How to tell if your WordPress site has been hacked

Look the way a stranger does

A hacked site often behaves differently for its owner. Some hacks hide from anyone logged in to the admin, some only show to people arriving from Google, and some only show to Google itself. So before you look:

• Log out of the site, or use a private browser window.
• Use your phone on mobile data as well as your office computer.
• Search for your business on Google and tap the result, rather than typing your address.

Sign 1Hidden text on your own pages

Text a visitor can't see but a search engine reads, usually advertising casinos, loans or pills. It's put there to borrow your site's standing in Google.

To look for it, open the page's source: Ctrl+U in Chrome on Windows, or Option+Cmd+U on a Mac. Search it with Ctrl+F or Cmd+F for words like casino, betting, viagra or loan. Spam words that are in the source but nowhere on the page you see were almost certainly hidden on purpose.

Sign 2Links you didn't add

Links to sites that have nothing to do with you, often betting, pharmacy or loan sites, slipped into the footer or the page's code. Some are in plain sight and some are hidden. Look along your footer, sidebar and menus first, then search the source for the spam words above and see where any link near them goes. A link to a stranger's site, sitting among your own services, is a strong sign.

Sign 3Pages you never published

Whole pages on your domain that you didn't make, often in another language or selling something you don't sell. Check every page and post in the admin, newest first. WordPress also lists its published pages for anyone at yourdomain.co.uk/wp-json/wp/v2/pages, and that list sometimes shows a page your menus never link to.

Some spam pages never appear in the admin at all, because they are made by code dropped on the server, or shown only to Google. The site: search below is how you find those.

Sign 4Admin usernames on show

Type yourdomain.co.uk/wp-json/wp/v2/users into a browser. If it shows a list, look at each “slug”: on many sites it's the name that person logs in with. yourdomain.co.uk/?author=1 can give the same name away in the address it sends you to.

On its own this isn't proof of a break-in. It hands anyone guessing passwords half of what they need, and it's one of the places automated attacks look. A developer or a security plugin can close both.

Sign 5Spam shown only to Google

Some hacks show normal pages to people and spam to Google's crawler. Your site looks fine to you, but Google's results under your name show casino or pill titles, and Google may add “This site may be hacked” under your listing.

Search Console shows you the page the way Google's crawler gets it. Open the URL Inspection tool, put in your home page, test the live page and view what was fetched. Spam words in that copy that aren't on your screen mean the site is showing Google something else.

Sign 6Odd redirects

Visitors are sent to another site, often only when they arrive from Google or on a phone, so typing your own address shows nothing wrong. Test it the way a customer would: on your phone, on mobile data, search for your business and tap your own result. Ask a friend to try too. If you land anywhere but your own site, it has been tampered with.

Signs you'll hear about from someone else

Sometimes the first sign comes from outside. Take any of these seriously, even if the site looks fine to you:

• A customer says your site sent them somewhere strange, or showed them something odd.
• A browser shows a red warning page instead of your site.
• Google writes to you through Search Console about a security issue.
• Your hosting company writes to you about malware, or suspends the site.
• Email from your domain starts bouncing, which can mean the site is being used to send spam.

The site: search trick

Type site:yourdomain.co.uk into Google, with your own domain and no space after the colon. Google lists the pages it holds for your domain. Read the titles: anything you didn't write, anything in a language you don't use, and anything selling something you don't sell needs a closer look.

Then narrow it down by adding a word spam uses:

site:yourdomain.co.uk casino
site:yourdomain.co.uk viagra
site:yourdomain.co.uk loan

It isn't a complete list of what Google holds, but it's the quickest look you can get, and it costs nothing.

If you find something

Don't start deleting. Our guide to the first hour after a hack says what to do, in order, so the damage stays small and the evidence stays intact.

Or let us look. The free check reads only what any visitor and a search engine can see, including the public lists on this page, and shows you the proof in seconds, each finding with the place on your own site where we found it.