained plugins, a firewall active, and regular updates applied is significantly harder to compromise than one that has not been touched in eighteen months.

What should I do immediately if my WordPress site has been hacked?

Do not just change passwords and assume the problem is solved. If a backdoor file has been placed on your server, it will still be there and still function regardless of your login credentials. The priority is identifying and removing the malicious files first, then finding and deleting any accounts the attacker created, and only then resetting all passwords. If you are not confident in doing this yourself, get someone to do it properly rather than doing it halfway.

Can a hacked WordPress site be recovered without a backup?

Yes, in most cases. Malware typically adds files rather than deleting your content, so recovery usually involves finding and removing the malicious code and accounts rather than rebuilding from scratch. A backup makes the process faster and more certain, but it is not always necessary. The harder part is identifying everything the attacker left behind, which is why a professional cleanup is often worth the investment.

---

Think your WordPress site might be compromised?

If you found something in the checks above, or you just want a second pair of eyes on your site before something goes wrong, we can take a look. This is something we do regularly, and the earlier we look, the less there is to clean up.

Marketing the Change is a digital marketing agency based in Liverpool. We manage WordPress sites for clients across the UK, which means we occasionally find things like this. When we do, we write about it.