Is Your WordPress Site Hacked? Warning Signs and What to Do

A hacked website doesn't always look hacked. Sometimes the homepage is defaced or visitors are redirected to scam pages. But often, especially with spam attacks, everything looks normal to you while search engines and visitors see something very different.

If you suspect your WordPress site is hacked, this guide walks through the warning signs, what to do first, how to audit the site properly, and how to decide between cleaning it and replacing it. It draws on first-hand experience: HEXACODES dealt with exactly this kind of compromise on our own former WordPress site.

Warning signs your WordPress site has been hacked

Watch for any of these:

• Strange search results. Searching site:yourdomain.com on Google shows pages you never wrote, often about casinos, pharmaceuticals, replica goods or loans, sometimes in foreign languages.
• Security warnings. Browsers or Google show "This site may be hacked" or a dangerous-site warning, or Google Search Console reports a security issue.
• Posts or pages you didn't create, sometimes with old publish dates so they sit quietly in your archive.
• Unknown admin users or changes to existing users' roles and email addresses.
• Redirects that send some visitors, often mobile users or those arriving from Google, to another site.
• Unexpected files in your hosting account, especially PHP files inside the uploads folder.
• Slowdowns or hosting alerts about high resource use, outgoing spam email or suspended service.
• Plugins you didn't install, or security plugins that have been switched off.

WordPress's own FAQ on hacked sites lists similar indicators, such as unauthorized new users and warnings from search engines.

How a spam injection can hide in plain sight

Our own experience is a good example of how quiet these attacks can be. An old WordPress site we ran had hundreds of multilingual casino spam posts published over several months. They were not injected through some obscure file; they were published through the admin account by an automated bot. Each post was back-dated, so instead of appearing at the top of the blog, it blended into the archive. Anyone glancing at recent posts would have seen nothing unusual.

Looking back, the site had familiar risk factors: outdated plugins and a "nulled" (pirated) premium plugin. Nulled plugins are a well-known way for attackers to ship hidden backdoors, because you are running code from an unknown source that never receives security updates.

The lesson: deleting the spam is the easy part. Finding and closing the way in is what actually fixes a hack.

First steps: contain the damage without destroying evidence

When you confirm a compromise, resist the urge to start deleting things. Work in this order:

1. Take a full backup of all files and the database, even though it is infected. You need it to investigate what happened and as a fallback if cleanup goes wrong.
2. Write down what you see: dates, URLs, users, files and anything that changed recently.
3. Change every password from a clean device: WordPress admin users, hosting control panel, FTP/SFTP, database and the email accounts tied to them.
4. Log everyone out by replacing the secret keys and salts in wp-config.php, which invalidates existing login sessions.
5. Turn on multi-factor authentication for all admin accounts and your hosting panel.
6. Tell your host. On shared hosting, other sites on the same server may be involved, and your host may have logs you can't see.

How to audit a hacked WordPress site

A proper audit looks at every place an attacker can hide. Key checks:

• Core file integrity. WP-CLI's core verify-checksums command compares your WordPress core files against the official checksums from WordPress.org. wp plugin verify-checksums --all does the same for plugins hosted on WordPress.org. Premium or nulled plugins can't be verified this way, which is one more reason to replace them with clean copies from the vendor.
• Users. Review every account with Administrator or Editor rights. Remove anyone you don't recognize and check that email addresses haven't been changed.
• Application passwords. Since WordPress 5.6, each user can have application passwords that allow access to the REST API without the main password. Check each admin user's profile and revoke any you didn't create, because changing the login password does not remove them.
• Uploads folder. The uploads directory should contain media, not code. PHP files there are a red flag.
• Scheduled tasks (cron). Attackers sometimes add scheduled events that recreate malware or republish spam after you clean it. Review scheduled events with a cron inspection tool or WP-CLI.
• Must-use plugins, themes and .htaccess. Check the mu-plugins folder, theme files such as functions.php, and .htaccess rules for injected code or redirects.
• Database content. Search posts by author and date for spam, including back-dated items, and check options for unfamiliar scripts or URLs.
• Access logs. If your host keeps them, look for repeated requests to login, XML-RPC or REST API endpoints around the time spam appeared.

Clean it, rebuild it or replace it?

Once you know what happened, you have three options:

• Clean in place. Reinstall core, themes and plugins from fresh official copies, remove the malicious content and harden the site. This is reasonable when the infection is limited and the site is otherwise healthy.
• Rebuild WordPress from scratch. Install a fresh WordPress, then import only clean content. Slower, but it avoids carrying hidden backdoors forward.
• Replace WordPress altogether. If the site is mostly brochure pages and a blog, a static site may serve you better. There is no admin login, database or plugin stack exposed to the internet, so most of the usual WordPress attack surface simply disappears.

We chose the last option for our own site. After the backup and the audit, we moved off WordPress to a fast static site. Our guide From WordPress to a static site explains the trade-offs in detail.

After the cleanup: recover rankings and prevent a repeat

Spam pages can damage your search visibility long after they are deleted. After cleanup:

• Verify your site in Google Search Console and open the Security issues report.
• Make sure the spam URLs now return "not found" or "gone" rather than redirecting to your homepage.
• Once every issue is fixed across the whole site, request a review and briefly explain what you cleaned and which vulnerability you closed. Google notes that reviews for spam hacks can take several weeks.
• Submit an up-to-date sitemap and watch the Pages report as spam URLs drop out of the index.

To keep it from happening again:

• Update WordPress core, themes and plugins promptly, and remove anything you don't use
• Never install nulled or pirated themes and plugins
• Use multi-factor authentication and unique passwords for every admin account
• Keep the number of administrators to a minimum
• Take automatic offsite backups and test restoring them
• Monitor file changes, new users and new posts, so an attack is noticed in days, not months

For broader protection across your business, see our 12-step cyber security checklist.

How HEXACODES can help

HEXACODES provides cyber security and website services, and we have been through a WordPress spam-injection cleanup ourselves. We can back up and audit a compromised site, remove the malicious content, close the entry point and help you request a review in Search Console. If WordPress is no longer the right fit, we can migrate you to a fast, low-maintenance static site.

You can also replace an aging site with a full business website starting at $30/month. If you think you have been hacked, contact us on WhatsApp or by email.

Frequently asked questions

How do I check if my WordPress site is hacked?

Search site:yourdomain.com on Google for pages you didn't create, check Google Search Console for security issues, and review your WordPress users, posts sorted by date and installed plugins. Running WP-CLI checksum verification on core and plugin files helps spot modified files. If anything looks unfamiliar, assume a compromise and investigate further.

Is it enough to delete the spam posts?

No. Spam posts are the symptom, not the cause. If you don't find and close the entry point, such as a stolen password, a leftover application password, a vulnerable or nulled plugin, or a malicious scheduled task, the spam is likely to return.

Should I move away from WordPress after a hack?

Not always. If you need WordPress features and can keep it updated and monitored, a careful cleanup can be enough. But if your site is mostly static content and nobody maintains it regularly, moving to a static site removes much of the attack surface and the ongoing maintenance burden.