How to tell if your WordPress site is infected

The signs you can see

Some infections are obvious: the site redirects to somewhere strange, pages fill with spam links or pop-ups, or you get a browser warning in red. Your host may email you or suspend the account. These are the loud ones — and if you see them, act immediately.

The signs you have to look for

Most modern hacks are quiet on purpose. Common quieter signals include: Google showing “This site may be hacked” under your listing, pages appearing in search results that you never created (often selling counterfeit goods or in another language), a sudden drop in rankings, new admin users, or unfamiliar files with recent modified dates.

The three fast checks

You can rule most of this in or out in a few minutes. One: open Google Search Console and check the Security Issues report. Two: search site:yourdomain.com on Google and scan for pages that aren’t yours. Three: in WordPress, look at your list of users for any admin you didn’t add. If all three are clean, you’re probably fine; if any raises a flag, scan deeper.

Don’t wait it out

The instinct to “see if it gets worse” is the costly one. Infections spread, get discovered by Google, and turn a small clean-up into a suspension and a ranking recovery. The earlier you catch it, the less there is to fix.

What this means for you

If any of these signs are showing and you’re not certain, get it checked properly. A proper scan looks at the files and database, not just the front end — because the whole point of a good hack is that the front end looks fine to you.

The infection types that show up most often

Not all hacks look the same. When I clean up a WordPress site is infected case, the pattern is telling. It shows me how the attacker got in. SEO spam injection is the most common type by far. Hackers plant hidden text and links on your pages. You can't see them. Google's crawler can. The links are built to rank for pills, replica goods, or gambling sites. They borrow your domain's trust to do it.

Pharma hacks are a close second. They're often layered on top of the same spam injection. Fake product pages get generated by the thousand. They usually sit in a subfolder you never open. Catch a WordPress site is infected with this variant early, and cleanup is simple. Just search your own domain on Google. Look for pages selling things you don't sell. If they're there, act fast.

Defacement attacks are rarer but harder to miss. The homepage gets replaced entirely, often with a political message or a hacker's calling card. It's the loudest possible signal you'll ever get. Most attackers don't want to be found, though. Quiet spam injection stays far more common than any dramatic takeover. Some hackers even use defacement as a distraction. A quieter backdoor gets installed somewhere else on the server, while everyone's staring at the homepage. By the time anyone checks, the WordPress site is infected in two places, not one.

Cloaked redirects that only trigger for some visitors

This one is sneaky by design. A cloaked redirect sends regular visitors from Google straight to a spam or scam page. But it leaves you alone when you visit directly. The code checks the referrer header first. Arrive from a search engine, and you get bounced somewhere else. Type the URL in yourself, and the page loads like nothing's wrong.

This is exactly why a WordPress site is infected for months without anyone noticing. You never see the symptom. You never arrive the way a hacked visitor does. The fix is simple, though. Click through from an actual Google search result. Use a device you don't normally use. Clear your cookies first if you can.

Mobile-only cloaking is a variant worth knowing about. Some scripts only fire the redirect on phones, never on desktop. A WordPress site is infected this way, and a desktop-only check will pass every single time. Testing from an actual phone, off your home network, closes that gap fast. It's a five-minute check most owners simply never think to run.

Fake login forms and credential theft

Some infections skip your public pages entirely. Instead, they inject a fake login form into checkout, or straight into your real wp-login page. It looks identical to the genuine one. Every password typed in gets logged somewhere the attacker controls. Sometimes it's emailed out immediately. Sometimes it just sits in a hidden file, collected in batches.

This variant is dangerous because it spreads past your own site. A WordPress site is infected this way, and every customer who logs in hands over a password. Reused passwords make it worse. That one leaked password can unlock accounts on completely unrelated services. Watch for login forms that behave slightly off. A delayed redirect. An extra field. A URL that doesn't quite match your own domain.

Checkout skimming is a close cousin of this. Instead of a fake login screen, a script sits quietly on the payment page itself. It captures card details as they're typed, before your payment processor ever sees them. WooCommerce stores are a frequent target, since the checkout page is predictable and easy to script against. The customer sees nothing unusual. Their order still goes through normally. That's exactly why a WordPress site is infected this way for so long. Nobody notices until it's too late.

Cryptomining scripts running in the background

Cryptomining injections are less common than a few years back. They still turn up, though. A script runs inside the visitor's browser. It quietly uses their spare processing power to mine currency for someone else. Visitors on older laptops or phones notice their fans spin up. Sometimes the browser tab freezes entirely, and they just leave.

Server-side cryptomining is worse for you as the owner. It doesn't touch your visitors at all. It just burns through your hosting resources around the clock, quietly, in the background. If your WordPress site is infected with a server-side miner, your host usually notices before you do. That shows up as a resource-usage warning, or sometimes a full account suspension with no warning at all.

Spotting server-side mining doesn't require special tools. Your hosting control panel usually graphs CPU and memory use over time, going back weeks. A flat baseline that suddenly jumps and stays high is worth investigating. Especially with no matching rise in visitors. It's one of the plainer signs a WordPress site is infected at the server level. It's often the easiest one to catch early, too.

Server-level signs most owners never check

Your WordPress dashboard only shows part of the picture. The server underneath tells its own story, if you know where to look. Watch for a sudden spike in outbound traffic. Especially at odd hours, with no matching spike in real visitors. That's a classic sign something on your server is talking to the outside world without permission.

Unfamiliar cron jobs are another giveaway worth checking. WordPress and your plugins schedule their own routine tasks constantly. Hackers schedule tasks too. Usually to re-infect files right after a cleanup. Sometimes just to keep sending spam email in the background, batch after batch. Most hosting panels let you view scheduled tasks directly. If you don't recognize one sitting there, don't assume it's harmless.

Outbound email is another channel worth watching closely. Hacked sites often get used to blast spam email at scale. They borrow your server's reputation to slip past spam filters that would normally catch it. The first sign is usually your own domain landing on an email blacklist. That then blocks your legitimate mail from reaching customers too. It's often how owners first notice their WordPress site is infected. Sometimes days or weeks after the fact.

What file timestamps and file integrity reveal

Every file on your server carries a last-modified date. Core WordPress files shouldn't change between official updates. Spot core files modified outside an update window, and that's a strong signal. It usually means your WordPress site is infected at the file level, not just inside the database. Timestamps are one of the fastest tells there is.

The harder cases are new files with names built to look boring. A file called class-cache-helper.php, sitting quietly in your uploads folder, raises no red flags on sight. It's dropped into a directory that already has hundreds of legitimate files. Real integrity checking compares every file against a known-clean WordPress core. That catches this kind of thing far faster than scanning by eye ever could.

Checksums take this further than timestamps alone. A checksum is a short fingerprint generated from a file's exact contents. Change even one character, and the fingerprint changes completely, every time. Comparing checksums against an official WordPress release catches subtle tampering that a modified date might miss. It works even when an attacker deliberately resets a file's timestamp to hide the change.

Why the infection hides specifically from you, the admin

This trips up more site owners than anything else on this list. A lot of modern malware checks who's viewing the page before it decides what to show. Logged in as an administrator? You see the clean, normal site, every single time. Coming from your own home IP address? Same result. Everyone else gets the actual payload.

It's a deliberate design choice, not an accident or a bug. The longer a WordPress site is infected without the owner noticing, the more time it has to spread. More time to get indexed by Google too, which makes the cleanup harder later. Checking from an incognito window while logged out closes this blind spot fast. A different network helps even more.

Some scripts add a time delay on top of the referrer check. The page loads clean for the first few seconds. Then it swaps in the malicious content once the delay passes. A quick glance won't catch this at all. Watching a page load fully helps. Refreshing it a few times in a row catches it more reliably than a single fast look.

What free scanners catch, and what they miss

Free scanning plugins are a genuinely useful first pass. They compare your files against a database of known malware signatures. Find a match, and you get a clear alert. That part works well, most of the time. What they generally miss is anything custom-written just for your site. Nothing in their signature database matches it, so nothing gets flagged.

They also tend to miss anything hiding inside the database rather than the files themselves. Injected scripts in a post or a widget slip right past a file scanner. So does the conditional logic described above. A free scanner logged in as you will often see a perfectly clean site. Meanwhile, every other visitor is seeing something completely different.

Free scanners cut both ways, too. They sometimes flag legitimate custom code as suspicious, simply because it looks unusual to a generic signature check. That creates alert fatigue fast. A few false alarms in a row, and it's tempting to start ignoring the warnings altogether. Including the one time it's actually right, which is exactly when it matters most.

What a thorough professional scan actually checks

A proper professional scan goes well beyond a signature match. It checks every single file against a clean, current core copy. It reads through the database line by line for injected scripts. It looks for rogue admin accounts hiding among the real ones. It checks file permissions and scheduled tasks too, not just the obvious spots.

Most importantly, it traces how the attacker actually got in. Not just what they left behind on the way out. I've cleaned up more than 10,000 WordPress sites over the years. The entry point is almost never where the owner first assumed it was. Finding it is the difference between a fix and a temporary patch.

Automated tools matter, but manual review still catches what they can't. A trained eye looking through unfamiliar files spots patterns no signature database has seen yet. That combination matters: automated scanning plus manual review. It's what separates a quick plugin scan from an actual professional cleanup. It's also the only way to confirm a site is genuinely clean, not just quiet.

What happens if you leave it unresolved

An infection that isn't fully removed tends to come back. Reinfection happens because the original entry point never got closed. That might be an outdated plugin. A leaked password. A weak file permission somewhere nobody checked. Wiping the visible symptoms doesn't fix that door. It's a short-term move at best. It rarely holds for long.

This is the part DIY cleanups usually get wrong. Deleting the obvious spam files can hide the symptom for a few weeks. A "WordPress site is infected" warning might vanish from Google. That doesn't mean the threat is gone. If the backdoor script survives in an unused theme folder, the same infection comes back. Often worse than before, and usually faster the second time around.

Recovery afterward isn't instant either. Once Google flags a site, or a blacklist picks it up, clearing that flag takes time. That's true even after the malware is fully gone. Search rankings usually take longer still to recover than the technical cleanup itself. That gap sits between fixing the problem and the internet noticing. It's the real cost of waiting to act in the first place.