Is My WordPress Site Hacked? 10 Signs and What to Do Next

How to tell if your WordPress website has been hacked, and exactly what to do next.

Last updated: September 2026

Short answer: the clearest signs of a hacked WordPress site are visitors being redirected to spam or betting sites, strange pages in Google results, a “This site may be hacked” warning, admin users you didn’t create, or a warning from your host. If you see any of these, save a backup of the current state, change every password, remove unknown users, scan and clean the files, reinstall WordPress core, themes and plugins from official sources, then ask Google to review your site.

10 Signs Your WordPress Site Has Been Hacked

1. Redirects: visitors, especially on mobile or coming from Google, are sent to betting, adult or scam websites.
2. Strange pages on Google: searching site:yourbusiness.com shows pages you never created, often in Japanese or about pharmacy, loans or casinos.
3. Browser or Google warnings: “This site may be hacked” in results, or a red “Deceptive site ahead” screen in Chrome.
4. Search Console alerts: a Security issues or Manual actions report in Google Search Console.
5. Unknown admin users: new administrator accounts under Users that nobody on your team created.
6. Locked out: your password suddenly stops working or your email address has been changed.
7. Unknown files or plugins: plugins you didn’t install, or odd PHP files in your uploads folder.
8. Hosting warnings: your host suspends the account or reports malware or very high resource use.
9. Your emails land in spam: your domain may be sending spam and has been blacklisted.
10. Sudden changes: pop-ups, links or text you didn’t add, or a sudden drop in Google traffic.

What to Do Right Now, Step by Step

1. Don’t delete everything in a panic. Take a full backup of the hacked site first. It helps find how the attacker got in.
2. Change every password: WordPress admins, hosting account, FTP or SFTP, database and the email linked to the site. Use long, unique passwords.
3. Remove unknown users and reduce everyone else to the lowest role they need.
4. Scan the site with a reputable security plugin or scanner, and ask your host whether they found malware.
5. Replace, don’t patch: reinstall WordPress core, your theme and every plugin from official sources. Delete any theme or plugin you don’t use.
6. Clean the uploads folder and database: remove PHP files from uploads and injected scripts or spam links from posts and settings.
7. Restore a clean backup if you have one from before the hack, then apply all updates straight away.
8. Tell Google it’s fixed: in Search Console, check the Security issues report and click “Request review”. Remove spam pages with the Removals tool.

If you’re not comfortable editing files and databases, this is the moment to call a professional. A partial clean-up often leaves a hidden backdoor, and the site is hacked again within days.

How WordPress Sites Usually Get Hacked

• Nulled themes and plugins: “free” copies of paid themes downloaded from unofficial sites often contain hidden malware. This is one of the most common causes we see.
• Outdated plugins: known security holes in old plugin versions are attacked automatically.
• Weak or reused passwords and admin usernames like “admin”.
• Too many people with admin access, including past developers who were never removed.

How to Stop It Happening Again

• Update WordPress, themes and plugins every week.
• Turn on two-factor authentication for every admin account.
• Keep daily off-site backups you have tested restoring.
• Only use themes and plugins from official sources. Never install nulled software.
• Use a security plugin or firewall, such as a web application firewall from your host or Cloudflare.

Frequently Asked Questions

Why is my site only redirecting on mobile?

Many hacks only redirect mobile visitors or people coming from Google, so the owner, who types the address directly on a laptop, doesn’t notice. Test on your phone using mobile data and by clicking your site from a Google search.

Will Google remove my site for being hacked?

Google can show warnings or drop affected pages from results. Once the site is cleaned and you request a review in Search Console, warnings are usually removed after Google confirms the fix.

Can I just restore an old backup?

Only if it is from before the hack and you then update everything and change all passwords. Otherwise the same weakness lets the attacker straight back in.

How much does it cost to fix a hacked WordPress site?

We quote clean-ups after a free check, because it depends on how deep the infection goes. To prevent future hacks, our Care Basic plan from ₦35,000 a month includes updates, daily backups and security monitoring. See care plans.