How can you tell if a site has been hacked? 8 WordPress signs and ways to check

A red browser screen: dangerous or deceptive site warning

If a full-screen red warning appears when entering the site, Google Safe Browsing has detected phishing, malware, or social engineering content. The Chrome Help page states that Safe Browsing is enabled by default and that a “Dangerous site” warning is shown on such sites. Google’s social engineering documentation uses the warning “Deceptive site ahead”; it is also commonly known as a deceptive site warning.

This warning does not mean the owner deliberately created a scam. The same Google document states that deceptive content sometimes appears when attackers take control of a site.

How to check: Enter the domain in the Safe Browsing site status tool in Google’s Transparency Report; the tool shows Safe Browsing’s latest analysis without visiting the site. If the result is “unsafe”, the detailed diagnosis is in Search Console’s Security Issues report.

Redirects to another website on mobile or when arriving from Google

If the site opens normally when typing the address directly but goes to a betting, pharmaceutical, or fake prize site when clicking from a Google result or phone, hidden redirect code is likely present. Google’s spam policies give examples of hacked sites sending users to suspicious pages when clicking from Google results and redirecting mobile users to a completely different domain. Showing different content to search engines and visitors is called cloaking.

Such code is often hidden from the owner: logged-in administrators or the same visitor on a second visit are not redirected. This is why an owner saying “it opens for me” can be misleading.

How to check: Visit by clicking a Google result in an incognito tab on a phone using mobile data without being signed in. Search Console’s URL Inspection tool shows the content Google sees on the page; Google’s Japanese hack guide also recommends checking for cloaking with this tool. For detailed repair, follow the process on the hacked WordPress site recovery page.

Unfamiliar administrator accounts and Search Console owners

If the WordPress dashboard contains an administrator user nobody created, this is one of the clearest signs of hacking. WordPress’s official document lists unauthorized new users among the obvious signs. Google’s Japanese hack guide explains that an attacker can add themselves as a property owner in Search Console and tamper with settings such as sitemaps.

How to check: Set the role filter to “Administrator” in the WordPress dashboard’s Users screen, and verify individually who owns every account. Look for unfamiliar owners or users in the Users and permissions section of Search Console settings; take an unfamiliar site verification notification email seriously as well. Agency and former developer accounts are also reviewed at this stage; an unused account can become an open door later.

Hosting warnings, spam email, and sudden slowdown

If the hosting company reports malicious files, suspends the account, or says bulk spam is being sent from the server, take the notice seriously. WordPress’s documentation lists a host shutting down a site among the obvious signs and states that hacked sites can be used to send spam email, which may result in the server’s IP address being blocklisted. The document also notes that on shared hosting, the issue may extend beyond a single site.

Sudden slowdown is a weak sign on its own. Unexplained server resource exhaustion, heavy overnight traffic, or a growing email queue becomes meaningful when seen alongside other signs; the fact that slowness often comes from plugins, images, or hosting is also explained in the WordPress site loading slowly article.

How to check: Open resource usage charts, email sending counts, and any malware scanner report in the hosting panel. If a warning email arrived, note its file paths and ask the hosting company’s support channel to confirm; enter the panel directly instead of clicking the email’s link.

Unfamiliar code in files: which files should you check?

Long meaningless character strings or obfuscated code snippets nobody added are concrete evidence of compromise. WordPress’s official documentation states that .htaccess is the most frequently modified file regardless of infection type. According to the document, index.php, header.php, footer.php, and functions.php are also targeted because they affect every page request.

How to check: Sort files by their last modified date in the hosting file manager; core files changed on a date when the owner did nothing deserve attention. Finding .php files in wp-content/uploads is also generally unusual because that folder is for images. Reading code requires technical knowledge; since deleting the wrong file can shut the site down entirely, it is safer at this step to take notes without changing anything.

False alarms mistaken for hacking

Not every malfunction is hacking; plugin conflicts, expired SSL certificates, and expired domains can also make a site suddenly look strange. Starting cleanup without making this distinction wastes both time and money. Common situations and the signs distinguishing them from hacking are as follows:

Why a website and email stop together when the domain expires is explained step by step in the what happens when a domain expires article. With plugin conflicts, temporarily disabling the conflicting plugin through the hosting file manager often brings the site back.

A 10-minute checklist

For a quick initial answer to how to tell whether a site has been hacked, follow the ten steps below in order; none of these steps changes the site. Record every step’s result with a screenshot and time, because WordPress’s documentation also recommends keeping this kind of incident record as the first task.

1. Search Google for site:alanadi.com and review several pages of results.
2. Repeat the same search with a word such as “casino” or “viagra”.
3. Query Safe Browsing site status in Google’s Transparency Report.
4. Open the Security Issues report in Search Console.
5. Check the Users and permissions list in Search Console.
6. Open the site by clicking a Google result on a phone without being signed in.
7. Count the users with the administrator role in the WordPress dashboard.
8. Look through the plugins list for any plugin whose installation nobody remembers.
9. Review resource usage and email sending counts in the hosting panel.
10. Check recently changed files and .php files in the uploads folder using the file manager.

If two or more steps return negative results, the likelihood of compromise is high. If only one step raises suspicion, return to the false alarm table or request a free preliminary assessment.

First steps if the site is hacked: backup and password order

If the site has been hacked, the first task is to back up its current state without panicking and lock down access in the correct order. WordPress’s official document lists staying calm as the first step and recommends copying the environment before cleanup even if infected; this copy serves as evidence for finding the entry route. In common practice, the first reflex is deleting files or changing only the WordPress password, but both actions often allow the problem to return.

The order we follow for password changes is based on the official document’s recommendations:

1. Scan the computer: The document states that an attack often starts when a Trojan on the local computer steals FTP and dashboard passwords; if passwords are changed from an infected device, the new passwords may also be stolen.
2. All access points: Change hosting panel, FTP/SFTP, WordPress administrator, and database passwords; this also includes other users with dashboard access.
3. Terminate active sessions: Refresh the secret keys in wp-config.php to sign out everyone with an active session.
4. A second change after cleanup: The document requires passwords to be changed once again after the site is cleaned.

Cleanup, reinstalling core files, database scanning, and the Google review request are separate specialist work; the detailed steps appear on the recovering a hacked WordPress site page. According to Search Console, review requests may take a few days or a few weeks to conclude. Measures to prevent the site from being hacked again are covered in the WordPress security guide, while regular updates and backups are handled through the annual WordPress maintenance service, with maintenance costing 500–2,000 TL per month. If Google visibility has fallen after a hack, an SEO analysis can separately examine which pages were affected.