Is your WordPress site hacked?

01

Signs to watch for

Searching "site:yourdomain.com" on Google shows pages you did not create, often in other languages or selling pharmaceuticals or gambling. Visitors are redirected to other sites, sometimes only on mobile or only when arriving from Google. The browser or Google shows a security warning. New admin users appear that nobody created. Your host emails about malware or suspends the site. The site suddenly becomes very slow or sends spam emails.

Some hacks hide from logged-in admins. Check the site from a phone on mobile data, logged out, via a Google search.

02

First: do not panic-delete

Deleting files or the whole site in a hurry can destroy evidence and make proper clean-up harder. Instead, change passwords for WordPress admin users, hosting, the database and FTP. Remove unknown admin users. Take a fresh backup of the current state, even though it is infected, so nothing is lost while you work.

03

Then: clean and restore

If you have a clean backup from before the hack, restoring it is often the fastest route, followed immediately by updating everything and changing passwords, otherwise the same weakness lets the attacker back in. If you are not sure when the hack began, a professional clean-up compares files against known-good versions and removes injected code.

Security plugins and scanning tools help identify the problem, but they do not always remove everything.

04

Tell Google once it is clean

If Google has flagged the site, use Search Console's Security Issues report to see what it found and to request a review once the site is clean. Remove spam pages from Google's index by making sure they return an error and, where necessary, using the removals tool. Warnings usually clear after the review succeeds.

05

How most small sites get hacked

Outdated plugins and themes with known security holes are the most common cause. Nulled, meaning pirated, premium themes or plugins often come with hidden malicious code. Weak or reused passwords, and admin accounts shared by several people. Old, unused plugins left installed. Cheap hosting that does not isolate accounts properly.

06

Prevention habits

Keep WordPress, themes and plugins updated, ideally weekly, after a backup. Remove plugins you do not use. Never install pirated themes or plugins. Use strong, unique passwords and two-factor authentication for admin accounts. Give each person their own login with only the access they need. Keep automatic off-site backups, and choose reputable hosting.

07

Consider whether you need WordPress

For a small brochure website that rarely changes, a static site has almost nothing to hack: no admin login, no plugins, no database. It also costs less to maintain. WordPress is the right choice when your team needs to update content often or needs features it provides; just budget for keeping it maintained.

Most hacks are automated, not personal

Small business owners often think nobody would bother hacking them. Most attacks are automated bots scanning millions of sites for known weaknesses in outdated plugins. They do not care who you are; they care whether your site is vulnerable.

Updates and backups prevent most of the damage.

If nobody is responsible for updating your WordPress site, that is the gap to close, whether you do it yourself, pay for maintenance or move to a simpler setup.

How do I know if my WordPress site has been hacked?

Common signs include spam pages in Google results for your site, redirects to other websites, browser or Google security warnings, unknown admin users, host malware notices and sudden slowness.

What should I do first if my website is hacked?

Change all passwords, remove unknown admin users and take a backup of the current state. Then restore a clean backup or get a professional clean-up, and update everything.

How do WordPress websites get hacked?

Most often through outdated plugins or themes with known vulnerabilities, pirated themes and plugins, and weak or shared passwords.