Has my WordPress site been hacked? Warning signs and first steps
Unexpected redirects, new administrators, strange files or sudden spam may indicate abuse. A single symptom is not proof. Gather facts first, limit further damage and avoid deleting useful evidence while investigating.
What should you do if you suspect a compromise?
First create a safe copy of the current state, restrict access where necessary, change important passwords from a clean device and review users, files, logs and recent changes. Do not blindly restore a random old backup without understanding how access was obtained.
Common warning signs
Unknown administrator accounts, modified files, unexpected redirects, new scheduled tasks, strange pop-ups, spam pages in search results or hosting/security warnings all deserve investigation. Sudden server load or unusual outbound email can also be a clue.
Some symptoms have innocent causes such as a failed update or broken plugin, so treat them as evidence to investigate rather than automatic proof.
- Unknown WordPress users or changed roles.
- Unexpected PHP files in uploads.
- Pages or redirects you did not create.
- Sudden outbound email or server load.
- File changes outside planned updates.
Contain the incident without destroying evidence
If the store is still reachable, first preserve a full copy of files, database and relevant logs. This helps both recovery and investigation. Then restrict unauthorised access by rotating hosting, WordPress, database and SFTP credentials where necessary and ending unknown sessions.
Prefer changing credentials from a known-clean device. If the administrator computer itself is compromised, new passwords can leak again.
- Create a snapshot or full backup of the current state.
- Preserve web-server, firewall and login logs.
- End unknown administrator sessions, but record evidence before deleting accounts or files.
- Rotate exposed API keys or tokens.
Find the access route
Removing visible malware is not enough if the original entry point remains open. Review active plugin and theme versions, recent logins, file changes and hosting access.
Compare suspicious files with clean copies from trusted sources and also inspect database content, scheduled tasks and hidden users.
- Review core, plugin and theme files for unexpected changes.
- Review users, roles and recent login activity.
- Inspect wp-config.php and server configuration.
- Check scheduled tasks, mu-plugins and uploads.
Recover and harden again
Restore only from a backup you reasonably believe predates the compromise. Update WordPress, themes and plugins, remove unused software and rotate relevant secrets. Then review both public exposure and internal files again.
If customer or personal data may have been exposed, legal notification duties may apply depending on what actually happened. Keep a timeline and documentation.
- Test checkout, email and payments after recovery.
- Create a new File Integrity baseline once you are confident the installation is clean.
- Enable 2FA and login rate limiting for administrators.
- Monitor logs and changes more closely after the incident.
What Merqivio can and cannot determine
The external Security Check can find signals visible from the internet but cannot prove that an installation is malware-free and cannot access server logs or database records.
The Merqivio Security plugin can inspect files, login activity and suspicious patterns inside WordPress, but it is not a forensic guarantee. Serious confirmed compromises may require specialist incident response.
Start by checking what is visible externally.
The free Security Check gives a first view of your public attack surface. For a real compromise, also use internal logs, files and hosting evidence.