The clearest signs are a browser warning when you visit your own site, spam pages showing up in Google results for your domain, redirects that only happen for some visitors, and admin users you did not create. If any of those are true, assume you are infected and act now.
The harder situation is when nothing obvious is wrong. Most WordPress infections are not defacements. Nobody puts a skull on your homepage anymore, because that gets fixed immediately. The valuable hacks are quiet ones that use your site to host spam or redirect your visitors, and stay hidden for months.
Here are the seven signs, roughly in order of how often I run into them.
1. Google shows pages on your site that you never made
This is the most common one, and the easiest to check.
Go to Google and search for site:yourdomain.com. That shows you what Google has indexed from your domain.
You are looking for pages you do not recognize. Usually they are pharmacy spam, counterfeit goods, gambling, or essay writing services. Sometimes the titles are in a language you do not publish in. Japanese keyword spam is common enough to have its own name.
If your site has twelve pages and Google is showing four hundred, you have an answer.
2. A security warning appears when someone visits
If Chrome or Firefox shows a red interstitial saying the site ahead contains malware or is deceptive, Google’s Safe Browsing has flagged your domain.
Here is the part people miss. This warning often does not appear for you. Once you have clicked through it once, your browser stops showing it to you, so you can browse your own site all day thinking everything is fine while every new visitor sees a full-page red warning.
Check it properly: open your site in an incognito window, or use the Google Safe Browsing site status tool. Also check Search Console under Security Issues, which tells you directly if Google has flagged you.
3. Your site redirects, but only sometimes
This is the most frustrating one to diagnose, and it is deliberately designed that way.
Modern redirect malware is conditional. It checks who is visiting before deciding what to do. It will often send mobile visitors to a spam site while showing desktop visitors the normal page. It frequently ignores anyone who is logged in as an administrator, which means the site owner never sees it. Some variants only fire for visitors arriving from Google, and leave direct visitors alone.
So “it works fine when I check” is not evidence of anything.
Check it properly: open your site on your phone, on mobile data rather than your home wifi, logged out, arriving via a Google search rather than typing the URL. If clients have told you the site sent them somewhere strange, believe them even when you cannot reproduce it.
4. Admin users you do not recognize
Go to Users in your WordPress dashboard and look at every account with Administrator access.
Do you know all of them? Is there an account with a name like admin1, wpuser, or a random string? Check the registration dates. An administrator account created at 3am on a date you were not working is worth investigating.
Also look for accounts with an email address on a domain you do not recognize.
5. Files changed on dates you were not working
If you have access to your files through hosting or FTP, sort by last modified date.
WordPress core files should all share a date, the date of your last WordPress update. If a single file in wp-includes was modified three weeks after everything else, that is not normal.
Pay attention to wp-config.php and .htaccess. Those two are the most common targets, because .htaccess controls redirects and wp-config.php controls database access.
6. Your site got slower for no clear reason
Injected malware runs on every page load. It is doing work, and that work costs time.
This is not a reliable sign on its own, because sites slow down for plenty of innocent reasons. But a sudden drop in speed with no change on your end, no new plugin, no new content, no host migration, is worth ten minutes of checking. If you have ruled out the ordinary performance problems and the site is still slower than it was, look at security next.
7. Your host emails you, or suspends the account
Hosting companies run their own scans. When they find something, you get an email, and sometimes the account gets suspended before you get the email.
Take these seriously even when the email is vague. Hosts do produce false positives, but they have visibility into things you do not, like outbound spam being sent from your account.
What to do if you found something
First, and this matters: take a full backup before you touch anything. Files and database both, including the infected version. People’s instinct is to start deleting suspicious files immediately. Do not. If you delete the wrong thing you can break the site and lose the ability to see what happened. The infected copy is evidence.
Then:
- Change every password. WordPress admin, hosting, FTP, database, and the email account tied to your admin user.
- Remove admin accounts you do not recognize.
- Update WordPress core, all plugins and all themes.
- Run a scan with Wordfence or Sucuri to see what they detect.
- Ask your host whether they have a clean backup from before the infection date.
That last one is worth doing first, honestly. If you have a clean backup from before the compromise and you have not lost content since, restoring it is often faster than cleaning.
The part most people get wrong
Removing the malware is not the same as fixing the problem.
Almost every real WordPress infection installs a backdoor, which is a small piece of code that lets the attacker back in later. It is usually somewhere unglamorous, an innocuous-looking file in an uploads folder, or a few lines added to a legitimate plugin file.
If you clean the visible malware and leave the backdoor, the site gets reinfected. Usually within days. I have had people tell me they cleaned their site four times before working out why it kept coming back.
This is the reason a plugin scan on its own frequently is not enough. Free scanners are good at flagging known malware signatures. They are considerably weaker at finding a custom backdoor sitting in a file that looks completely ordinary.
If you are not confident you can find it, that is exactly the point at which it is worth getting the site cleaned properly and hardened rather than going another round.
Questions people ask
Can a WordPress site get hacked if it is kept updated? Yes, though it is much less likely. Most infections come in through an outdated plugin or theme, but weak passwords, a compromised hosting account and shared hosting neighbors are all real routes too. Updates reduce the risk substantially, they do not eliminate it.
How long does malware sit on a site before anyone notices? Often weeks or months. Modern infections are built to stay hidden, since a hacked site that still works is more useful to an attacker than one that visibly breaks. That is why searching site:yourdomain.com occasionally is worth the thirty seconds.
Will my Google ranking recover after a hack? Usually yes, if you clean it properly and request a review through Search Console. Rankings often dip while the site is flagged and recover over the following weeks. The damage is much worse if the infection sits there for months, because Google has had time to index all the spam pages.
Is a free security plugin enough? For prevention, a free plugin plus good passwords and prompt updates goes a long way. For cleaning a site that is already infected, free scanners often miss backdoors, which is why sites get reinfected after what looked like a successful cleanup.
Do I need to tell my customers? If the site handles customer accounts or takes payments and there is any chance data was accessed, yes, and depending on where your customers are, you may be legally required to. If it is a brochure site with no stored customer data, the practical risk to them is that they saw spam or a warning.
If you are not sure whether what you are seeing is a hack or something harmless, send me the URL and I will check it for free and tell you straight. If it is clean, I will say so. If it is not, I will tell you exactly what I found before you decide whether you want me to fix it.
