Here’s a scenario nobody wants to face: you wake up, grab your coffee, and check your website: only to find it’s been completely defaced, redirecting visitors to some dodgy pharmaceutical site, or worse, Google’s slapped a big red “This site may harm your computer” warning on it.
WordPress powers over 40% of the web, which makes it a massive target for hackers. The good news? Most hacks leave behind telltale signs. If you catch them early, you can minimise damage, protect your visitors, and get your site back on track fast.
Let’s break down the five warning signs that your WordPress site may have been compromised: and what you can do about it.
1. Your Homepage Looks… Different
This one’s the most obvious red flag. You load up your site and something’s off. Maybe the layout’s changed. Maybe there’s content you definitely didn’t write. Or perhaps there’s a lovely message from a hacker announcing they’ve taken over.
Some attackers deface sites purely for bragging rights. Others inject malicious content designed to steal visitor information or redirect them to phishing pages. Either way, if your homepage doesn’t look like you remember it, don’t brush it off as a glitch.
What to do: Take a screenshot immediately (for evidence), then check your WordPress dashboard. Look at recent changes to pages, posts, and theme files. If you can’t access the dashboard at all, that’s an even bigger problem: which brings us to the next warning sign.
2. You’re Locked Out of Your Own Dashboard
You type in your username and password. You’re 100% certain they’re correct. But WordPress keeps rejecting you.
This is a classic sign that a hacker has already gained admin access and changed your credentials. Once they’re in, they often delete other admin accounts or change passwords to lock out the legitimate owner. It’s their site now: or at least, that’s what they think.
What to do: Try the password reset function first. If that doesn’t work (or if the email address has been changed), you’ll need to access your database directly via phpMyAdmin to reset your password or create a new admin user. If that sounds intimidating, it’s time to call in professional help.
Pro tip: This is exactly why we recommend enabling two-factor authentication and using strong, unique passwords. Prevention beats cure every time.
3. Your Traffic Has Tanked (Or Google’s Flagged You)
You check your analytics and notice a sudden, dramatic drop in traffic. Where’d everyone go?
There are two common culprits here:
- Malicious redirects: Hackers inject code that redirects visitors (especially those coming from search engines) to spam or malware sites. You might not even notice because the redirect often doesn’t trigger when you’re logged in as an admin.
- Google Safe Browsing warnings: If Google detects malware or phishing content on your site, they’ll show a warning to users before they can access it. Most people see that red screen and immediately hit the back button. Can you blame them?
What to do: Check Google Search Console for any security issues flagged against your site. You can also use free scanning tools like Sucuri SiteCheck to see if your domain has been blacklisted. If redirects are happening, inspect your .htaccess file and wp-config.php for any suspicious code.
4. Mystery Admin Accounts Have Appeared
Head to your WordPress dashboard and navigate to Users > All Users. See any accounts you don’t recognise? Especially ones with Administrator privileges?
If you haven’t enabled open registration (and you probably shouldn’t for most business sites), new user accounts appearing out of nowhere is a major red flag. Hackers create these accounts to maintain access even if you change your own password or remove malware.
What to do: Delete any suspicious accounts immediately. Then check your site’s registration settings under Settings > General and make sure “Anyone can register” is unchecked (unless you specifically need it). While you’re at it, review the roles assigned to all existing users: only give admin access to people who absolutely need it.
5. Weird Pop-Ups, Ads, or Spam Links You Didn’t Add
Your visitors start complaining about pop-ups. Or you notice banner ads promoting things you’d never endorse. Maybe there are random links scattered through your content pointing to suspicious domains.
This type of hack is particularly sneaky. The injected content often only displays to:
- First-time visitors
- Users arriving via search engines
- Non-logged-in users
So if you’re always logged in as an admin, you might never see it yourself. Meanwhile, your visitors are getting bombarded with spam: and your reputation takes a hit.
What to do: Log out and visit your site in incognito mode. Better yet, ask a friend to check it on their device. Use a malware scanner to detect injected scripts in your theme files, plugins, or database. This type of infection can be tricky to fully remove, so professional wordpress malware removal may be necessary.
What To Do If You Suspect Your Site Is Hacked
Don’t panic: but don’t delay either. Here’s a quick action plan:
- Take your site offline (or enable maintenance mode) to prevent further damage to visitors.
- Scan for malware using a security plugin or external scanner.
- Check for backdoors in your files: hackers often leave hidden access points to get back in later.
- Restore from a clean backup if you have one (you do have backups, right?).
- Update everything: WordPress core, themes, and plugins. Outdated software is the number one entry point for attacks.
- Change all passwords: WordPress admin, hosting account, FTP, database. All of them.
- Harden your security to prevent it from happening again.
Prevention Is Always Better Than Cleanup
Getting hacked is stressful, time-consuming, and potentially expensive. The best approach is to stop attacks before they happen.
At Shadowtek, we take wordpress security seriously. Our hosting includes Imunify360 real-time defense, which actively monitors and blocks threats before they can compromise your site. We also offer security hardening services that lock down vulnerabilities hackers love to exploit: things like weak file permissions, exposed login pages, and outdated software.
And if the worst has already happened? Our wordpress malware removal service will clean up the mess, patch the holes, and get your site back online safely.
Don’t Wait Until It’s Too Late
Hackers aren’t going away. If anything, attacks on WordPress sites are becoming more sophisticated and more frequent. The warning signs we’ve covered today: defaced pages, lockouts, traffic drops, mystery admins, and rogue pop-ups: are your early detection system.
Catch them early, and you can limit the damage. Ignore them, and you risk losing customer trust, search rankings, and potentially your entire site.
Need help securing your WordPress site or cleaning up after a hack? Get in touch with the Shadowtek team( we’ve got your back.)