Signs your site was hacked
- Google shows “This site may be hacked” under your site in search results.
- Chrome shows a full-page red warning before your site opens.
- Visitors end up on a spam, casino or pill site. This often happens only on phones, or only when people come from Google, so you might not see it yourself.
- Pages you never made show up when you search Google for
site:yourbusiness.com, often in Japanese or selling something. - An admin user you don’t recognize appears in WordPress, under Users.
- Your hosting company emails you about malware, or switches your site off.
What to do right now
- Don’t delete the site.The evidence of how they got in is still there, and deleting it can lose your content for good.
- Change your passwords.Your hosting account first, then every WordPress admin user, then the email address those accounts use. Turn on two-step login at your host if it offers it.
- Tell your hosting company.Many will scan your site, and some will clean it or restore a backup from before the hack.
- Don’t stop at a backup.Restoring an older copy removes the damage, but the way in is usually still open. Update WordPress, plugins and themes straight after, or it can happen again within days.
- Tell Google once it’s clean.If you use Google Search Console, the Security issues report shows what Google found. After the cleanup, ask Google for a review there to remove the warnings.
Be careful with emails from strangers offering to “fix your hacked site,” or saying they hacked it and want money. Talk only to your host or someone you chose yourself.
How it usually happens
Most break-ins come through an out-of-date plugin or theme, not through WordPress itself. Once a weakness is made public, automated tools try it on thousands of sites a day. Keeping everything updated is the best protection there is.