How to Tell If Your WordPress Site Has Been Hacked

The clearest signs a WordPress site has been hacked are a browser or Google warning, visitors being redirected to spam, pages in Google that you didn’t write, and administrator accounts you didn’t create. Many hacks show none of these to the site owner, so the only way to be sure is to check: search Google for your own site, look at your users and plugins, and run a free scan. Here are the signs to look for, a 10-minute check, and what to do first if you find something.

Signs your visitors and Google notice

• A warning in the browser or in Google’s results, such as “This site may be hacked” or a red “Deceptive site ahead” page.
• Redirects to spam, gambling or pharmacy sites. These often only happen to visitors arriving from Google or on phones, so the site can look normal when you visit it yourself.
• Pages in Google that aren’t yours, often in another language or selling products you don’t sell.
• Your host suspended the account or emailed you about malware.
• New ads, pop-ups or links on your pages that you didn’t add.

Signs inside WordPress

• Administrators you didn’t create under Users, or an existing account that has quietly become an administrator.
• Application passwords you didn’t add on an administrator’s profile. They give access to the site without the login screen.
• Plugins you didn’t install, including must-use plugins, which don’t appear in the normal plugin list.
• PHP files where they don’t belong, such as in the uploads folder or loose in wp-content, or images with PHP code hidden inside.
• Changes to wp-config.php or to WordPress core files that you didn’t make.

How to check your site in 10 minutes

1. Search Google for site:yourdomain.com and scroll through the results. Look for pages, titles or languages you don’t recognize.
2. Open Google Search Console, if you have it, and check Security issues and Manual actions.
3. Go to Users → All Users in WordPress and filter by Administrator. Every name should be someone you know.
4. Go to Plugins and look at the Must-Use tab too, if there is one. Anything you don’t recognize is worth a closer look.
5. Run a free scan. JAT Shell Scanner is my free plugin from the official WordPress plugin directory. It checks for the signs above automatically and tells you in plain language whether anyone got in.

What a free scan checks

JAT Shell Scanner looks for what an attacker leaves behind, not just for known malware:

• Webshell code anywhere on the site, including packed and disguised code
• PHP in uploads, cache folders and images, and hidden PHP files
• New or promoted administrators, application passwords and roles given admin powers
• Must-use plugins, hidden plugin folders and plugin files that differ from the official release
• WordPress core files that don’t match wordpress.org’s checksums
• Code hidden in settings, posts and scheduled tasks, and SEO spam links hidden from visitors
• Whether the site is exposed to PHP2Shell or wp2shell, two serious 2026 vulnerabilities

Scans only read your site. If something is flagged, the safe fixes, such as quarantining a file, can be undone with one click.

What to do first if you find signs of a hack

1. Don’t delete anything yet. The changed files show how the attacker got in.
2. Back up the whole site, files and database, and keep that copy apart from your clean backups.
3. Change every password from a clean device: WordPress administrators, hosting, SFTP or FTP, and the database.
4. Tell your host, and ask whether they have suspended or flagged the account.
5. Find and close the way in, then remove what was added. Cleaning without closing the way in usually means the site is reinfected.

The first-hour steps on my repair page go through each one in more detail. If you’d rather have it handled, I offer hacked WordPress site repair, starting with a free assessment and a written quote.

How to keep it from happening again

• Keep WordPress, plugins, themes and PHP updated. Some of the worst 2026 attacks targeted outdated PHP, which only your host can update.
• Turn on two-factor authentication for every administrator. JAT Site Shield, my free security plugin, adds two-factor, login lockouts, hardening and daily file checks.
• Remove administrator accounts nobody uses, and revoke application passwords you don’t need.
• Have someone watching. My WordPress care plans include updates, backups, uptime monitoring and a monthly security scan.

FAQ

Can my WordPress site be hacked without me noticing?

Yes. Many hacks hide from logged-in administrators or only redirect visitors who arrive from Google or on phones. Searching Google for your own site and running a scan are the most reliable ways to check.

Will Google tell me if my site is hacked?

Sometimes. If Google detects malware or spam it can show a warning in search results and report it under Security issues in Google Search Console. Many hacks aren’t detected that way, so it isn’t a reliable early warning on its own.

Does updating WordPress remove a hack?

No. Updating closes known holes, but anything the attacker already added, such as a webshell, a hidden plugin or a new administrator, stays until it’s found and removed.

Should I just restore a backup?

A backup can help, but if it was made after the attacker got in, or the way in is still open, the site can be reinfected. Find the way in before you restore.

Is the scanner free?

Yes. JAT Shell Scanner is free and open source, with no account and nothing sent to me. Install it from Plugins → Add New by searching for “JAT Shell Scanner”.

How much does it cost to fix a hacked WordPress site?

It depends on how badly the site is compromised. I start with a free assessment and give you a written quote before any paid work. See hacked WordPress site repair.