WordPress Hacked or Acting Strange? First Checks

Most WordPress compromises I hear about didn't happen because of anything exotic — they happened because a plugin or theme went unpatched for months, or because a password was reused somewhere else that leaked. That's actually useful to know, because it means the first checks are usually straightforward, even if cleaning up afterward takes patience.

I want to be upfront about scope: I'm a developer who can help with WordPress-level troubleshooting, basic compromise checks, backup restoration, and hardening — not a cybersecurity specialist, malware forensics analyst, or incident-response firm. For a straightforward case (an outdated plugin, an unwanted redirect, a spam injection), that may be enough depending on the cause. For a genuinely persistent reinfection, a compromised server at the hosting level, or anything with legal or compliance stakes, you need dedicated security specialists, and I'd tell you that directly rather than take on something outside what I actually do.

Signs something is wrong

The usual first signals: the site redirects to another domain unexpectedly, Google shows pages in search results that you never created (often spam or pharma content), there's a browser "deceptive site" warning, your host has emailed you about suspicious activity, or there's an admin user in your user list you don't recognize.

Don't make more changes yet

Before cleaning anything up, take a full backup of the site exactly as it is now — even in its compromised state. It sounds counterintuitive, but if something goes wrong during cleanup, or if you need a specialist to look at it later, having a snapshot of what happened is more useful than having already deleted the evidence. Note the approximate date things started looking wrong; that narrows down which backup (if you have older ones) is actually clean.

How sites usually get compromised

The common entry points, roughly in order of how often I see them mentioned:

• An outdated plugin or theme with a known, published vulnerability
• A weak or reused admin password (especially one used on other sites that have themselves been breached)
• Leaked FTP, hosting panel, or database credentials
• A nulled or pirated premium plugin/theme with malicious code baked in

Notice that none of these require a sophisticated attacker — they're mostly opportunistic, automated scans looking for known weaknesses.

Basic checks worth running

• Compare core files against a clean copy of the same WordPress version. Unexpected changes to core files (outside wp-content) are a strong signal.
• List every admin and editor-level user and confirm you recognize all of them.
• Review installed plugins for anything you didn't install, and for anything you recognize but haven't updated in a long time.
• Sort files by modification date and look for anything recently changed that you didn't touch — especially in wp-content/uploads, which normally only holds media, not PHP files.
• Check scheduled tasks (cron) for anything unfamiliar, since malware sometimes re-injects itself on a schedule.

If you have a clean backup

If a backup exists from before the site started acting up, restoring it is usually faster and more reliable than hand-cleaning an infected site file by file — provided you then close whatever door let the attacker in the first time, otherwise it happens again. A restore without fixing the entry point is a temporary fix, not a real one.

After cleanup: closing the door, not just mopping the floor

• Update WordPress core, every theme, and every plugin
• Remove anything unused — an inactive but outdated plugin is still a risk
• Force a password reset for every user account, not just the one that looks suspicious
• Rotate any API keys or secrets that might have been exposed
• Enable two-factor authentication for admin accounts
• Review file and database permissions so they're no more permissive than necessary

Where I can help, and where you need a specialist

I can help with initial triage — looking at what changed, checking users and plugins, restoring from a clean backup, applying updates, and basic hardening like the steps above. If what you're dealing with is a straightforward, single-site WordPress compromise, that may be enough to get back to normal — but if the investigation points to something deeper, I'll say so rather than guess.

If the investigation points to something deeper — the hosting account or server itself being compromised, malware that keeps coming back after cleanup, or a situation with legal or compliance requirements around a breach — that's genuinely outside what a WordPress developer should be handling alone, and I'd say so rather than guess.

FAQ

Related expertise

• Diagnosing a broken WordPress site
• WooCommerce checkout troubleshooting
• Self-hosted backups and infrastructure
• Freelance WordPress and Laravel services

If your WordPress site is showing signs of compromise, I can take a first look — checking core files, users, and plugins — and tell you honestly whether it looks like a WordPress-level fix or something that needs specialist attention. See my freelance developer page or get in touch.