Most owners do not discover a hack by looking for one. A customer sends a screenshot of a casino page. The hosting company emails about “malicious files”. Enquiries from the contact form stop for a week and nobody can say why. Something feels wrong, but the website opens normally on your own laptop, so you start to wonder whether you are imagining it.
You are probably not. Hacked websites rarely announce themselves, and the clues tend to show up in places owners do not check every day. Below are the signs people actually notice, grouped by where they appear, plus a few problems that look like a hack but usually are not.
Why the site can look normal to you
Before the list, one thing worth understanding. A lot of malicious code is written to stay invisible to the person who runs the site. It may only act for visitors on phones, for people who arrive from a search engine, or for anyone who is not logged in to WordPress. Some versions show their payload once per visitor and then go quiet for that device.
So “I checked and it was fine” means very little on its own. When someone outside the business reports something odd, take the report seriously even if you cannot reproduce it straight away. Our post on why spam redirects hide from site owners explains the tricks in more detail.
Signs your visitors notice first
Customers often see the problem before you do, because they reach the site the way the attacker expects people to arrive.
- They land somewhere else. A tap on your search result opens a prize page, a dating site, a fake shop or a “your phone has a virus” screen. Sometimes the address bar flashes your domain for a second before changing.
- A full-screen red warning appears. Chrome and other browsers that use Google Safe Browsing can show messages such as “Deceptive site ahead” or a warning that the site contains malware. Visitors usually close the tab rather than click through.
- Their antivirus blocks the page. Security software on a visitor’s computer, or a browser extension, may refuse to load your site and name it as dangerous. This can happen even when Google shows no warning at all. We cover that situation on the page about sites blocked by antivirus and security vendors.
- Odd pop-ups or permission requests. A box asking visitors to “Allow notifications to continue”, or a fake CAPTCHA asking them to press keys or paste something, is not something a normal business site does.
- Checkout behaves strangely. On an online store, a customer may report a payment form that looks different from usual, asks for card details twice, or pops up somewhere in the order process it did not appear before.
If a customer tells you about any of these, ask for three details: what device they used, how they got to the site (search, link, typed address), and roughly what time it happened. Those answers make the problem far easier to find later.
Signs in Google search
Search results show a different picture of your site from the one you see in a browser, because Google’s crawler may be treated differently by the injected code.
- A grey line under your listing reading “This site may be hacked”. Our guide to clearing that Google label walks through what it means.
- Strange titles in a “site:” search. Type “site:yourdomain.com” into Google. Pages about pharmacy products, replica watches, loans or gambling, or titles in Japanese or another language you do not use, mean someone has added content.
- Your description has changed. The snippet under your homepage shows text you never wrote, while the page itself looks fine when you visit.
- Emails from Search Console. If the site is verified in Google Search Console, a message about security issues or a new owner being added is worth reading carefully rather than filing as spam.
- A jump in indexed pages. The Pages report in Search Console shows far more URLs than your site has ever had, often in folders you do not recognise.
Signs from your host and your email
The server side often tells you before the website does.
- A suspension or malware notice. Many hosts scan accounts and will quarantine files, disable a site or suspend the whole account when they find malicious code. A notice like this deserves a reply the same day. If it has already happened, see our page on getting a site back after a malware suspension.
- Resource limits being hit. The site becomes slow or shows “resource limit reached” errors even though your traffic has not grown. Hidden scripts sending spam or attacking other sites can use a lot of CPU.
- Disk usage climbing. Thousands of spam pages or a folder of stolen files take up room. If your storage figure has jumped and you have not uploaded anything, look into it.
- Bounces you did not send. Your inbox fills with “undeliverable” replies to messages nobody in the business wrote. That can point to a mailer script on the website, although it can also be spoofing from elsewhere.
- Your own mail starts landing in spam. If the domain or server ends up on a blocklist because of spam sent from the site, ordinary invoices and replies stop reaching people.
Signs inside WordPress
Once you log in to the dashboard, a few places are worth a slow look.
Users
Open Users and sort by role. An administrator account you cannot account for is one of the clearest signs of a compromise. Attackers often pick names that sound official, such as “wpadmin”, “support” or something close to your own name. Check the email address on each admin too. An account you do recognise with an email address you do not is just as worrying.
Plugins
Look for plugins you did not install, especially ones with vague names and no author link. Click the Must-Use tab if it appears; plugins in that list load automatically and are a favourite hiding place. A security plugin that has been switched off without anyone on your side doing it is another warning.
Settings
Under Settings, then General, check three fields: the site address, the administration email address, and the membership options. If “Anyone can register” is ticked and the default role for new users is set to Administrator, someone has given themselves a way back in.
Content
Posts or pages you did not write, links added to the bottom of old posts, or a homepage replaced by a message from the attacker are all obvious once you see them. Less obvious is a script tag added to a widget or to a header and footer box in your theme settings.
Logins
Your password suddenly does not work, a password-reset email arrives that you did not request, or you are told your account no longer exists. Any of these means someone else has been in the admin area.
Signs in the files
If you or a developer can look at the files through the hosting file manager or SFTP, a few things stand out on a WordPress site.
- PHP files inside wp-content/uploads, a folder that should normally hold images and documents.
- Files with random names, or names that imitate WordPress files with a small change, such as an extra letter.
- Very long lines of scrambled text at the top of PHP files.
- Many files with the same recent modified date when nobody updated anything that day.
- A changed .htaccess file in the root folder or in a subfolder.
Finding one of these does not tell you how far the problem goes. It tells you there is a problem.
Things that look like a hack but usually are not
Plenty of alarming symptoms have ordinary causes, and it helps to rule them out before assuming the worst.
- A white screen or “critical error” right after an update. This is usually a plugin conflict or a PHP compatibility issue. Our post on why WordPress sites break after changes covers the usual culprits.
- Spam comments. Bots posting junk into your comment form is a nuisance, not a breach. Nobody has access to your site because of it.
- A “Not secure” warning. This normally means the SSL certificate has expired or a page loads something over plain http. It is a configuration problem, not malware.
- Contact form emails not arriving. Most often a mail delivery setting, not an attacker.
- A slow site. Slowness on its own has many causes. Combined with high CPU and outgoing spam, it becomes more suspicious.
The difference is pattern. One symptom with a clear trigger, such as an update five minutes earlier, is probably a fault. Several symptoms with no obvious trigger, or anything involving unknown users, foreign-language pages or redirects, is probably a hack.
How to check without making things worse
If you want to confirm what a visitor reported, test the way they would have seen it. Use a private browser window so you are logged out. Try a phone on mobile data rather than office Wi-Fi. Find the site through a Google search, the way a new customer would, rather than typing the address in. If something unexpected loads, close it without clicking anything on the page.
Avoid logging in to the WordPress dashboard from a computer you suspect may itself be infected, and do not start deleting files you do not recognise. Those strange files are clues to the attacker’s route, and some of them sit inside legitimate plugins, where removing them breaks the site. Our separate guide on scanning a site for malware and what scanners miss covers the checking tools in more depth.
When the signs add up
If you have seen two or more of the signs above, treat the site as compromised until proven otherwise. That does not mean panic. It means slowing down, writing down what you have noticed and when, and making a full copy of the site before anyone changes anything. The next decisions, such as whether to take the site offline and which passwords to change first, are covered in our first-hour checklist for a hacked site.
Keep a note of everything people have reported, with dates. Whoever cleans the site will ask, and a clear timeline often points straight at the weak spot.
If the signs point to a hack and you would rather not untangle it alone, our page on repairing hacked websites for owners in India and the USA sets out how we work through a compromised site and how to get hold of us quickly. The quickest route is WhatsApp: message us and start with the word HACKED, and you will get a plain account of what we find.
Next in this series: Website Hacked? What to Do First (and What Not to Do)
