Signs Your WordPress Site Has Been Hacked

Most compromises are found by accident. These are the symptoms owners report, and what each one typically indicates.

Obvious

• Visitors are redirected somewhere else — injected code in the theme, a plugin, or the options table. Frequently mobile-only or search-referral-only.
• Pages you did not write — SEO spam, often the result of arbitrary content creation. See the importer disclosure.
• A browser or search warning — someone else already noticed.
• The host suspended the account — usually outbound spam or CPU abuse from injected code.

Less obvious

• An administrator you do not recognise, or an existing account whose email address changed.
• You cannot log in, and password reset emails never arrive — a hijacked admin email.
• The site got slow — cryptomining or spam sending consumes real resources.
• New scheduled tasks, or a plugin you did not install.
• Search results show content that is not on the page — cloaking, shown to crawlers only.
• Contact-form email stopped arriving — your domain got blacklisted for spam you did not send.

What to do in the first hour

1. Do not delete anything, and do not immediately restore an old backup — both destroy the evidence needed to find the entry point.
2. Take a full snapshot of files and database as they are now.
3. Change administrator passwords and regenerate the salts in wp-config.php to end every session.
4. Then start the cleanup process, or get help.

Hardening reduces the damage. Patching removes the hole. Scan your site free to see what still needs patching.