The image of the hacked website with a skull on the screen is cinema. In reality, an attacker who manages to enter your WordPress wants just the opposite: that you don't find out.
The longer it goes undetected, the more spam it places, the more mail it sends from your server, and the more data it collects. That's why real hacks are discreet, and many businesses discover them weeks later, when the damage has already been done.
These are the signs that do appear, ordered from most to least obvious.
1. Google tells you before anyone else
The fastest and most reliable verification. Search this on Google, with your domain:
It will show you everything that Google has indexed about your website. Check the results: if pages appear that you did not create, especially with topics that have nothing to do with your business or in strange languages, you have injected content.
It is the most common symptom of the most common hack: using your domain, which has a reputation, to position spam.
If you have Search Console configured, log in and look at the security section. Google notifies there when it detects malicious software.
2. Administrator users you don't recognize
Go to Users on your desktop and review the full list, filtering by administrators.
If there is one that you have not created, the website is compromised. Creating your own user is one of the first things an attacker does to be able to return even if you close the original door.
Also look for users with names that imitate legitimate ones (admin1, wpadmin, support) and registration dates.
3. Different behavior depending on who enters
This is the most insidious, and explains why so many people are slow to realize it.
Many malware is programmed not to show itself to the administrator. You enter your website and everything is perfect. But a visitor who comes from Google, or from a mobile phone, is redirected to another page.
How to check it:
- Open your website in an incognito window, with the session closed
- Try it from your mobile, with mobile data instead of Wi-Fi
- Reach your website from a Google result, not by typing the address
If something strange happens in any of those cases, there it is.
4. Recently modified files
If you have access via FTP or the hosting file manager, sort by modification date.
WordPress core files should only change when you upgrade. If you see kernel files modified on a date when you didn't touch anything, that's a bad sign.
Pay special attention to index.php, wp-config.php, .htaccess and files with strange names in uploads folders (there should never be PHP files there).
5. Rare peaks in consumption
Look at your hosting statistics. A spike in traffic or CPU usage that doesn't correspond to any campaign could mean that your server is sending spam or participating in attacks on other websites.
Related signal: your hosting provider warns you of abnormal consumption, or your emails start bouncing because your domain has been blacklisted.
6. The website is suddenly slow
By itself it means nothing (there are a thousand causes of slowness), but combined with any other signal on this list, it gains weight. Malicious code consumes resources.
What to do if you detect something
In order, and this matters:
1. Don't delete anything yet
The impulse is to clean quickly. Resist it. The modified files and logs are the only clue to where they got in. If you clean without finding out, they will come back in through the same place in a few days.
2. Make a copy of the current state
Yes, a copy of the infected website. It serves as evidence and to analyze. Keep it separate, well identified, and do not restore it by mistake.
3. Change all passwords
All: WordPress users, database, FTP, hosting panel and email. If the attacker has credentials, wiping is of no use.
4. Seek help if the case is serious
Cleaning an infected WordPress done right is not deleting a file: it is finding all the backdoors, checking the database and closing the way in. If there is customer data involved, there are also legal obligations with specific deadlines.
5. Request review from Google
Once clean, request a review from Search Console to remove the dangerous site warning. It may take days.
The two minute check
If you've made it this far, do this right now:
- Search site:yourdomain.com on Google and review the results
- Go to Users and check the list of administrators
- Open your website incognito from your mobile
With those three you detect the vast majority of common infections.
And if you prefer to let this take care of itself, it's part of what we do at the WordPress maintenance: Continuous monitoring and periodic review, to detect it in hours instead of weeks. Because in this, the time that goes unnoticed is exactly what determines how expensive it is.
Would you prefer us to review it? Take a look at our WordPress maintenance service either tell us what your website needs and we will respond to you in less than 24 hours.