8 signs that your site may have malware or has been hacked

If you’re unsure whether your site has been compromised, start here. If you answer yes to any of the questions below, it’s best to treat your site as if it is compromised until you feel certain that your site is secure.

1. Are visitors being redirected to unfamiliar or spammy websites?
2. Is Google showing a “This site may be hacked” warning for your site?
3. Do you see admin users in WordPress that you didn’t create?
4. Have you found unfamiliar PHP files or recently modified core files you or your host didn’t change?
5. Is your site sending spam emails or showing spammy content you didn’t add?
6. Has your site become noticeably slower or is it crashing unexpectedly?
7. Is your login/password no longer working?
8. Has a security scanner (like Wordfence) flagged malware or modified files?

Next steps if your site is compromised

The longer a compromised site remains infected, the greater the risk of data loss, SEO penalties, or further spread. You want to act quickly. If you are comfortable working with files, databases and command line tools, choose option 1. Otherwise, we recommend option 2.

⚠️ Avoid:

• Restoring from old backups without checking if they’re clean
• Installing multiple security plugins at once
• Ignoring database infections

1. Clean the site yourself using Wordfence’s cleaning guide:

How to Clean a Hacked WordPress Site Using Wordfence
Additionally, review the scan results documentation: Understanding Scan Results

After cleaning, harden the site using a defense-in-depth approach included with these resources:

• 20 Minutes to Secure WordPress
• 10 WordPress Security Mistakes You Might Be Making
• Three WordPress Security Mistakes You Didn’t Realize You Made
• WordPress Backups
• Wordfence Learning Center
• WordPress Security Essentials Course by Wordfence

2. Get expert help

If you’re unsure how to safely clean your site, or want to be confident the issue is fully resolved, let the Wordfence team handle the cleanup for you.

Wordfence Care and Response include:

• Full malware removal and cleanup
• Investigation of how the site was compromised (not just surface fixes)
• Removal from blocklists (e.g., Google warnings)
• Post-cleanup hardening to prevent reinfection

Response includes 24/7 coverage with a 1-hour response time for urgent incidents.

Purchase or upgrade from your Licenses page, then select Get Help → Security Incident Assistance.

For more details on Care vs. Response, see: Wordfence Pricing

What the Wordfence plugin will (and won’t) do

The Wordfence plugin helps clean infections, but it does not fully restore a compromised site. It can help clean much of the malicious code from a hacked WordPress site, identify changed files, and assist with repairing or deleting infected files. It is a strong tool for detection and cleanup support, but it is not a complete or automatic restoration solution once a site has already been compromised. Installing Wordfence after a hack is like finding an intruder in your house and adding security measures after they’re already inside. It can help you regain control and limit further damage, but it won’t undo everything the intruder may have already done.

If your site is already hacked, the Wordfence plugin can help by:

• Scanning for malware, backdoors, malicious URLs, and other signs of compromise.
• Comparing core, plugin, and theme files against original versions to spot unauthorized changes.
• Helping repair or remove infected files and supporting rescans during cleanup.

Some issues may require additional work outside of Wordfence, including:

• Spam, including carding attacks and spam orders. Note that Wordfence does not offer features to prevent spam orders due to the possibility of blocking legitimate orders or traffic. We recommend using reCAPTCHA (with WooCommerce integration if applicable) to prevent spam users from registering.
• Malicious content stored in the database.
• Hidden backdoors, phishing files, or malicious scripts that require manual investigation.
• Infected old backups or abandoned WordPress installs on the same hosting account.

The Wordfence plugin can detect and repair much of a compromised site, but it’s up to you to keep your site secure. Regular maintenance, strong passwords, and ongoing hardening are what will keep you safe long-term.

Understanding how a site can get “hacked”

Even a well-maintained site can be compromised. Common entry points include:

• Weak passwords on your hosting control panel, FTP account, database, or WordPress admin
• A vulnerable plugin or theme, including nulled/pirated software with malware pre-installed. (Nulled/pirated software refers to premium applications, themes, or plugins that have been illegally modified to remove license checks, allowing free, unauthorized access. They are often distributed by third-party websites offering free or discounted, “premium” functionality while frequently containing hidden malware, backdoors, or malicious scripts)
• A readable wp-config.php or wp-config backup file, such as wp-config.php.bak accessible via a vulnerability or another compromised site on the same server
• Cross-infection from another user’s account or PHP application in the same shared hosting account where user accounts and applications are not properly isolated (e.g., a second WordPress site, Joomla, or Drupal)
• Publicly accessible, unarchived site backups containing exploitable vulnerabilities
• Unmaintained third-party scripts like Adminer or SearchReplaceDB in your hosting account
• Server-level vulnerabilities, e.g., end-of-life (no longer supported or updated) PHP versions with unpatched exploits

Note: part of the infection may be in a database table that Wordfence doesn’t scan, which would require manual database cleaning.

Check out our WordPress Security Tips playlist on YouTube to learn more about common attack vectors.

Common issues after a hack

Can’t log in to WordPress after a hack?

If you changed all your passwords after a security incident and are now locked out, try the “Lost your password?” link on your WordPress login page (/wp-login.php). If the admin email was also changed, contact your hosting provider — they can help you regain database access or reset admin credentials.

After Cleanup: Secure Your Site

Cleaning your site is only part of the process. Without proper hardening at both the site and server level, reinfection is common. Focus on reducing the “blast radius” — limiting how much damage an attacker can do if they regain access.

Key steps:

• Update WordPress core, plugins, and themes
• Remove unused plugins, themes, and old installs
• Reset and strengthen all passwords (WordPress, hosting, FTP, database)
• Do not reuse passwords
• Enable 2FA for all admin users
• Ensure regular, tested backups are in place
• Review user accounts and remove anything unfamiliar
• Isolate sites to their own file systems that don’t have access to each other

Ongoing maintenance and a defense-in-depth, layered security approach are essential to keeping your site protected long-term.