"Has my WordPress site been hacked? 7 checks you can do in 10 minutes"
You look after the website, but you're not a developer. Maybe a customer mentioned a strange pop-up, Google is showing odd results for your organization, or you've just read that an old plugin on your site has a known security hole. Now you're wondering: has our site been hacked?
The tricky part is that most hacked sites look perfectly normal to the people who run them. Attackers usually want your site's reputation with Google, not your attention, so they hide their changes from you. Spam pages appear only in search results. Redirects happen only to phone visitors arriving from Google. When you log in, everything looks fine.
The good news: you can look for the signs yourself, from the outside, with free tools and no technical skills. Set aside 10 minutes and go through these seven checks.
1. Search Google for your own site
In Google, type site:yourdomain.com (with your real domain, no spaces) and look at the results.
What's normal: your own pages, with titles and descriptions you recognize, and a number of results roughly in line with how many pages your site has.
Warning signs:
- Pages you didn't create, especially about pills, casinos, loans, replica watches or adult content
- Results in Japanese, Chinese or another language your site doesn't use (a common attack known as the "Japanese keyword hack")
- Thousands of results for a site you know has a few dozen pages
Then try site:yourdomain.com casino OR viagra OR loan for a quick spam sweep. A clean site usually returns nothing.
2. Visit your site on a phone, from Google
Some hacks only show up for visitors who come from a Google search on a phone, because that's who the attackers want. On your phone, search Google for your organization's name, then tap your own result instead of typing the address.
Warning sign: you land somewhere else (a prize draw, a "your phone has a virus" page, an app store) or see pop-ups you didn't add. Try it a couple of times. Some redirects only happen on a first visit.
3. Check whether Google has flagged your site
Google keeps a list of dangerous websites and warns people before they visit them. Check yours at Google's Safe Browsing site status. Enter your domain and look at the result.
What's normal: "No unsafe content found."
Warning sign: anything else. A flag here means Chrome may already be showing visitors a red warning page instead of your site.
4. Run a free outside scan
Sucuri SiteCheck is a free scanner that loads your public pages and looks for known malware, spam and hidden code, and checks a few security blocklists. Enter your address and read the summary.
It can't see inside your site, only what visitors see, so a clean result isn't a guarantee. A warning is worth taking seriously, though.
5. Look at Google Search Console, if you have access
If your organization uses Google Search Console, open your site and look under Security & Manual actions → Security issues. If Google has detected hacked content, malware or deceptive pages, it says so here, often with example pages.
Don't have access? Ask whoever set up your website. It's free, and worth having for every site.
6. Check whether your email is being treated as spam
A hacked site is sometimes used to send spam, which can get your domain's email blocked. Signs include replies to your emails going missing, or people saying your messages land in their junk folder.
Enter your domain at MXToolbox's blacklist check. A listing on a major blocklist is worth raising with your host or IT person.
7. If you can log in: look for strangers
If you have admin access to WordPress, take two minutes in the dashboard:
- Users: any administrator accounts you don't recognize?
- Plugins: anything installed that nobody remembers adding?
- Pages and posts: anything recently published that your team didn't write?
Also check your inbox for warnings from your web host. Hosts often notice hacked sites first, because of unusual traffic or spam.
Found something? What to do next
Don't panic, and don't start deleting things. Hacked sites can almost always be cleaned up, and a calm, orderly response makes that easier.
- Tell whoever manages your site's hosting or development, today. Share what you found: screenshots of the search results, the redirect, or the scanner report.
- Change passwords for WordPress admin accounts, your hosting account and any email accounts linked to the site, and turn on two-factor sign-in where you can.
- Ask about backups. Restoring a clean backup from before the problem started is often the fastest fix. The weak spot that let attackers in still needs closing, or they'll be back.
- Update or remove the weak spot. Most WordPress hacks come through out-of-date plugins or themes, so they need updating, and anything unused should be removed.
- Tell Google once it's clean. If your site was flagged, your developer can ask Google to review it through Search Console, which removes the warnings.
Found nothing? Good, but stay alert
A clean result from these checks means there are no visible signs of a hack, which is great news. It doesn't guarantee the site is safe. Many sites are running software with known security holes that simply haven't been used against them yet. Checks from the outside can't see everything; a proper inspection of the server can.
The bigger question is why your site might be at risk in the first place. We explain how small business websites get hacked, and how to make yours safer, in Could your small business website be hacked?
A simpler way to stay safe
Most WordPress security problems come from plugins: in 2025, 91% of newly found WordPress vulnerabilities were in plugins, according to the security firm Patchstack. Keeping them all patched is a weekly chore that's easy to let slip.
A SiteFlo™ site is published as fast static pages, with no plugins to patch, no database to break into and no login page to attack. Your team updates it by sending a message in Slack. We move your existing WordPress content across and keep your search rankings.
Want a quick read on your site? Run a free SiteFlo Fit check. In about a minute it looks for outdated software, known security issues and missing protections, plus speed, accessibility and search visibility.