Quick answer
Malware doesn't always announce itself. Here are the quiet signals that something's wrong under the hood — before your visitors notice.
Key takeaways
- Unexpected redirects — often only on mobile or from Google — are a top warning sign.
- A Google warning or blacklist means a search engine has already flagged you.
- Unknown admin accounts and random files are classic backdoor signatures.
- Two or more signs together mean it's time for a full scan.
The worst malware is the quiet kind. It doesn't deface your homepage — it hides, redirects a fraction of your visitors, or sends spam in the background for months. Here are the signals worth watching for.
1. Unexpected redirects
Visitors — often only on mobile, or only from Google — get bounced to a site you've never heard of. This is one of the most common symptoms of a compromised WordPress install.
2. A Google warning or a blacklist
“This site may be harmful,” a red interstitial, or a sudden collapse in traffic usually means a search engine has flagged you. It's a signal, not the disease — but it needs handling quickly.
3. New admin users or files you didn't create
An unfamiliar administrator account, or files with random names in your uploads folder, are classic backdoor signatures. Attackers leave themselves a way back in.
4. Your host suspends the account or flags spam
If your hosting provider emails you about outbound spam or unusual resource usage, take it seriously. A compromised site is often quietly used to send email or attack others.
5. Strange behaviour in search results
Search listings showing pages you never published — often in another language, selling products you don't sell — mean someone has injected content to piggyback on your rankings.
If two or more of these ring true
Don't wait for it to get worse. A proper scan across core files, themes, plugins, and the database will tell you exactly what's there — and a free audit is a low-stakes way to find out where you stand.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
Attackers cloak their code so it only triggers for specific visitors — often mobile users or people arriving from search — to stay hidden from the site owner, who usually visits directly on desktop. That's why a redirect you can't reproduce is still very real.
Keep reading
Why WordPress Sites Get Hacked (and How to Not Be One)
WordPress isn't insecure — but how it's run often is. Here's why sites actually get hacked, and how to stay off the list.
How to Choose Secure WordPress Hosting
Your host is your site's foundation. Here's what actually matters when choosing secure WordPress hosting.
What to Do After Cleaning a Hacked WordPress Site
Removing the malware is the middle of the story, not the end. Here's what to do after a cleanup so it doesn't happen again.