7
Your WordPress website can look perfectly normal while malicious code is quietly operating in the background. Hackers may inject spam links, create unauthorized administrator accounts, redirect visitors to dangerous websites, modify files, or use your server to distribute malware.
The difficult part is that not every hacked WordPress website looks obviously hacked. Some compromises are designed to remain hidden for as long as possible.
WordPress itself lists several indicators of compromise, including search-engine blacklisting, malware warnings, unauthorized users, disabled websites, and visible changes to the site.
In this guide, we’ll cover the most common signs of WordPress malware, what they mean, what you should do if you discover them, and how to reduce the chances of your website being compromised again.
What Is WordPress Malware?
WordPress malware is malicious code, files, scripts, or unauthorized modifications that have been introduced into a WordPress website.
Malware can be placed in:
- WordPress core files
- Plugins
- Themes
- Uploaded files
.htaccess- Database content
- JavaScript files
- PHP files
- User accounts
- Server configuration
A compromised plugin or theme isn’t necessarily the original cause of an attack. Malware can potentially be inserted into files after an attacker gains access to the server or website.
Attackers may use compromised websites for several purposes, including:
- Redirecting visitors
- Injecting advertisements or spam
- Stealing information
- Creating hidden administrator accounts
- Sending spam emails
- Hosting phishing pages
- Distributing malware
- Manipulating search-engine results
- Using server resources for malicious activity
12 Signs Your WordPress Website May Have Been Hacked
1. Your Website Redirects Visitors to Another Website
One of the most noticeable symptoms is an unexpected redirect.
You enter your normal domain, but instead of seeing your website, you’re sent to another page. The destination could be a spam website, fake download page, gambling site, phishing page, or another suspicious domain.
Sometimes the redirect only happens under certain conditions—for example, on mobile devices, for users coming from search engines, or when visiting a particular page.
This can make the malware difficult to detect because the website may appear normal to the administrator.
What to check
Test your website:
- In an incognito/private browser window
- On a mobile device
- From a different network
- From a search-engine result
- While logged out of WordPress
If different visitors consistently experience unexpected redirects, investigate the website immediately.
2. Strange Pop-Ups or Spam Appearing on Your Pages
Another common warning sign is unexpected content.
You might suddenly see:
- Casino advertisements
- Adult-content links
- Cryptocurrency promotions
- Fake virus warnings
- Download buttons
- Pharmaceutical advertisements
- Spam articles
- Hidden links
Sometimes these changes aren’t visible when you’re logged into WordPress. Malware can be configured to show content only to particular visitors.
If you notice content that you didn’t create or authorize, treat it as a potential security incident.
3. Google Shows a Malware or Security Warning
Your website may be working normally for you, but visitors may receive a browser warning.
For example, a browser can display a warning that the site contains malware or dangerous content.
Search engines and security services can also flag compromised websites. WordPress specifically identifies malware warnings and search-engine blacklisting as indicators that a website may have been hacked.
This is particularly serious because visitors may stop accessing your website even if the site itself appears normal to you.
What should you do?
Check:
- Google Search Console
- Your browser’s security warning
- Your hosting provider’s security notifications
- A reputable website malware scanner
Don’t simply ignore the warning after removing the visible problem. A compromised website can contain additional malicious files that aren’t immediately obvious.
4. Unknown Administrator Accounts Appear
Log in to:
WordPress Dashboard → Users → All Users
Look for accounts that you don’t recognize.
Pay particular attention to accounts with:
- Administrator privileges
- Strange usernames
- Unfamiliar email addresses
- Recently created accounts
- Unusual registration dates
WordPress identifies unauthorized user creation as a potential indicator of compromise.
An unknown administrator account can be especially dangerous because an attacker may use it to regain access after you remove the original malware.
Don’t immediately delete everything without investigation, particularly if you’re dealing with a business website and need to preserve evidence or determine how the compromise occurred.
5. Your Website Becomes Extremely Slow
A sudden performance problem can sometimes be a security warning.
For example, malware may cause your server to perform additional tasks, make external requests, generate spam pages, or send large volumes of unwanted traffic.
However, slow performance doesn’t automatically mean your website has malware.
Other causes include:
- Hosting problems
- Poorly optimized plugins
- Large images
- Database issues
- Traffic spikes
- Server configuration problems
- Broken scripts
Therefore, slow performance should be treated as a symptom worth investigating rather than proof of a hack.
6. Your Hosting Provider Suspends Your Website
Hosting companies may temporarily disable a website if their systems detect malicious activity.
You might receive a message saying your account or website has been suspended because of:
- Malware
- Phishing
- Spam
- Excessive resource usage
- Suspicious scripts
- Outgoing attacks
WordPress recommends contacting your hosting provider when investigating a suspected compromise because the host may have information about server activity or problems affecting other sites on the same server.
Ask your hosting provider for details about:
- Which files were detected
- When the activity started
- What type of malware was detected
- Whether other sites on the account were affected
- Whether server logs are available
7. Your WordPress Files Have Been Modified
Unexpected file modifications are another major warning sign.
Important files that deserve attention include:
wp-config.php.htaccessindex.phpfunctions.php- Theme files
- Plugin files
- JavaScript files
WordPress’s hacked-site documentation specifically recommends examining files such as .htaccess, index.php, header.php, footer.php, and functions.php during remediation.
You may find suspicious code containing:
- Obfuscated PHP
- Unexpected JavaScript
- Encoded strings
- Unknown functions
- External URLs
- Recently modified files
- Newly created PHP files
Don’t assume every unfamiliar line of code is malware. Some legitimate plugins and themes contain complex or encoded code. A proper comparison against a known-clean version is safer than deleting code simply because it looks strange.
8. Your Website Contains Hidden Spam Links
Hackers sometimes inject links into pages that are difficult for normal visitors to notice.
For example, you might find:
Buy cheap products here…
or hundreds of pages containing unrelated keywords.
These pages may be designed specifically for search engines rather than your normal visitors.
Signs can include:
- Strange URLs in Google results
- Pages you never created
- Foreign-language spam pages
- Unrelated product keywords
- Thousands of newly indexed URLs
- Hidden links in the footer
This type of compromise can damage both your website’s reputation and its search visibility.
9. Your WordPress Password Suddenly Stops Working
If your WordPress administrator password stops working unexpectedly, investigate.
Possible explanations include:
- Someone changed the password
- Another administrator changed it
- Your account was compromised
- Your hosting environment was compromised
- Your authentication system has a problem
If you suspect unauthorized access, don’t only change the WordPress password. Consider changing other credentials associated with the website as well.
WordPress.com currently recommends resetting the account password, WordPress administrator passwords, and SFTP/SSH credentials when a compromise is suspected.
10. Your Website Sends Spam Emails
A hacked WordPress website can sometimes be abused to send unwanted email.
You may notice:
- Email delivery problems
- Spam complaints
- Your domain appearing on email blocklists
- Unexpected messages sent from your domain
- Your hosting provider contacting you about outgoing email
WordPress notes that compromised websites can be abused to send spam and that email blacklisting can become an issue.
If this happens, investigate both the website and your email infrastructure.
11. Your Security Plugin Detects Malware
Security plugins and external scanners can detect suspicious files or behavior.
Depending on the tool, a scan may identify:
- Modified core files
- Suspicious PHP files
- Malware signatures
- Backdoors
- Modified plugins
- Malicious JavaScript
- Suspicious URLs
- File integrity changes
WordPress’s official hacked-site documentation lists both application-level scanners and remote scanners as useful parts of an investigation.
6
Important
A single scanner should not necessarily be treated as absolute proof.
False positives can happen, and malware can sometimes evade individual scanners. For serious incidents, combine:
- File integrity checks
- Server logs
- Security scans
- WordPress activity logs
- Hosting information
- Manual investigation
12. Your Website Suddenly Behaves Differently
Sometimes the warning signs don’t fit neatly into one category.
You may notice:
- Pages disappearing
- Settings changing
- Plugins activating or deactivating
- New redirects
- Strange JavaScript
- Broken forms
- Unknown admin users
- Unexpected database changes
- Unusual traffic
- Search results showing strange pages
If something changed without authorization, don’t automatically assume it’s just a WordPress bug.
Document the behavior and investigate.
WordPress recommends documenting what you observed, when you noticed it, and what changes were made around that time.
What to Do If Your WordPress Website Has Been Hacked
If you believe your website has been compromised, avoid randomly deleting files.
A more organized response can prevent additional damage.
Step 1: Stay Calm and Document Everything
Record:
- The symptoms
- The affected URLs
- When you first noticed the problem
- Screenshots
- Security warnings
- Unknown users
- Recent plugin/theme changes
- Hosting notifications
WordPress recommends documenting the incident before beginning remediation.
Step 2: Create a Backup
Before making major changes, preserve a copy of the current website if your situation allows.
You may need:
- Website files
- Database
- Server logs
- Access logs
- Security scan reports
Even an infected copy can sometimes be useful for determining what happened.
Important: Don’t treat an infected backup as a clean backup.
Step 3: Scan the Website
Run a malware/security scan using a reputable security solution.
You can also use a remote scanner to look at what visitors are seeing.
Using more than one method can help because different scanners inspect different parts of a website. WordPress recommends considering both application-level and remote scanning approaches.
Step 4: Check Your Hosting Account
Contact your hosting provider if the compromise appears serious.
Ask whether they can provide:
- Malware reports
- Access logs
- Error logs
- File modification information
- Suspicious login information
- Account-level security events
A compromised hosting account can affect more than one website, particularly in shared hosting environments.
Step 5: Change Your Passwords
After you’ve begun the cleanup process, reset relevant credentials.
These may include:
- WordPress administrator passwords
- Other WordPress user passwords
- Hosting account password
- SFTP password
- SSH credentials
- Database credentials
- FTP credentials
- Email passwords
- API keys
Use long, unique passwords.
If credentials were stolen, changing only the WordPress administrator password may not be sufficient.
Step 6: Update WordPress, Plugins and Themes
Outdated software is a major security concern.
Update:
- WordPress core
- Plugins
- Themes
- PHP, where appropriate
- Other server software
WordPress recommends keeping the installation updated, and its security documentation explains that the project releases security fixes for vulnerabilities in the ecosystem.
Don’t install pirated or “nulled” plugins and themes. These can introduce malicious code and create serious security risks.
Step 7: Remove Unused Plugins and Themes
If you don’t need a plugin or theme, remove it rather than leaving it installed indefinitely.
Also check for:
- Plugins you don’t remember installing
- Old plugins
- Abandoned plugins
- Duplicate plugins
- Suspicious themes
- Unused administrator accounts
Reducing the number of components in your WordPress installation reduces the amount of software that needs to be maintained.
Step 8: Check for Backdoors
A backdoor is a mechanism that allows unauthorized access to a website.
Backdoors can be hidden in:
- Plugin files
- Theme files
- Upload directories
- Core files
- Database entries
.htaccess- Cron jobs
- New administrator accounts
This is one reason simply removing the visible spam page may not solve the problem.
An attacker could have installed another mechanism that allows them to return later.
Step 9: Restore From a Known-Clean Backup When Appropriate
If you have a backup from before the compromise, restoring it can be an effective part of remediation.
But you need to be careful.
If the backup was created after the compromise, it may contain the malware too.
After restoring, update WordPress and its components, change credentials, and investigate how the attacker originally gained access.
How to Prevent WordPress Malware
6
Prevention is easier when security becomes part of routine website maintenance.
1. Keep WordPress Updated
Install security updates promptly.
This applies to:
- WordPress core
- Plugins
- Themes
- Server software
2. Use Strong, Unique Passwords
Never reuse your WordPress administrator password on another service.
If another service suffers a breach, attackers may try the same credentials against your WordPress site.
3. Enable Two-Factor Authentication
Two-factor authentication adds another authentication step beyond the password.
WordPress.com recommends enabling two-step authentication when securing an account after suspected compromise.
4. Use a Security Plugin or Monitoring System
Security tools can help monitor:
- File changes
- Malware
- Login attempts
- Vulnerabilities
- Suspicious activity
Monitoring isn’t a substitute for good security practices, but it can make suspicious activity easier to discover.
5. Maintain Regular Backups
A good backup strategy should allow you to restore your website if something goes wrong.
Consider maintaining:
- Automated backups
- Multiple backup versions
- Off-site backups
- Database backups
- Website-file backups
Most importantly, periodically verify that your backups can actually be restored.
6. Choose Plugins Carefully
Before installing a plugin, consider:
- Is it actively maintained?
- Is it from a trustworthy source?
- Does it receive updates?
- Does it have a legitimate purpose?
- Do you actually need it?
WordPress maintains security processes for vulnerabilities reported in plugins and themes available through its ecosystem.
7. Don’t Use Nulled Plugins or Themes
“Nulled” versions of premium plugins and themes are often distributed through unofficial websites.
Even if the plugin appears to work normally, malicious code may have been added to it.
Use legitimate software from trusted sources.
8. Secure Your Hosting Account
Website security isn’t limited to WordPress.
Also protect:
- Hosting control panel
- FTP/SFTP
- SSH
- Database
- Domain registrar
- Email accounts
An attacker who obtains hosting credentials may be able to bypass WordPress completely.
WordPress Malware Checklist
Use this quick checklist if you’re concerned that your site may have been hacked:
| Check | What to Look For |
|---|---|
| ☐ | Unexpected redirects |
| ☐ | Strange pop-ups |
| ☐ | Spam content |
| ☐ | Unknown administrator accounts |
| ☐ | Modified files |
| ☐ | Unknown plugins/themes |
| ☐ | Google security warnings |
| ☐ | Hosting malware alerts |
| ☐ | Suspicious search results |
| ☐ | Unexpected email activity |
| ☐ | Failed administrator login |
| ☐ | Unusual server activity |
| ☐ | Malware scanner alerts |
If you find multiple warning signs, treat the situation as a potential compromise and begin an organized investigation.
Frequently Asked Questions
Can a WordPress website be hacked without showing obvious signs?
Yes. A compromise doesn’t necessarily result in a visibly defaced homepage. Attackers can modify specific files, create hidden accounts, inject scripts, or target only certain visitors.
That’s why monitoring, file integrity checks and security scanning are useful.
Does a strange redirect always mean my website is hacked?
Not necessarily.
Redirects can also be caused by:
- Incorrect WordPress settings
- Plugins
- Theme code
.htaccessconfiguration- CDN settings
- Hosting configuration
However, an unexpected redirect—particularly to an unrelated or suspicious domain—should be investigated.
Should I delete the infected files immediately?
Not always.
Deleting files without understanding the infection can make the website malfunction and can remove information that might help determine what happened.
For serious incidents, preserve evidence and consider getting professional assistance.
Can updating WordPress remove malware?
Usually, updating alone should not be considered a complete malware-removal strategy.
An update may replace legitimate WordPress files, but it doesn’t necessarily remove malicious files added elsewhere or compromised accounts.
You should still scan the website and investigate persistence mechanisms.
How do I know whether my WordPress site is clean?
No single test can guarantee that a website is clean.
A stronger verification process can include:
- Malware scanning
- File-integrity comparison
- Reviewing administrator accounts
- Checking server logs
- Reviewing database changes
- Checking search-engine warnings
- Updating all software
- Changing credentials
- Monitoring the website after cleanup
WordPress itself recommends combining different scanning and investigation methods rather than relying on one approach.
Final Thoughts
A hacked WordPress website doesn’t always announce itself with a giant message saying “You’ve Been Hacked.”
Sometimes the first clue is a strange redirect. Sometimes it’s an unfamiliar administrator account, a malware warning from a browser, unexpected spam pages, modified files, or an alert from your hosting provider.
The key is to take unusual behavior seriously without assuming that every WordPress error is malware.
If you suspect a compromise, document what you’re seeing, preserve an appropriate backup, scan the site, review accounts and files, contact your hosting provider when necessary, change credentials, update your software, and investigate the original entry point.
WordPress’s official security guidance also recommends hardening areas such as passwords, file permissions, hosting, plugins, backups, logging and monitoring.
For ongoing protection, the goal isn’t simply to remove today’s malware. It’s to make it harder for an attacker to get back in tomorrow.
Useful official resources
SEO Title: WordPress Malware: 12 Signs Your Website May Have Been Hacked
Meta Description: Learn the warning signs of WordPress malware, including redirects, spam, unknown admin accounts, modified files and security warnings—and what to do if your website is hacked.
Suggested URL Slug: wordpress-malware-signs-website-hacked
Primary Keyword: WordPress malware
Secondary Keywords: WordPress hacked, signs WordPress website hacked, WordPress malware removal, WordPress security, hacked WordPress website