Most hacked websites look completely normal. The home page opens. The logo is there. Nothing flashes red. The owner finds out weeks later, from a customer or from Google.
I clean hacked WordPress sites every week. The signs your website is hacked are almost always there already. The owner simply did not know what to look for.
Here are the five signs I see most often, and how to check each one yourself in a few minutes.
1. Google shows Japanese text under your pages
Open Google and search for your own site. Type site:yourdomain.com and press enter.
If you see page titles in Japanese, or in any language you have never published in, your site is infected. This is one of the most common WordPress attacks in the world right now. The attacker quietly adds thousands of spam pages to your site and sells counterfeit goods through them.
You will usually not see these pages when you browse your own site. They are built to show only to search engines. That is exactly why the search result is the first place the problem becomes visible.
2. Your site redirects, but only for some visitors
You open your website and everything is fine. A customer opens the same link on a phone and lands on a betting site.
That is a conditional redirect. The malicious code checks who is visiting before it decides what to do. It leaves logged in administrators alone. It often leaves desktop visitors alone. It sends everyone else away.
So test it the way a stranger would. Use mobile data instead of your office wifi. Open a private window. Click your site from a Google search result rather than typing the address. If it behaves differently there, you have a problem.
3. There is an administrator account you never created
Log in to WordPress and open Users. Look at every account that has the Administrator role.
Attackers almost always leave a second door. The username is usually something that looks official, like wpsupport or admin2, or a short string of random letters. Check the email address on each account as well. An administrator account attached to a free email address you do not recognize is a serious red flag.
Check the plugin list in the same visit. A plugin you did not install, with no author and no description, is the same story in a different place.
4. Your host suspends the account, or your email stops arriving
A suspended hosting account rarely comes out of nowhere. In most cases the server has been sending spam for days, and the host finally noticed.
The same thing shows up in a softer way first. Your business email starts landing in spam folders. Clients say they never received your reply. Your domain quietly ends up on a blocklist because your server was used to send thousands of messages you never wrote.
If deliverability suddenly gets worse and nothing changed on your side, treat it as a security question, not an email question.
5. Files changed on a day you did nothing
Open the file manager in your hosting panel and sort the files by date modified.
You know when you last updated your site. If core WordPress files or theme files were modified on a random Tuesday at three in the morning, something else edited them. Pay close attention to anything sitting in the uploads folder that does not look like an image or a document. That folder should hold media, nothing else.
What to do first, before you delete anything
The instinct is to find the bad file and delete it. That is usually the wrong first move.
- Take a full backup first. Files and database. Even an infected backup is useful, because it is the only record of what happened and how the attacker got in.
- Change every password. Hosting, FTP, database, WordPress admin and the email account linked to it. Changing only the WordPress password achieves nothing if the attacker still has FTP access.
- Do not trust a single clean scan. Most infections are planted in several places at once, so that deleting one copy restores nothing.
- Check again after seven days. If the site reinfects itself, the real entry point was never closed. The cleanup was cosmetic.
The part most people skip
Cleaning a site and securing a site are two different jobs. A clean site with the same outdated plugin, the same weak password and the same open file permissions is simply a site waiting for the next visit.
After every cleanup I do the second job too. Update everything, remove what is not in use, lock down file permissions, add proper login protection and set up monitoring, so you find out before Google does.
If something here matched your site
Send me the URL. I will tell you honestly whether it is infected and what it will take to fix. I clean hacked WordPress sites, usually within 24 hours, and I harden them afterwards so the same hole is not sitting there next month.
