Website compromises range from noisy attacks that replace a home page to quiet infections designed to remain hidden. The second kind can redirect selected visitors, create spam pages for search engines, steal data, or add administrator access without changing what you see.

No single symptom proves a hack, but several of these signs justify an immediate professional review.

Seven signs that deserve investigation

1. Unfamiliar pages appear in Google

Search for site:yourdomain.com. If results include pharmaceuticals, gambling, foreign-language spam, or pages you did not create, attackers may be generating hidden content.

2. Visitors are redirected somewhere else

Malicious redirects may only affect mobile users, search visitors, or a percentage of sessions. That makes them easy for an owner to miss while customers see something completely different.

3. New administrator users appear

Every WordPress administrator should be recognizable and necessary. An unknown admin account is a serious signal because it gives broad control over the site.

4. Security tools or browsers display warnings

Hosting notices, browser interstitials, Google Search Console alerts, or malware scanner results should be treated as actionable until properly investigated.

5. The website becomes unusually slow or unstable

Malicious scripts can consume server resources, contact external systems, send spam, or generate thousands of pages. Sudden performance changes may have innocent causes, but security should be part of the diagnosis.

6. Files change without explanation

Unexpected PHP files, modified core files, or strange code inside a theme are common indicators. File changes should be compared against known-clean versions by someone who understands WordPress structure.

7. Email delivery or search traffic collapses

A hacked domain may be blocklisted, used for spam, or lose search visibility. A sudden drop paired with other symptoms warrants a wider review.

Do not assume that restoring the home page means the website is clean. The visible symptom and the underlying access point are often different.

What to do next

  1. Document what you see with screenshots and timestamps.
  2. Contact your host or WordPress support partner through a trusted channel.
  3. Create a backup of the current state for investigation.
  4. Restrict unnecessary access and rotate credentials carefully.
  5. Scan files and the database, then identify the entry point.
  6. Clean or restore from a verified safe source.
  7. Update vulnerable software and verify the site again.
If the site handles sensitive customer or payment dataConsult appropriate security, legal, insurance, and compliance professionals. Incident obligations vary by business and location.

What not to do

  • Do not install several random security plugins and hope one fixes everything.
  • Do not delete suspicious files without understanding whether they are evidence or required system files.
  • Do not restore an old backup before identifying whether it is clean.
  • Do not reuse compromised passwords.
  • Do not hide the incident from stakeholders who need to make informed decisions.

Reduce the chance of another incident

Keep WordPress, plugins, themes, PHP, and hosting environments current. Use unique passwords and multi-factor authentication, minimize administrator accounts, maintain off-site backups, monitor uptime and file changes, and remove abandoned extensions.

Most importantly, make security a routine rather than an emergency-only activity.

Worried about something on your website?

Describe what you are seeing. We will review the situation and recommend the safest next step in plain English.

Request a priority review →