5 Signs Your WordPress Site Is Hacked (That You’ve Probably Missed)

When people imagine a hacked website, they picture something dramatic — a defaced homepage, a ransom note, obvious chaos. In reality, most WordPress compromises are quiet. They're designed to stay hidden, because a hack that gets noticed gets fixed. So attackers build ones that don't.

Here are five signs that tend to slip past business owners, based on patterns I see repeatedly in remediation work.

1. A traffic drop with no obvious explanation

If nothing about your content, ads, or marketing has changed but traffic is sliding, don't assume it's an algorithm shift. A common cause is Google detecting spam content on your domain and reducing its visibility — content the attacker planted, not you.

2. Pages in Google's index that you never created

Search your domain on Google using the "site:" operator. If unfamiliar pages show up — spam keywords, foreign-language content, product pages for things you don't sell — the site has almost certainly been compromised, even if it looks completely fine when you visit it directly.

3. Extra user accounts you don't recognize

Attackers often create a hidden admin or editor account as a backdoor. Even after a plugin update or password reset, this account lets them regain access. Checking your Users list periodically is one of the simplest habits that catches this early.

4. A noticeable slowdown with no clear cause

Malicious scripts consume server resources running in the background — sending spam emails, mining resources, or serving hidden content to search engines. If your site feels sluggish and nothing on your end has changed, it's worth investigating server-side activity.

5. Warnings from browsers, antivirus software, or hosting providers

By the time Chrome or your antivirus is flagging your own site, the compromise has usually been active for a while. This is often the first sign non-technical site owners actually notice — and by then, damage to trust and rankings has already begun.

Why this matters

None of these signs alone proves a hack. But WordPress sites rarely show all their symptoms at once — which is exactly why so many stay compromised for weeks or months without anyone noticing. The earlier one of these is caught, the smaller the cleanup, and the smaller the damage to search rankings and customer trust.

If you manage a WordPress site, it's worth spending ten minutes checking these five things today.