Your WordPress Site May Have Been Compromised Last Week. Here’s How to Check.

If your WordPress site suddenly feels a little off (weird search results, a plugin you don’t remember installing, or a client asking why your homepage redirected them to a shady pharmacy site) it may have been compromised. To check, look for unfamiliar admin users, unexpected files in your plugin or theme folders, new warnings in Google Search Console, and any sudden drop in traffic or rankings. A malware scan will confirm what your eyes might miss.

WordPress powers a huge share of the internet (W3Techs has tracked it at well over 40% of all websites for years), which makes it an enormous target. Hackers don’t need to single you out personally. They run automated scripts that scan millions of sites at once, looking for outdated plugins, weak passwords, or known vulnerabilities in themes. If your site checks any of those boxes, it can get swept up in a mass compromise without anyone ever typing your domain name into a browser on purpose.

That’s the uncomfortable truth about WordPress security: it’s rarely personal, and it’s rarely dramatic. Most business owners don’t get a ransom note or a defaced homepage. They get something quieter and, in some ways, more dangerous: a site that looks completely normal to them but is quietly serving spam links to Google, redirecting mobile visitors to scam pages, or sending your customer data somewhere it shouldn’t go.

Why WordPress Sites Keep Getting Targeted

WordPress itself is generally secure when it’s kept up to date. The real risk almost always lives in the plugins and themes layered on top of it. Every plugin you install is another piece of code written by a different developer, with its own update schedule, its own bugs, and its own potential vulnerabilities. A credit union or local business might be running fifteen or twenty plugins without realizing it, and each one is a small, separate door into the site.

When a vulnerability is discovered in a popular plugin, it’s public knowledge almost immediately, security researchers publish disclosures, and that information becomes a roadmap for anyone running automated attack tools. Sites that haven’t updated the affected plugin become sitting targets, sometimes for months, until the owner either patches it or gets compromised. This is exactly why a plugin that seemed safe last year can turn into a liability overnight with no action on your part other than not updating it.

This pattern is also why “it happened last week” is such a common story. A widely used plugin gets flagged, attackers move fast, and thousands of sites running that plugin get hit in a short window before most owners even hear about the vulnerability. If you haven’t logged into your WordPress dashboard in a while, there’s a real chance something changed without your knowledge.

The Warning Signs You Can Check Right Now

You don’t need to be technical to spot most of the red flags. A compromised site usually leaves at least a few fingerprints, and checking for them takes less time than you’d think.

Unfamiliar Admin Users and Login Activity

Log into your WordPress dashboard and go to Users. Look at every account listed, not just the ones you recognize. A common trick is for attackers to create a new administrator account with a name that sounds legitimate, like “support” or “admin2,” so it blends in. If you see an account you didn’t create, or one with a role higher than it should have, that’s a strong sign something is wrong. Also check the “last login” information if you have a security plugin installed that tracks it, since a login at 3 a.m. from a country you’ve never done business in is worth investigating.

New or Modified Files You Didn’t Add

This one requires a little more digging, but it’s worth doing if you have FTP or file manager access through your host. Compromised sites often have extra files sitting in the wp-content/uploads folder, or modified versions of core files with strange code appended to them. If you see files with random character strings for names, or PHP files sitting inside your uploads folder (which should generally only contain images and media), that’s not normal.

Sudden Changes in Search Rankings or Traffic

One of the most common signs of a hacked WordPress site is a sudden, unexplained shift in your search visibility. If you search your business name on Google and see spammy titles or descriptions you didn’t write, or if pages you don’t recognize show up in your site’s search results, your site has likely been injected with hidden content designed to manipulate search engines. This is often the first sign business owners notice, usually because a customer mentions it before the owner ever sees it themselves. If you’re not already keeping an eye on your traffic and rankings on a regular basis, the 5-minute weekly website check is a good habit to build, because catching this kind of drop early makes cleanup a lot less painful.

Unexpected Redirects and Pop-ups

Try visiting your site from your phone using mobile data instead of WiFi, and try it in a private or incognito browser window. Some malware is written to behave normally for logged-in admins and desktop visitors while redirecting mobile traffic from search engines to a completely different site. If your homepage behaves differently depending on the device or how someone arrived there, that’s a serious signal that something has been injected into your code.

Where to Look First: Five Places to Check Today

If you’re short on time and just want to know where to start, a handful of places will tell you almost everything you need to know.

Google Search Console

If you have Search Console set up (and if you don’t, that’s a project for another day), check the Security Issues section. Google actively scans indexed sites for malware and will flag your property directly if it detects injected spam content, phishing pages, or malicious redirects. This is one of the most reliable free tools available, because Google is essentially crawling your site the same way an attacker’s target audience would find it.

Your Hosting Provider’s Malware Scanner

Most reputable WordPress hosts run some level of automated malware scanning and will notify you if they detect something. Log into your hosting account and look for any security notices, quarantined files, or flagged directories. If your host has suspended or limited your account, that’s usually them protecting other customers on the same server from a compromise they’ve already detected on yours.

Your robots.txt File

This one surprises people, but it’s a favorite target for attackers because it’s so rarely checked. Malicious code sometimes rewrites your robots.txt file to either block search engines from crawling your real content or, more deviously, to allow crawling of spam pages the attacker has planted. We’ve written before about how a misconfigured robots.txt file can quietly tank your visibility, and it’s just as relevant when the misconfiguration is malicious rather than accidental. Pull up yoursite.com/robots.txt and read through it. If you see directives you didn’t write, or references to folders that shouldn’t exist, that’s worth flagging to whoever manages your site.

Plugin and Theme File List

From your dashboard, go to Plugins and look at the full list, including inactive ones. Attackers sometimes install a plugin, use it to establish access, and then deactivate it so it’s less likely to be noticed. Anything you don’t recognize should be treated as suspicious until proven otherwise. The same goes for themes; check for any theme files listed that you didn’t install, especially generic-sounding ones.

Recently Modified Files, Sorted by Date

If your hosting control panel allows it, sort your site’s files by “last modified” date. A cluster of files all changed on the same day, especially core WordPress files that shouldn’t need frequent updates, is a strong indicator that something (or someone) made changes outside of a normal update cycle.

Tools That Do the Heavy Lifting

You don’t have to do all of this manually every time. Security plugins like Wordfence and Sucuri are widely used in the WordPress community specifically because they automate malware scanning, monitor file changes, and alert you to suspicious login attempts in real time. If you don’t already have one of these installed, adding one is one of the fastest ways to get ongoing visibility into your site’s health instead of only finding out about a problem after a customer or Google tells you.

That said, a scanning plugin is only as good as its ability to actually catch what’s on your site, and no single tool catches everything. If a scan comes back clean but you’re still seeing symptoms (strange redirects, ranking drops, or reports from customers), it’s worth getting a second opinion from your web developer or hosting support team rather than assuming the scanner is infallible.

What to Do If You Confirm a Compromise

Finding out your site has been hacked is stressful, but the response doesn’t have to be complicated. Start by changing every password associated with the site: your WordPress admin accounts, your hosting account, your FTP credentials, and your database password if you have direct access to it. Attackers who gained access once often leave themselves a way back in, and rotating credentials closes that door.

Next, remove any admin users, plugins, or files you didn’t recognize during your check. If you have a recent clean backup from before the compromise, restoring from it is often faster and safer than trying to manually clean an infected site line by line. If you don’t have a backup, or you’re not confident identifying every piece of injected code, this is a good moment to bring in a developer who works with WordPress security regularly rather than risking a partial cleanup that leaves a backdoor in place.

Once the site is clean, request a review through Google Search Console if your site was flagged there. Google needs to re-crawl and confirm the issue is resolved before it will remove any security warnings shown to searchers, and that process can take a few days.

Preventing the Next Compromise

The single biggest thing you can do is keep WordPress core, your theme, and every plugin updated. Most compromises exploit a known vulnerability that already has a patch available; the site just hadn’t installed it yet. Set a recurring reminder if your host doesn’t handle updates automatically, and remove any plugins you’re not actively using. Every inactive plugin is still a potential vulnerability sitting on your server even if you never touch it.

It’s also worth applying the same skepticism to plugins that we’ve written about applying to AI tools: before you install anything new on your site, ask what happens if that tool has a problem, gets abandoned by its developer, or turns out to have a security flaw. That’s the same question we raise in our piece on vetting AI tools before you depend on them, and it applies just as directly to the plugins running your website. Fewer, better-maintained plugins from reputable developers will always be safer than a long list of tools you added once and forgot about.

Finally, build a security check into your regular routine rather than treating it as a one-time fire drill. The same weekly habit that catches traffic drops and broken forms will also catch most of the warning signs of a compromise long before it turns into a full-blown crisis.

The Bottom Line

A compromised WordPress site rarely announces itself with a dramatic warning. It shows up as a strange admin account, a plugin you don’t remember, a ranking drop you can’t explain, or a customer mentioning that your website did something odd on their phone. Checking your users list, your plugins, Google Search Console, and your robots.txt file takes less than fifteen minutes and can save you weeks of cleanup, lost rankings, and lost trust with customers who land on a hacked page.

If you’ve gone through this checklist and something still doesn’t sit right, or if you’d rather have someone else keep an eye on it so you don’t have to think about it, Lemon Head Design has been managing and securing WordPress sites for Utah businesses, credit unions, and home service contractors since 2007. Reach out to us and we’ll run a full check on your site, clean up anything we find, and help you set up ongoing monitoring so this doesn’t become a monthly worry.