Signs that your WordPress site is hacked

A hacked WordPress site can look normal to its owner. Much malicious code only fires for visitors coming from Google, for phone users or for search engines, and not for a logged-in administrator. That is why many owners only find out when Google warns them, a customer complains or the host takes the site offline.

Signs that the site is hacked

• Visitors from Google or on a phone are redirected to another website, while the site looks normal when you type the address yourself.
• A Google search for site:yourdomain.com shows pages you never created, for example in Japanese or advertising pills and casinos.
• Google shows "Deceptive site ahead" or another warning, or the Security Issues report in Search Console has findings.
• The Users screen lists administrators you don't recognise.
• There are PHP files in wp-content/uploads, where there should only be images and documents.
• There are files in wp-content/mu-plugins you don't know, or plugins in the list you never installed.
• Your host has suspended the site, or your email provider warns that the domain is sending spam.
• Sucuri SiteCheck finds malware on the site or shows the domain on a blocklist.

One of these signs is enough reason to look closer. If you have SSH and WP-CLI, compare WordPress core and the plugins from wordpress.org with the official checksums. wp core verify-checksums and wp plugin verify-checksums --all list the files that don't match the originals.

What to do first

1. Take a copy before you clean up. Download the files, export the database and save the access logs, because many hosts delete them after a short time. Without that copy you can't find out how the attacker got in.
2. Change every password: the WordPress users with administrator access, the hosting panel, FTP, SFTP and the database. Update DB_PASSWORD in wp-config.php with the new database password at the same time, or the site loses its database connection.
3. Log everyone out. Change the salt keys in wp-config.php, which invalidates every logged-in session, including the attacker's. You can get new keys from https://api.wordpress.org/secret-key/1.1/salt/.
4. Write down the user names and email addresses of unknown administrators, and lock them out as the article on unknown administrators explains. Delete them once everything is updated.
5. Update everything that is out of date: WordPress, plugins and themes. Delete plugins and themes you don't use.

Why deleting files isn't enough

A scanner only finds malware it already knows. An attacker who got in may have left more back doors: an extra administrator, code in the database or a file named like a WordPress file. If you only delete what the scanner found, the attacker can use one of the remaining back doors to get back in.

A thorough clean-up means reinstalling WordPress core, plugins and themes from clean copies, going through the database and the uploads folder, and finding the vulnerability the attacker used. That can be an outdated plugin or a leaked password. If you have a backup from before the attack, restoring it and then fixing the vulnerability can be faster.

When Google has flagged the site

Once the site is clean, request a review under Security Issues in Search Console and describe what you did. Google checks the site again, and the warning is removed when no more problems are found.

If it happens again

If the attack comes back after a clean-up, the vulnerability is still open. Someone has to go through the files, the database and the server logs to find how the attacker got in. That requires access to the hosting account and a developer with experience in WordPress security.