How to Know If Your WordPress Site Has Been Hacked

What I Found on My Own Site This Week (Real Example)

This isn't hypothetical. While doing a routine technical audit on this exact website, I found a backdoor sitting in wp-content/mu-plugins/ — the "must-use plugins" folder, which WordPress loads automatically on every single request with no way to disable it from the admin screen. That's exactly why it's the location a serious attacker picks.

Here's what made it dangerous, and why "just install a security plugin" isn't the whole story:

• It disguised itself as a real plugin. A convincing plugin header — "Streamlined caching and optimization layer," a plausible author name, a version number — sitting on top of heavily obfuscated code: scrambled variable names, an encoded string array, and a custom decoder function. Nothing about it looked suspicious on a casual scroll through the file list.
• It could silently control other plugins. The code directly rewrote WordPress's active_plugins database option via raw SQL — meaning it could activate or deactivate any plugin on the site, including a security plugin, without ever touching the admin UI where you'd notice.
• It injected content into page output. A function decoded and echo'd a JavaScript payload directly into the page — the classic mechanism behind malicious redirects, injected spam links, or (in this case, once fully decoded) a cryptocurrency wallet-draining script, complete with a list of attacker-controlled wallet addresses and nearly twenty different blockchain RPC endpoints to broadcast transactions through.
• It was reading attacker-supplied input. It pulled data from $_REQUEST, meaning it wasn't a one-time infection — it was a remote-control channel, waiting for further instructions.

None of this showed up as a red flag in the WordPress admin dashboard. What actually surfaced it: Google Search Console's Page Indexing report started showing thousands of garbage, random-character URLs being crawled and 404ing — /VY|^@e4|, /HwG, and similar. That pattern — a sudden spike in nonsensical crawled URLs — is one of the more reliable outside signals that something is actively injecting content, even when everything looks normal from inside wp-admin.

The fix took under an hour once found: the file was removed, credentials were rotated (WordPress admin, hosting panel, database, and the site's wp-config.php secret keys), and a full malware/file-integrity sweep confirmed nothing else was planted. The point of including this here isn't the specific incident — it's that this exact pattern (disguised mu-plugin, database manipulation, injected script) is a real, current technique, not a theoretical warning-sign list copied from somewhere else.

15 Warning Signs Your WordPress Site Has Been Hacked

Hackers leave traces. These warning signs should prompt immediate investigation:

How to Verify Your Site Is Actually Compromised

Suspicion isn't confirmation. Follow these steps to verify compromise:

1Check Google Search Console

Log in to Google Search Console and look for:

• Manual actions (spam, malware warnings)
• Security issues reported by Google
• Unexpected crawl errors

Google is often the first to detect compromised sites through user reports and automated scanning.

2Scan with Free Online Tools

Use these free external scanners:

• Google Safe Browsing: https://transparencyreport.google.com/safe-browsing
• URLhaus: Check if your URL appears in malware databases
• Norton Safe Web: https://safeweb.norton.com
• Sucuri SiteCheck: Free malware scanner (https://sitecheck.sucuri.net)

3Review File Integrity

Check your WordPress installation files:

• Compare your current files against the official wordpress.org releases
• Look for unexpected PHP files in the root directory or /wp-content/
• Use FTP or SFTP to browse your server directly
• Check file modification dates—recent changes indicate intrusion

If you have SSH access and WP-CLI installed, these two commands do most of this automatically:

# Verify core files match the official WordPress release exactly
wp core verify-checksums

# List every file in mu-plugins/ (loads on every request, never shown as "inactive")
# and check for anything you didn't put there yourself
ls -la wp-content/mu-plugins/

# Find every PHP file that claims to be a plugin, and check the ones you don't recognize
grep -rl "Plugin Name:" wp-content/plugins wp-content/mu-plugins --include="*.php"

4Inspect WordPress Database

Log in to phpMyAdmin (via your hosting control panel):

• Review wp_users table for unfamiliar admin accounts
• Check wp_posts for posts/pages you didn't create
• Look for suspicious options in wp_options (check for encoded or base64 strings)

With WP-CLI, check the actual list of active plugins directly from the database rather than trusting the admin screen (malware can rewrite this option without the UI reflecting it):

wp option get active_plugins --format=json
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

5Examine Server Logs

Access your access.log and error.log via hosting control panel:

• Look for requests to suspicious files (shell.php, wp-admin-login.php, etc.)
• Check for unusual POST requests or directory scanning attempts
• Verify if errors correspond to break-in attempts

Automated Scanning Tools

Manual checks catch a lot, but automated scanning catches things a quick look won't — obfuscated code patterns, known-vulnerable plugin versions, and file changes you'd never notice by eye. I built WP Scan for exactly this reason: it checks themes, plugins, and raw PHP files for malware patterns, risky code, and known vulnerabilities, and the premium tier gives exact line numbers and fix guidance instead of just a pass/fail.

It's one option among several reasonable ones — Sucuri SiteCheck and Wordfence both do similar scanning, and any of the three beats no scanning at all. What actually matters is picking one and running it on a schedule, not which specific tool.

Immediate Steps If You Find a Hack

Time is critical. A hacked WordPress site can spread malware to visitors and destroy your reputation in hours. Follow this checklist:

1Isolate the Compromised Site

• Consider taking your site offline temporarily while investigating
• Change all passwords (WordPress admin, FTP, hosting, database) from a clean computer
• Revoke all SSH keys and API tokens

2Contact Your Hosting Provider

• Alert them immediately of the compromise
• Request server logs and help identifying entry points
• Ask if they can isolate your account

3Backup & Preserve Evidence

• Download a full backup of your site (don't restore it yet—it contains the malware)
• Keep server logs and database records for forensics
• Document all changes you notice for your security investigation

4Remove the Malware

You have three options:

• Manual Cleanup: Delete suspicious files, remove backdoor accounts, clean the database (advanced—high risk)
• Automated Cleanup: Use plugins like Wordfence Security or Sucuri (easier but not always complete)
• Professional Remediation: Hire a WordPress security specialist ($500-$2,000 but thorough and reliable)

5Reinstall WordPress Core

• Download the latest WordPress version from wordpress.org
• Replace all core files (wp-admin, wp-includes, root PHP files) via FTP
• Keep your wp-content/ and wp-config.php (unless they're known to be compromised)

6Audit & Update Everything

• Update all plugins to the latest versions
• Update all themes to the latest versions
• Delete unused plugins and themes
• Review user accounts—delete unfamiliar ones

7Rescan & Verify

• Run a full scan again (WP Scan, Sucuri SiteCheck, or your tool of choice) to confirm the malware is actually gone, not just hidden
• Re-run wp core verify-checksums to confirm core files are clean
• Check Google Search Console for blacklist status

8Request Google Delisting

• In Google Search Console, request a review if your site was flagged as compromised
• Google will re-crawl your site and lift the warning once clean
• This process typically takes 24-72 hours

Prevention: Stop Hacks Before They Happen

The best hack is the one that never happens. Implement these preventive measures:

Keep Everything Updated

• WordPress core, plugins, and themes—update the moment new versions release
• Enable automatic updates in WordPress settings
• Set up a schedule to review and update third-party libraries

Use Strong Security Practices

• Unique passwords: Use a password manager (1Password, LastPass, Bitwarden)
• Two-factor authentication: Enable 2FA on all admin accounts
• Limit login attempts: Install a plugin to prevent brute-force attacks
• Change default usernames: Never use "admin" as your username

Remove Unnecessary Code

• Uninstall plugins you don't use—each is a potential entry point
• Delete inactive themes (keep only one active theme)
• Disable file editing: Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php

Install Security Monitoring

• Wordfence Security: File integrity monitoring, login auditing, malware scanning
• Sucuri Security: Malware detection and cleanup
• iThemes Security: Brute-force protection, vulnerability scanning
• WP-Scan.org API Integration: Continuous vulnerability scanning via WP-Scan.org's API

Harden Your Server

• Use SFTP instead of FTP (FTP sends passwords in plain text)
• Change your database prefix from wp_ to something random
• Move wp-config.php one directory above the root (if your hosting allows)
• Restrict access to wp-admin by IP address
• Use an SSL certificate (HTTPS)—standard for all sites now

Schedule Regular Backups

• Daily automated backups to cloud storage (AWS S3, Google Drive, Dropbox)
• Store backups separately from your hosting account
• Test restore procedures monthly to ensure backups are valid

Frequently Asked Questions

Author: Rajan Gupta, Freelance WordPress Developer | Related tool: WP Scan