Can a WordPress site be hacked without me noticing?

Yes. Many infections are built to hide from the owner: redirects that only fire for mobile visitors or people arriving from Google, spam pages served only to search engines, and backdoors that do nothing until the attacker uses them.

Is a free online scanner enough to tell if my site is hacked?

An external scanner only sees what your site shows the public, so it catches visible malware and blocklist status but misses backdoors and database injections. Combine it with the checks on the server and in Search Console.

What should I do first if I think my site is hacked?

Take a full copy of the files and database before changing anything, lock out accounts you don't recognize, and then follow a cleanup sequence rather than deleting files at random.

9 Signs Your WordPress Site Has Been Hacked

Most WordPress hacks are built to stay quiet. The attacker wants your site's reputation and traffic, so the infection often hides from you while it shows spam to Google or redirects visitors you'll never hear from. These are the nine signs we see most often, with a quick way to check each one.

1. Visitors are redirected to other sites

The most common symptom. Redirects frequently trigger only for some visitors: people on mobile, people arriving from a Google search, or first-time visitors. That's why the owner, logged in on a desktop, often sees nothing wrong.

How to check: open a private browser window on your phone, search Google for your business, and click your own result.

2. Google shows "This site may be hacked"

Google adds this warning under results when it detects spam content or hacked pages on your domain. Chrome may show a full red warning page for malware.

How to check: search for your domain and read your own result. In Google Search Console, open Security Issues.

3. Pages you never wrote appear in Google

The "Japanese keyword hack" and pharmacy or casino spam create thousands of pages under your domain to borrow your rankings.

How to check: search Google for site:yourdomain.com and scroll. Also try site:yourdomain.com viagra or site:yourdomain.com casino.

4. Unknown administrator accounts

Attackers create admin users so they can get back in after a cleanup, sometimes with names that look legitimate, like "wpadmin" or a copy of a real user's name.

How to check: in the dashboard, go to Users and filter by Administrator. Every account should belong to someone you can name.

5. Your host suspended the account or flagged malware

Hosts scan for malware and outgoing spam, and they will suspend an account rather than let it infect others.

How to check: read every email from your host from the past month, including the ones in spam.

6. PHP files in the uploads folder

wp-content/uploads holds images and documents. It should never contain PHP files. A .php file there is almost always a backdoor.

How to check: in your hosting file manager or over SFTP, search wp-content/uploads for files ending in .php.

7. Core files that don't match WordPress

Attackers modify core files or add new ones with official-looking names.

How to check: if your host offers WP-CLI, run wp core verify-checksums. It lists every core file that differs from the official release.

8. The site sends spam, or your email lands in junk

A compromised site can be used to send spam, which damages your domain's email reputation.

How to check: ask your host whether outgoing mail volume has spiked, and test your domain on email blocklist checkers.

9. Sudden slowness or unexplained resource use

Crypto-mining scripts, spam generators, and attacks launched from your server all use CPU and bandwidth.

How to check: compare your hosting resource graphs with last month. A jump with no traffic increase to explain it deserves a closer look.

If you found one or more of these

Don't start deleting files at random. Take a full copy of the files and database first, then follow a proper sequence: contain, find the entry point, replace infected files, rotate every credential, close the hole, and request reviews from Google. Our step-by-step guide on how to fix a hacked WordPress site walks through it.

If the site is a store, handles customer data, or has been reinfected before, our WordPress malware removal service does the whole cleanup and tells you exactly how the attacker got in.

9 Signs Your WordPress Site Has Been Hacked (and How to Check)