Here's the uncomfortable truth about WordPress hacks: the average site owner discovers the infection weeks after it starts. Attackers don't want you to notice — a quiet hack keeps earning them traffic, spam links, and redirect revenue while your customers slowly stop trusting you.
These are the five signs I check first on every suspected site. If any of them look familiar, don't wait for it to get worse — every day costs you visitors you won't get back.
1Strange content you never wrote
The classic: your homepage — or worse, pages deep in your site — suddenly advertise casinos, pharmaceuticals, crypto schemes, or show text in a language you don't speak. Sometimes it's blatant. Often it's subtle: a few paragraphs injected at the bottom of legitimate pages, invisible unless you scroll.
What it's costing you: every visitor who sees it assumes your business is either dead or dangerous. Most never come back, and they don't tell you why.
2Google shows pages you never created
Search Google for site:yourwebsite.com. If the results include pages, products, or posts you never wrote — especially spammy ones — attackers have injected content specifically to hijack your search rankings.
What it's costing you: your hard-earned Google presence now works for criminals. And Google notices: enough injected spam triggers the "This site may be hacked" warning, which tanks click-through rates overnight.
3Visitors get redirected — but the site looks fine to you
This is the sneakiest one. The hack detects who's visiting: you (the owner, on desktop, direct visit) see the normal site. Everyone else — mobile users, Google visitors — gets bounced to scam pages. You can stare at your homepage all day and never see it.
What it's costing you: you're losing the exact customers who found you through search — the highest-intent traffic you have — while believing everything is fine.
4Admin users you don't recognize
Open Users → All Users in your WordPress dashboard. See any administrator accounts you didn't create — especially with odd usernames or unfamiliar email addresses? That's not a glitch. Attackers create their own admin accounts so they can walk back in whenever they like, even after a surface-level cleanup.
What it's costing you: as long as that account exists, you don't own your site — you're sharing it. Any cleanup that misses this step will fail within days.
5Sudden slowness, warnings, or host emails
A site that's mysteriously slower, emails from your host about "malware detected" or "resource abuse," browser warnings for your visitors, or a Search Console security alert — these are the alarm bells. By the time your host writes to you, the infection is usually well established.
What it's costing you: hosts suspend infected accounts to protect their network. Suspension means no site, no email, no orders — until it's verifiably clean.
Don't start deleting things at random — that often destroys the evidence needed for a proper cleanup. Run through the Hacked Website Checklist for the safe order of operations, or send me your URL and I'll check it personally, free.
What to do in the next hour
Confirm it with the checks above. Take a full backup of the site as-is. Change your passwords from a trusted device. Then either follow the first-24-hours playbook — or hand it to someone who does this daily. The one thing you shouldn't do is nothing: injected spam multiplies, Google's patience doesn't, and your customers are already noticing.