Is my WordPress site hacked? The eleven signs
Most compromises are quiet. Attackers want your server’s reputation, your visitors or your customers’ card numbers, and they keep that access longer if nobody notices. So the signs are often small. Here they are, roughly from most to least certain.
- An administrator account you didn’t create. This is the single clearest sign. Attackers add an admin so they can get back in after you clean up.
- Visitors are sent to another site. Often only some visitors: people arriving from Google, people on phones, or first-time visitors. You, logged in, may never see it.
- Spam pages in Google. Search for
site:yourdomain.comand look for pages you never wrote: pharmacy, casino, replica goods, or pages in Japanese or another language you don’t publish in. - A browser or Google warning. “Deceptive site ahead” or “This site may be hacked” under your result in search.
- Your host suspended the site or emailed you about malware, outgoing spam or unusual CPU use.
- Core files have changed. WordPress core files should be byte-for-byte identical to the official release.
- PHP files inside wp-content/uploads. Uploads should contain images and documents. A
.phpfile there is almost always a backdoor. - Plugins, mu-plugins or theme files you don’t recognise. Look especially in
wp-content/mu-plugins, which loads automatically and doesn’t appear in the normal plugin list. - Unexpected scripts in posts, widgets or settings. Injected
<script>tags often live in the database, not in files. - Scheduled tasks you didn’t add. A malicious cron event can re-infect the site every hour.
- The site is suddenly slow or sends mail you didn’t write. Weaker on its own, because plenty of innocent things cause it, but worth checking.
Why a hacked site redirects only some visitors
Conditional redirects are designed to hide from the site owner. The malicious code checks things like the referrer (did the visitor come from a search engine?), the user agent (is it a phone?), whether a WordPress login cookie is present, or whether this IP has visited before. If you are logged in and typing your own address, you look exactly like the person the code is told to leave alone.
To see what visitors see, open a private window on your phone using mobile data, search for your site on Google and click the result. If that lands somewhere else, the site is compromised. The redirect usually lives in one of three places: injected JavaScript in the database, a modified theme file such as header.php or functions.php, or rewrite rules added to .htaccess.
Five checks that confirm it
1. Check the user list
In WordPress admin, open Users and filter by Administrator. Every name should be someone you know. Attackers sometimes give accounts plausible names like “wpadmin” or “support”, so check the email addresses and registration dates too. With WP-CLI: wp user list --role=administrator.
2. Compare core files with the official checksums
WordPress publishes a checksum for every core file of every release. With WP-CLI, wp core verify-checksums lists every core file that is missing, added or modified. For plugins from WordPress.org, wp plugin verify-checksums --all does the same. A security plugin that checks core integrity does this from the admin screen; in Silent Threads it’s the Core File Integrity scanner, included on every plan.
3. Look for PHP in uploads
From SSH, find wp-content/uploads -name "*.php" should normally print nothing. Also look for files with double extensions such as image.jpg.php, and for recently modified files: find . -name "*.php" -mtime -7 lists PHP files changed in the last week.
4. Search the database
Look for <script, eval(, base64_decode and unfamiliar domains in wp_posts and wp_options. In wp_options, check that siteurl and home still point at your domain. Database scanners automate this; Silent Threads’s Database Scanner runs on every plan.
5. Ask Google
Add the site to Google Search Console and open Security & Manual Actions. Google lists the hacked URLs it found and the type of problem. You can also check any URL with Google’s Safe Browsing site status tool. Search Console is also where you request a review once the site is clean.
Things that look like a hack but usually aren’t
- A slow site after a plugin update, a traffic spike or a full disk.
- Failed login emails or lockouts. Bots try to log in to every WordPress site all day. Attempts are not a compromise; a successful login you didn’t make is.
- A security plugin flagging a file that turns out to be an obfuscated licence check in a premium theme. Check the file against a fresh copy from the vendor before deleting anything.
If you find a strong sign
Don’t start deleting files straight away. First take a full backup of the infected site (files and database) so you keep the evidence, then change your hosting, SFTP, database and WordPress passwords from a clean computer. After that, follow a clean-up plan: our guide to removing malware from WordPress goes through it step by step, and the hacked site recovery page explains how Silent Threads’s scanners help.
A strong sign plus a successful clean-up still leaves the question of how the attacker got in. The most common answers are an outdated plugin with a known vulnerability, a reused password, or a “nulled” premium plugin that arrived with a backdoor already inside. Close that door, or you will be doing this again next month.
How to notice sooner next time
The difference between a one-hour fix and a week of damage is usually how quickly you notice. Three things shorten that time a lot:
- An instant alert when a new administrator appears. Silent Threads sends one on every plan.
- Regular file and database scans, so changes are found by you and not by Google. Scans use 74 built-in malware signatures plus live signatures from the cloud feed.
- A firewall that blocks the common exploit attempts before they reach vulnerable code. Ours has 356 built-in rules on every plan.
For everything else, work through the WordPress security checklist.
How we checked this guide
The commands in this article are standard WP-CLI and shell commands documented by WordPress. The signs come from common, publicly documented infection patterns. Plugin features mentioned are limited to what Silent Threads actually includes, with the plan named where it matters.