Signs your WordPress website has been hacked (and what to do)

Finding out your website has been hacked is a horrible feeling. Often the first you hear of it is a customer saying “your site sent me somewhere weird”, or an email from Google saying your site may be harmful.

The good news is that most hacked WordPress sites can be cleaned up and made secure again. Here are the signs to look for, and what to do if you spot them.

Common signs your site has been hacked

Hacks are not always obvious. Many are designed to stay hidden from the owner while they quietly use your site for something else. Watch out for these:

• Visitors are redirected to other websites, often spam, gambling or fake prize pages. Sometimes this only happens on mobile, or only when people arrive from Google, so you may not see it yourself.
• Google shows a warning such as “This site may be hacked” in search results, or Chrome shows a red warning screen.
• Strange pages appear in Google. Search for site:yourdomain.com.au and look for pages you did not create, often in other languages or selling something unrelated.
• New admin users you do not recognise appear under Users in WordPress.
• Your host suspends the account or emails you about malware or high resource usage.
• Your emails start bouncing or landing in spam because your server has been used to send spam.
• The site is suddenly very slow, or shows errors you have never seen before.
• Files or plugins you do not recognise appear on the server.

One sign on its own does not always mean a hack. A slow site can just be a slow site. But two or three together is worth acting on quickly.

What to do first

If you think your site has been hacked, try not to panic, and try not to start deleting things at random. Here are sensible first steps:

1. Change your passwords. WordPress admin accounts, hosting control panel, FTP and the database. Use long, unique passwords.
2. Check your users. Remove any admin accounts you do not recognise.
3. Do not restore an old backup straight away without knowing how the hacker got in. If the hole is still open, they will often be back within days.
4. Tell your host. Many hosts can help identify infected files or what was changed.
5. Get it cleaned properly. That means removing the malicious code, finding and closing the way in, and checking the database as well as the files.

How sites usually get hacked

In our experience, most small business sites are not targeted personally. They are found by automated tools scanning for common weaknesses, such as:

• Plugins or themes that have not been updated, especially ones with known security holes.
• Plugins that have been abandoned by their developers.
• Weak or reused passwords, with no limit on login attempts.
• Pirated “free” versions of paid themes and plugins, which often come with hidden code.
• Old hosting setups with outdated PHP and no firewall.

Cleaning up after a hack

A proper clean-up involves more than running a scanner. A good process looks like this:

• Take a copy of the hacked site first, so nothing is lost while investigating.
• Replace WordPress core files, plugins and themes with fresh copies from trusted sources.
• Search the remaining files and the database for injected code and spam.
• Remove unknown users and reset every password and security key.
• Update everything, and remove plugins that are no longer maintained.
• Ask Google to review the site if a warning was showing.

Stopping it happening again

Once your site is clean, keeping it that way comes down to a few habits:

• Keep WordPress, plugins and themes up to date every month.
• Use a firewall and limit login attempts.
• Keep daily off-site backups, so you can recover quickly if needed.
• Only install plugins from reputable sources, and delete ones you do not use.
• Have someone keep an eye on the site, rather than finding out from a customer.

Why acting quickly matters

The longer a hack goes unnoticed, the more damage it can do. Google may flag the site and warn visitors away, your host may suspend the account, and spam sent from your server can hurt your email delivery for months. Cleaning up early is almost always quicker and cheaper.

Need help with a hacked site?

If your WordPress site has been hacked, broken or is showing warnings, our website repair service can help. We clean the site, close the hole and harden it, and we give you a clear quote before any work starts. We are based in Pelican Waters and look after businesses right across the Sunshine Coast.

Call Dave on 0418 501 122 if it is urgent.