Signs your WordPress site has been hacked, and how to check each one

WindowsMacUpdated

WordPress's own FAQ on hacked sites calls new users nobody authorised a clear sign of a hack, alongside a Google or Bing blacklisting, your host disabling the site and visitors' antivirus flagging it. Google's Search Console adds redirects, spam text and spam pages that hackers create. Most of them can be checked from your dashboard and Search Console.

Quick answer

Go to Users > All Users and filter by Administrator for accounts you didn't create. Open the Security issues report in Google Search Console for hacked content, injected spam and malicious code. Check Pages > All Pages and Posts > All Posts for content you didn't write, and ask whether .htaccess, index.php, header.php or footer.php has changed.

What does WordPress count as a sign of a hack?

WordPress calls them Indicators of Compromise. Its FAQ lists these as clear ones:

  • the site is blacklisted by Google, Bing or similar
  • your host has disabled the site
  • the site has been flagged for distributing malware
  • readers say their antivirus is flagging it
  • someone tells you the site is being used to attack other sites
  • behaviour you didn't authorise, such as new users
  • you can see the hack when you open the site in a browser

The FAQ also says "Not all hacks are created equal". Google's help notes that hackers may use cloaking to hide spam from the site's owner, so a site that looks normal to you isn't proof on its own.

How do I check for admin users I didn't add?

The Users screen lists every account, and the links above the table filter it by role. Start with administrators: WordPress's hardening guide says a hacker with access to an administrator account "is able to install malicious scripts".

  1. In your dashboard, go to Users > All Users.
  2. Click the Administrator link above the table.
  3. Read the Username, Name and E-mail of each account. Note any you don't recognise, along with the date you spotted it.
  4. Click All Users and look through the other roles too.
  5. Go to Settings > General and look at Membership and New User Default Role. WordPress lists Administrator among the choices for the default role given to new users.

Write it down before you delete anything. WordPress's FAQ calls documenting what you see the first actionable step after a compromise.

How do I spot a redirect hack?

Google's Security issues report lists code injection, where "a hacker has compromised your site and is injecting malicious code in your pages", and gives malicious redirects as an example. On the WordPress side, the FAQ singles out the .htaccess file as the one you'll "definitely want to look at", because it is most often changed for nefarious ends.

  1. Open the Security issues report in Search Console. Expand any issue to see sample URLs and the date it was first detected.
  2. Connect to your site over FTP or SFTP and open the .htaccess file in the WordPress folder. Look for lines you didn't add.
  3. Check other folders too. WordPress says .htaccess usually sits at the root of the installation but can also appear inside other directories.

How do I find spam pages on my site?

Google describes two kinds. Content injection is when "a hacker has added spammy links or text to your site's pages". URL injection is when "a hacker has created new pages on your site, often containing spammy words or links".

  1. Go to Pages > All Pages. WordPress lists the newest first, with Author and Date columns, so look at the top of the list for titles you don't recognise.
  2. Use the status links above the table, such as Draft and Private, to see pages that aren't public.
  3. Type a word from the spam into the search box and click Search Pages.
  4. Repeat in Posts > All Posts.
  5. Compare what you find with the sample URLs in the Security issues report.

What do Google's warnings mean?

They mean Google has found a problem it judges could harm visitors. Google says affected pages "can appear with a warning label in search results or an interstitial warning page in the browser". WordPress's FAQ adds that warnings range from large splash pages to subtler notes in search results, and that Bing, Yahoo and desktop antivirus keep blacklists of their own.

  1. Open the Security issues report in Search Console. A green tick means Google found no issues; otherwise it shows a count.
  2. Expand each issue for sample URLs, the first detection date and a Learn more link.
  3. Register with Bing Webmaster Tools as well. WordPress's FAQ recommends registering with the webmaster consoles, Bing's among them.

Google asks you to fix every listed issue before you select Request Review, and not to resubmit until you have a final decision.

How do I check for changed files?

The dashboard doesn't list file changes. WordPress's hardening guide says an attack always leaves traces, either in the logs or on the file system, as new or modified files. The FAQ names files to watch because a change to them can affect every page: index.php, header.php, footer.php and the theme's functions file.

  1. Run a scan. WordPress's FAQ lists scanner plugins from the WordPress.org directory and remote scanners, and says that while no one tool is best, using them together greatly improves your odds.
  2. Over FTP or SFTP, check those files and .htaccess against a backup made before the trouble started.
  3. If your host gives you your logs, the hardening guide says they can show brute force attempts and when the theme and plugin editors were used.
  4. Scan your own computer as well. WordPress says some attacks start on the owner's machine, with trojans that capture FTP and admin logins.

If any of these checks turns something up, note what you saw and when, then follow what to do if your website is hacked. It covers your host, passwords, removing unknown users, a clean backup and the Google review in order.

More questions

Can a WordPress site be hacked without any visible signs?

Yes. Google says hackers may use cloaking to hide spam from site owners, and WordPress's FAQ says not all hacks are created equal. That's why the Security issues report and a file scan are worth checking even when the site looks normal to you.

Should I delete unknown admin users straight away?

Write them down first. WordPress's FAQ says documentation comes first, and to take one more snapshot of the site before cleaning, even an infected one. The recovery guide covers when to delete them and reset everyone's passwords.

What if I can't log in to WordPress any more?

WordPress's FAQ says an attacker sometimes takes over administrator accounts. You can reset your password, or use phpMyAdmin from your host to reach the users table directly. One simpler route it gives is to change your email there, then use "forgot password" on the login screen.

Is my WordPress site hacked because of PHP2Shell?

Not necessarily. PHP2Shell is a pair of flaws in PHP, which PHP fixed on 21 October 2026. As of 23 October 2026, CISA says in its alert of 21 October, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication". Check your PHP version, and read our PHP2Shell explainer for the background.

Will updating WordPress remove a hack?

Not on its own. WordPress's FAQ puts the update after the clean-up, saying to update once you're clean because older versions are more prone to hacks, and to change your passwords again after the clean-up.

Sources