What signs suggest your WordPress website has been hacked?
Unusual behaviour, unfamiliar page elements or security warnings are good reasons to consider whether someone has made unauthorised changes to your website. One symptom alone does not prove a hack: a broken redirect, for instance, may have another cause. The aim is to record the signs and investigate professionally, not delete things in a rush.
↗ · Redirects to an unknown website
Visitors are taken elsewhere or to a suspicious offer. Redirects can also result from configuration errors; the cause needs checking.
🔑 · Unfamiliar access appears
An unknown administrator account or unexpected password change appears. This calls for an access-rights investigation.
⌕ · Unknown pages appear in search
You find addresses under your own domain that you did not create. Investigate the site's content and permissions as well as search visibility.
⚠ · Browser or Google shows a warning
Visitors may see the site as dangerous or deceptive. Protecting visitors and investigating the affected system is especially important.
Together, these signs may strengthen the suspicion, but the true cause should only be stated after a targeted investigation. If a function simply broke after an update, the guide to update-related errors may be more relevant.
Why is this important for a business?
A compromised website can disrupt more than operations. Visitors may lose trust, see incorrect content or be redirected to suspicious pages. If your site handles customer details, form submissions or order information, it is especially important to assess which functions and systems could be affected.
Not every unusual sign automatically means data theft or total website loss. However, uncertainty is no reason to leave suspicious behaviour unchanged for days. Arrange the necessary professional assessment promptly while preserving the current state.
First rule: don't send website administrator passwords, hosting access or confidential customer data through a public form. For an initial discussion, the domain and a description of the symptoms are enough.
The first three safe steps if you suspect a compromise
- 01 · Record the signs. Take screenshots of the warning or unusual page and record the exact URL and time. Don't delete files, logs or accounts blindly; they may later help explain what happened.
- 02 · Limit further risk with appropriate assistance. You may need to notify your host, review access from a secure device and temporarily protect visitors. The order of actions depends on what is affected.
- 03 · Investigate and verify recovery. Removing a visible symptom is not enough. The entry point, permissions, restored functions and further prevention also need investigating.
This is not a do-it-yourself malware removal guide. As a business owner, your first responsibility is to recognise the risk, preserve important information and request suitable professional help.
Seeing suspicious WordPress behaviour?
Don't let another redirect be how you discover the problem remains
Kaluzsa's WordPress repair service also covers reviewing suspicious redirects, unknown URLs and underlying issues. Choose the next action based on the actual condition, rather than promising a guaranteed clean-up without inspecting the site.
Five mistakes that can make recovery harder
01 · Deleting things blindly
Carelessly removing files, databases or logs can destroy evidence or working data.
02 · Restoring an unchecked backup
An older backup may itself contain defects or infected components; it must be checked separately.
03 · Sending passwords around
Sharing credentials through ordinary email or public forms can create further risks.
04 · Relying on a single plugin
A security tool can help, but a green tick alone doesn't prove the website and all access permissions are clean.
05 · Removing only the visible symptom
If the cause of unauthorised access remains, the problem may return. Recovery must include root-cause analysis.
What happens during a professional investigation?
First establish which website is affected, what symptoms occur and what access is available. Then safely document the state and backups, investigate suspicious files, users and displayed content, and select an appropriate recovery method.
Repair doesn't stop when the homepage loads again. Contact routes, relevant subpages, permissions and, where necessary, search and browser warnings all need checking. The WordPress repair service page describes the types of problems Kaluzsa can examine.
If the old site's condition makes repair unreasonable, you can consider redesigning or rebuilding. But this should follow an assessment, not be an automatic response to one suspicious symptom.
How can you restore your site so customers can trust it again?
The first goal is a secure website whose operation has been verified. Review access rights, suspicious files, backups, contact forms and the pages visitors use. After repair, perform real tests on both mobile and desktop.
Recovery
Find the cause, remove unauthorised changes and check affected features.
Rebuilding trust
Working contact buttons, trustworthy pages, checked redirects and properly organised administrator access.
If repairing the old system is no longer worthwhile, consider WordPress repair alongside or instead of a website redesign. Base the decision on the site's condition and expected business benefit.
What if Google or the browser also shows a warning?
A website flagged as dangerous creates trust and accessibility problems. Search Console's security report or a notification from your host may help the investigation. After fixing the technical problem, you may be able to submit a review request in some cases. This doesn't guarantee that warnings will be removed automatically or within a fixed period.
Similarly, nobody can promise that earlier Google rankings will return fully or by a particular date. Restore visitor safety and genuine website functionality first.
Frequently asked questions when a WordPress hack is suspected
Is installing a security plugin enough?
Not necessarily. A plugin can help, but cannot on its own prove that unauthorised access and the underlying cause have been eliminated.
Do I have to delete everything and build a new site?
Not automatically. The existing system may be recoverable securely, or a fresh foundation with careful content migration may be justified. Decide after assessing its condition.
If I changed the admin password, is the problem solved?
That can be an important defensive step but may not be enough on its own. Other access rights, backups and system components may also be affected.
Will my Google search results definitely return?
There is no guarantee. Resolving the security incident, verifying the website's operation and any Google review process are separate steps.
What should I include in my first enquiry?
Your website address, a brief description of the suspicious behaviour and when you noticed it. Don't send passwords, access tokens or lists of customers' personal data.
Related Knowledge Base guides
Suspicious WordPress behaviour · Kaluzsa
Investigate the signs before the problem spreads further
Share your website address and the suspicious behaviour you have noticed. You don't need to determine the cause yourself; the next professional step will depend on the investigation and the actual state of the affected systems.