The signs your WordPress site is hacked aren’t always a defaced homepage or an obvious warning page. Many of the most common infections are designed specifically to stay invisible to you, the owner, while doing damage somewhere you’re not looking. Here’s what to actually check.
Signs Your WordPress Site Is Hacked Even When It Looks Completely Normal
Signs your WordPress site is hacked can show up in places you wouldn’t normally check, rather than on the page itself. The eight items below are where we find most invisible infections during a routine audit.
✓
Google Search Console shows a security issue, but your homepage looks fine. Malware often targets specific pages or only shows malicious content to search engine crawlers, not regular visitors.
✓
Your search results show different text than your actual page. If a Google result for your site mentions products, pharmaceuticals, or topics you’ve never published, the site is very likely serving different content to Google than it shows you.
✓
A sudden spike in outbound email or a spam flag from your host. Compromised sites are commonly used to send spam email in bulk, which gets noticed by hosting providers before it gets noticed by you.
✓
An admin user you didn’t create. Check Users in your WordPress dashboard. A new administrator account is one of the clearest signs of unauthorised access, even if nothing else looks different.
✓
Unfamiliar files with recent modification dates. Check your uploads folder and plugin directories for files with names that don’t match anything you’ve installed, particularly ones modified more recently than your last update.
✓
Your host warns of “resource abuse” or suspends your account. Hosts monitor server resource usage, and a hacked site running malicious scripts often trips this before you notice anything visually wrong.
✓
Traffic to URLs that don’t exist on your site. Check your analytics for visits to pages you never created. This often means hidden spam pages have been injected and are being indexed without your knowledge.
✓
Visitors report an antivirus or browser warning that you can’t reproduce yourself. Some infections only trigger for certain visitors or only appear intermittently, which is exactly why they go unnoticed for so long.
Why Hacks Often Stay Invisible to the Site Owner
Many infections use a technique called cloaking, where the server detects whether a request is coming from a search engine crawler or a regular visitor, and serves different content accordingly. The attacker’s goal isn’t to deface your site. It’s to quietly use your domain’s reputation for SEO spam or malware distribution while you see nothing unusual.
During WordPress audits, we regularly find sites that have been compromised for months without the owner noticing a single thing, because the infection was specifically built to avoid drawing attention.
How to Check for Yourself
1
Check Google Search Console’s Security Issues report. This is the single fastest way to confirm whether Google has flagged anything on your site that you haven’t seen yourself.
2
Review your full list of WordPress admin users. Confirm every account belongs to someone who should have access.
3
Sort your file manager by modification date. Recently changed files you don’t recognise are worth investigating before anything else.
4
Run a malware scanner as a baseline. A scan won’t catch everything, particularly well-hidden backdoors, but it’s a useful first check before deciding whether to dig further.
What to Do If You Find Something
If any of the above turns something up, don’t start deleting files or changing things at random. The order you act in matters. Our guide on what to do if your WordPress site has been hacked covers exactly what to do first and what to avoid.
FAQs
Can a hacked WordPress site really show no visible signs at all?
Yes, and it’s more common than most owners expect. Cloaked malware, hidden spam pages, and quietly added admin accounts are all designed specifically to avoid detection by the site owner for as long as possible.
Will my security plugin catch all of these signs automatically?
It catches some, particularly known malware signatures, but not all. Manual checks like reviewing admin users and recent Search Console issues catch things many automated scanners miss.
How often should I check for these signs?
A monthly check takes a few minutes and catches most issues early. This is exactly the kind of check that’s normally built into a proper WordPress maintenance plan, rather than something to remember to do yourself.
I found a new admin user. What now?
Don’t just delete the account. Change all your passwords first, from a different device, then treat the site as compromised and follow the proper cleanup steps rather than assuming removing one account fixes everything.
Not Sure What You’re Looking At? Get a Second Opinion
If something on this list looks off, we’ll check it properly rather than guess. Request a security check, or book a free call if you want to talk through what you’re seeing first.
Related: My WordPress Site Has Been Hacked: What to Do Right Now · What Should a WordPress Maintenance Plan Include?
