Is Your WordPress Site Hacked? How to Check and What to Do

Key takeaways

• No single sign proves a hack. A slow site, a strange page or a plugin warning can have an ordinary cause, so check before you panic.
• Start with the free checks. Google Search Console has a Security issues report, and most hosts can run a malware scan for you.
• Keep a copy before you change anything. WordPress.org advises writing down what you see and taking a backup of the site as it is now, even if it is infected.
• Passwords come twice. Change them early to lock things down, and again once the site is clean. Do it from a device you trust.
• Update everything afterwards. That means WordPress, plugins, themes and the PHP version your host runs.
• Know when to stop. If the problem keeps coming back or you are not comfortable in files and databases, hand it to a professional.

What this page can and cannot tell you

This is a general guide. It cannot tell you that your site is hacked or that it is safe. Only a proper check of your own site can do that.

The topic is in the news because of the PHP security fix of 21 October 2026. We have not confirmed any attacks. The short version is in our post on the PHP vulnerability of October 2026. The NCSC says that if a PHP system cannot be updated at once, you should check it for signs of compromise and backdoors. This guide shows what that looks like for a WordPress owner.

Signs that suggest a problem

WordPress.org lists signs that its own helpers treat as indicators of compromise. Sucuri, a security vendor, adds a few more. Put together, these are the common ones.

WordPress.org says "hack" is a vague word, so write down the exact symptoms. That helps whoever helps you later.

How to check, in order

Work from the easiest check to the more technical ones. Stop and ask for help at any step.

1. Google Search Console

If your site is added to Google Search Console, open the Security issues report. Google's help page says it lists hacked content, malware and unwanted software, and social engineering pages, shown as errors or warnings. A green tick means Google has found nothing. A clean report does not prove the site is clean.

2. Your host's malware scan

Many hosts include a scanner in the control panel or can run one if you ask. WordPress.org also tells owners to check with the host, because on shared hosting the problem may reach beyond your own site. The host can also tell you if what you see is a real attack or just a loss of service.

3. An outside scanner and a plugin scanner

WordPress.org suggests using both kinds, an outside scanner that looks at your site from the web and a plugin that looks inside it, because each sees different things. It names Sucuri SiteCheck and VirusTotal as outside tools and Wordfence and Sucuri among the plugins. No one tool catches everything, so treat a clean result as one piece of evidence.

4. WordPress core file check

If you or your developer can use the command line, WP-CLI has a command, wp core verify-checksums. It compares the WordPress files on your site with the official checksums from WordPress.org and lists any that differ. A mismatch is a reason to look closer. It only covers core files, not your theme or plugins.

5. Users, plugins and recently changed files

In the WordPress dashboard, open Users and look for administrators you do not know. Open Plugins and look for anything you did not install. Sucuri also advises looking at recently modified files, especially new files in the uploads folder. WordPress.org points to the .htaccess file and to theme files such as index.php, header.php, footer.php and functions.php as common targets.

What to do first

Here is the order that WordPress.org and Sucuri describe, in plain words.

1. Stay calm and write things down. Note what you see, the time and time zone, and anything you changed recently, such as a new plugin.
2. Take a backup copy of the site as it is. WordPress.org says to do this even if the site is infected, so you have something to refer to if the cleanup goes wrong. Sucuri says to back up files and database before you change anything.
3. Contact your host. They can check the server, tell you if other sites on the account are affected, and sometimes restore a clean copy.
4. Scan your own computer. WordPress.org notes that attacks often start on a local machine that steals logins. Run a full scan, and try a second tool if the first finds nothing.
5. Change passwords from a clean device. Cover WordPress admins, hosting, FTP or SFTP, and the database. WordPress.org also says to replace the secret keys in wp-config.php, which logs out anyone still signed in.
6. Restore from a clean backup, or clean the files. Restoring a copy from before the problem is often the quickest fix, if you are sure it is clean. Sucuri advises replacing WordPress core files with fresh copies from WordPress.org and reinstalling plugins and themes from official sources.
7. Update everything. WordPress, plugins, themes, and the PHP version on your hosting. Our guide to checking and updating PHP on WordPress shows where to look.
8. Change the passwords again. WordPress.org says to repeat this once the site is confirmed clean.
9. Ask Google for a review if you were flagged. Fix every listed problem first. Google says a review request sent too early can slow down later ones.

Keep the infected copy until the site is stable. It may show how the attacker got in.

What not to do

• Do not restore an old backup blindly. A backup taken after the problem began can bring it straight back.
• Do not delete the evidence early. Keep the backup copy until you understand what happened.
• Do not log in to your admin screens from a computer you do not trust.
• Do not tell customers they are definitely affected, or definitely safe, until you know. Say what you have checked and what you are doing next.

When to bring in a professional

Sucuri says to get expert help if you are not comfortable editing PHP or database tables, if the infection keeps returning, or if your host has suspended the site. The NCSC says that if you are not confident checking for compromise, you can use an incident response provider. If you handle customer data or take payments, add one more reason: you may have legal duties to report a breach, and a professional can help you work out what applies. That is general information, not legal advice.

After the clean up

Cleaning is only half the job. The other half is finding how the attacker got in. WordPress.org says this is hard for owners without logs or skills, so ask the host or a developer. Then reduce the chance of a repeat:

• Keep PHP, WordPress, plugins and themes current. Use our list of questions for your web host and see who patches PHP on managed and shared hosting.
• Remove plugins and themes you do not use.
• Use strong, unique passwords and two-factor sign-in for admins.
• Keep scheduled backups stored away from the site.

Our guide to website maintenance costs compares what updates and monitoring involve.

How we help

If you want a second pair of eyes, we can talk through the signs you have seen and tell you honestly whether a cleanup needs a specialist. We build WordPress sites, and for owners who would rather not manage updates at all, Webflow maintenance and Webflow migration are options. Domain, hosting and analytics accounts stay registered to you on every project.

Frequently asked questions

How do I know if my WordPress site is hacked?

No single sign proves it. Look for a Google warning, new admin users you did not add, content you did not publish, odd redirects, or a host notice, then run a scan and check Search Console. If several signs appear together, treat it as likely and follow the steps above.

Can I check my WordPress files without a plugin?

Yes, if you or a developer can use WP-CLI. The command wp core verify-checksums compares your core files with the official ones from WordPress.org. It does not check themes, plugins or your uploads, so it is one check among several.

Should I take my site offline?

It depends. The NCSC says to consider taking a PHP system offline if it cannot be updated, and WordPress.org says a host may disable a site itself. If visitors could be harmed, such as through malware or stolen card details, going offline while you clean up is a sensible call. Ask your host.

Does the October 2026 PHP flaw mean my site is hacked?

No. It means PHP versions below the safe build for your PHP branch should be updated. We have not independently confirmed attacks on any site, and a missing update does not mean you were compromised. Check the version and read our main post.

How do I get Google to remove the warning?

Fix every issue the Security issues report lists, test the fixes, then use Request Review in Search Console and describe what you did. Google says reviews usually take days to weeks and that asking too early can slow later requests.

Do I need a professional?

If you are not comfortable with files and databases, if the problem returns, or if your host suspended the site, yes. Sucuri and the NCSC both say so in their own words. For a small site with a clear cause, a clean backup and a round of updates may be enough.