Check if Your WordPress Site Is Hacked

To check if a WordPress site is hacked, run real scans from inside the install, then look for compromise signals you can verify. Start with free vulnerability checks, security tests, and core integrity. Add a malware scan when files look wrong or the site already shows redirects, spam, or lockouts.

This page is the short tool path. For the longer signs walkthrough, use how to tell if your WordPress site is hacked.

Start with free scans

You do not need a fake “paste your URL” checker on a marketing page. You need tools that see installed versions and files from wp-admin.

Install WP Security Ninja (free on WordPress.org, or start from pricing if you already know you want Pro). Then run these in order:

1. Vulnerability scanner
   Compares plugins, themes, and core against known vulnerabilities. Outdated software with a public advisory is how many hacks start.

2. Security tests
   Flags configuration gaps (file permissions, exposed bits, weak defaults). Failed tests are not always “you are hacked,” but they show what attackers look for next.

3. Core Scanner
   Checks WordPress core files against known-good copies. Modified, missing, or unexpected core files deserve a close look.

4. Events
   Review recent security-related activity in the free Events view so you notice odd logins or changes after the scans.

Free covers security tests, vulnerability scanning, core integrity, and events. Pro adds the malware scanner when you need on-disk suspicious-file review and schedules.

Run the free scans even if the homepage “looks fine” while you are logged in. Cloaked redirects and SEO spam often hide from admins. Scanner output plus a logged-out check beats guessing from the homepage alone.

Quick checklist of what to look for

Scans answer “does software or core look wrong?” Pair them with a fast human check:

• Open the site logged out in a private window (desktop and phone if you can)
• Search site:yourdomain.com for pages or titles you never published
• In Users, look for administrators you did not create
• Check Plugins for anything unknown
• Open Google Search Console → Security issues if you use it
• Note sudden redirects, spam ads, or browser malware warnings

Several signals together matter more than one odd glitch. Full detail, false positives, and the seven common signs live on signs your WordPress site is hacked.

If something looks wrong

Do not keep clicking random plugins while visitors hit malware. Work a recovery path:

1. Contain damage (maintenance mode, host help, pause outbound mail if you are spamming)
2. Prefer a clean backup from before the breach when you have one
3. Otherwise clean carefully: remove unknown admins, compare core, hunt malware and backdoors, then rotate passwords

Close the entry point before you celebrate. Updating a vulnerable plugin after a restore matters as much as deleting odd PHP. Leaving the same hole open is why malware “keeps coming back.”

Guides:

• WordPress malware removal
• What to do if your WordPress site is hacked
• Hire cleanup / consultation if you are locked out, the infection returns, or the site is revenue-critical

After cleanup: harden so it stays clean

A restore without hardening is a rewind button for the attacker. Clean first, then lock doors.

• Keep plugins, themes, and core updated; re-run the vulnerability scanner after big change weeks
• Put a Cloud Firewall in front of exploit-shaped traffic (Pro)
• Lock down wp-login with login protection and follow the WordPress login security guide
• Schedule malware and integrity checks so findings do not wait until you remember

Related reading

• How to tell if your WordPress site is hacked (7 signs)
• WordPress malware removal
• What to do if your site is hacked
• WordPress security scanner comparison
• Free vs premium security plugins

Bottom line: check with scans you control inside WordPress, confirm with the signs checklist, then clean and harden. Start free with Security Ninja, then add Pro malware scanning when file-level review is the job at hand.