Most small business owners find out their WordPress site was hacked one of two ways: a customer mentions their browser flashed a scary red warning screen, or they Google their own business and see “This site may be hacked” sitting right under their listing. By that point, it’s usually been compromised for a while: hacked sites are rarely loud about it right away. Quiet and undetected is more useful to an attacker than obvious and gets-fixed-immediately.
Here’s what to actually watch for, and what to do if you spot it.
The signs
- Google flags you. A “This site may be hacked” or “Deceptive site ahead” warning in search results or from Chrome is one of the most reliable signals: Google’s crawlers found something you probably haven’t seen yet.
- Strange redirects. Visitors (or you) land on the site and briefly get bounced to an unrelated site, often something spammy or foreign. This is one of the most common WordPress hack patterns and is often invisible to a logged-in admin, who gets treated differently by the malicious code than a normal visitor.
- Content you didn’t write. Pages advertising counterfeit goods, pharmaceuticals, or gibberish keyword spam suddenly showing up in your site’s pages or search results.
- Users or admins you don’t recognize. Check your Users list. An extra administrator account you didn’t create is one of the clearest signs someone else has been inside.
- The site is suddenly, inexplicably slow, or your host emails you about unusual server load. Malware often runs background tasks (sending spam email, mining cryptocurrency, attacking other sites) that eat up resources.
- Your host suspends your account or emails about “abuse” or “malware detected.” Hosts scan for this actively and will shut a compromised site down to protect their other customers.
What to do first
Don’t panic, and don’t start deleting things at random: that can destroy the evidence of how the attacker got in, and they’ll just get back in the same way. In order:
- Change your passwords: WordPress admin, hosting account, and the database, from a device you’re confident isn’t compromised.
- Take the site offline or into maintenance mode if it’s actively serving malicious content to visitors, to stop the bleeding.
- Restore from a clean backup taken before the compromise, if you have one. This is almost always faster and more reliable than trying to manually hunt down and remove malicious code line by line.
- If you don’t have a clean backup, this is where it’s worth bringing in someone who does this regularly: a proper cleanup means finding and closing whatever let the attacker in, not just deleting the obvious mess and hoping.
- Request a review from Google once it’s clean, so the warning label comes off search results.
The uncomfortable truth
Almost every hacked WordPress site I’ve cleaned up had the same root cause: an outdated plugin, theme, or WordPress core version with a publicly known vulnerability. Not a sophisticated attack: an automated bot that scans millions of sites for the one detail that was three versions behind. The fix isn’t glamorous. It’s just staying current, having backups you’ve actually tested, and having someone checking in regularly enough to catch the early signs before Google does it for you.