Is my WordPress site hacked? How to check

Something feels off, but you're not sure whether your WordPress site has actually been hacked or is just misbehaving. Before you panic — or dismiss it — here's how to check properly.

1. Look for redirects

Open your site in an incognito window, and try it from your phone on mobile data. Attackers often redirect only certain visitors — mobile users, or people arriving from Google — so it can look fine to you while sending others to spam.

2. Check for a Google warning

Search your site name on Google and look for a “This site may be hacked” label under the result. Then open Google Search Console and check the Security Issues report — it's the most direct signal that Google has detected something.

3. Review your users

In WordPress under Users, look for administrator accounts you don't recognize. An unfamiliar admin is one of the clearest signs of a compromise — attackers create them to keep access.

4. Look for files you didn't create

Random-named PHP files in your uploads folder, or recently modified core files, are classic backdoor signatures. If you're comfortable with file access, check modification dates for anything that changed without your involvement.

5. Watch for host or performance warnings

Emails from your host about outbound spam or unusual resource usage, sudden slowdowns, or unexpected traffic spikes can all point to a site being quietly used by an attacker.

If two or more of these ring true

Treat it as a likely compromise. Take a full backup before touching anything, avoid deleting files at random, and run a thorough scan across core, themes, plugins, and the database. If you'd rather have a second pair of eyes, a free security audit will tell you exactly where you stand.