Most WordPress hacks are quiet. There is no ransom note and no defaced homepage. The site looks normal to you while it redirects mobile visitors to a pharmacy ad, shows spam to search crawlers, or sends mail from your server. That is why many hacks run for weeks before anyone notices.

Check it in 5 minutes

You need no plugin and no technical skill for these five checks. Do them in order.

  1. Search Google for your own site. Type site:yourdomain.com into Google, then try site:yourdomain.com casino OR pills OR loan OR replica. Pages or titles you never wrote mean spam has been injected.
  2. Look up your domain in Safe Browsing. Open Google's Safe Browsing site status, enter your domain, and read the result.
  3. Open Search Console. In Google Search Console, choose your site, then Security & Manual Actions → Security issues. Google often flags a hack here before you see anything yourself.
  4. Review your administrators. In wp-admin go to Users → All Users and filter by Administrator. Remove nothing yet, just note any name or email you do not recognize.
  5. Visit your site the way a stranger would. On your phone, using mobile data, search Google for your site and tap the result instead of typing the address. Redirect hacks often fire only for search visitors or only on mobile, so they stay hidden when you visit directly.
Found something? Do not delete files yet. Take a full backup first, because the infected copy helps you find how the attacker got in. Then follow How to Fix a Hacked WordPress Site.

8 signs your site may be compromised

  1. Unexpected redirects. Visitors land on a different site, sometimes only from search results or only on mobile.
  2. A Google warning. "This site may be hacked" under your listing, or a security issue in Search Console.
  3. An administrator you didn't create. Attackers add a hidden admin so they can return after you change your own password.
  4. PHP files where only images belong. Random names such as wp-cache-xk29.php inside wp-content/uploads or theme folders.
  5. Spam in your page source. Hidden links or pharmacy and gambling keywords. Use View Source and search for viagra, casino or display:none.
  6. A sudden traffic or ranking drop. Google may be removing pages it now considers compromised.
  7. Unexplained resource spikes. CPU, bandwidth or outgoing email volume well above your normal pattern.
  8. Your host suspends the account. Many hosts do this automatically when a site starts serving malware or sending spam.

Deeper checks if you have SSH or WP-CLI

These commands read your site from the server. Run them from the WordPress folder, usually public_html. None of them changes anything.

Compare WordPress core against the official files

wp core verify-checksums
wp plugin verify-checksums --all

Each command compares your files with the official copies from wordpress.org and lists anything that differs or is missing. Custom and premium plugins that are not on wordpress.org will not be checked.

Find PHP files hiding in uploads

find wp-content/uploads -name "*.php"

The uploads folder should hold media, not code. Any result deserves a look, though a few plugins do store a harmless index file there.

Find recently changed PHP files

find . -type f -name "*.php" -mtime -7

This lists PHP files changed in the last seven days. Compare the list with your own update history. Files changed on a day you did nothing are worth opening.

List administrators and check the site address

wp user list --role=administrator
wp option get siteurl
wp option get home

The last two values should both be your own domain. A hacked site is sometimes pointed at another domain through these settings alone, without any changed file.

What a scanner can and cannot tell you

A signature-based scanner looks for known malware patterns. It is a quick first pass and catches a lot. It can miss new or custom malware, and a scanner that only looks at your site from outside cannot see files, users or database rows. Checking from the server side, with file comparison and database review, covers more.

How SiftWP helps

SiftWP runs this kind of check every week over SSH, with no plugin on your site. It covers core file integrity, database drift, malware patterns, mixed-content SSL issues and new files in uploads/. An AI agent investigates what it finds, fixes what is safe, and asks before anything risky.

Start with free credits, no card needed

Things that look like a hack but often aren't

  • Changed files after an update. Core, plugin and theme updates rewrite files. Check the modification date against your update log.
  • Cache and security plugin files. Some plugins keep PHP or log files under wp-content. Check the name against your installed plugins before deleting.
  • A ranking drop. Algorithm updates and competitors cause these too. A drop alone is weak evidence unless it comes with another sign.

What to do next

One confirmed sign is enough to start fixing. Take a backup, change every password, then work through the steps in How to Fix a Hacked WordPress Site. If you found injected code, How to Remove Malware From a WordPress Site covers removal in detail.

How to fix a hacked WordPress site → How to remove WordPress malware → How to find a WordPress backdoor → WordPress core file integrity check → WordPress security checklist → How often to scan for malware →