Most business owners find out their website has been hacked from a customer: a strange redirect, a warning in Google, or an email that never arrived. By then the problem has usually been there for weeks. These are the five signs we see most often when we clean up WordPress sites, and the first things to do when you spot one.
1. Visitors are redirected to spam or scam sites
The classic sign. Your site loads for you, but some visitors, often those arriving from Google on a phone, land on a betting, pharmacy or fake prize page instead. Hackers hide these redirects so that logged-in admins never see them. Test by opening your site in a private window on your phone, using mobile data, from a Google search result.
2. Admin users you did not create
Go to Users in your dashboard and filter by Administrator. Any account you do not recognise, especially one with a random-looking name or an email address you have never seen, should be treated as a sign of a compromise until proven otherwise. Attackers often create a spare admin so they can get back in after you clean up.
3. Google shows a warning or strange search results
Search for site:yourdomain.com. If you see pages you never wrote, often in Japanese or full of product and casino keywords, your site is being used for spam. Google may also show “This site may be hacked” under your listing, and Search Console will report it under Security issues.
4. Your host suspends the site or reports high resource use
Hacked sites are often used to send spam email or attack other websites. Your host may notice the spike in activity before you do and suspend the account, or send you a malware notice. Do not ignore these emails.
5. Files, plugins or code you do not recognise
Unfamiliar plugins in your plugin list, PHP files in your uploads folder, or long blocks of scrambled code at the top of theme files are all red flags. A security plugin such as Wordfence or Sucuri can scan for many of these, but scanners do not catch everything.
What to do first
- Do not delete everything in a panic. Take a full copy of the files and database first. You may need it to work out how the attacker got in.
- Change every password: WordPress admins, hosting control panel, FTP or SFTP, and the database. Use a password manager and unique passwords.
- Remove admin users you did not create, and log everyone out.
- Restore a clean backup or clean the site properly. A backup from before the hack is the fastest route, if you know when the hack happened. Otherwise every file and the database need checking, not just what a scanner flags.
- Close the hole. Update WordPress, every plugin and the theme, and remove anything nulled, abandoned or unused. Most hacks come in through an outdated plugin.
- Ask Google to review the site in Search Console once it is clean, so the warning is removed.
Cleaning a hacked site properly takes time, and partial cleanups are the main reason sites get reinfected. If your site has been hacked, get in touch and we will remove the malware, close the gap it came through and harden the site. To stop it happening again, our Website Care plans keep everything updated, backed up and monitored every month.
