What to Do and How to Check if Your WordPress Site Has Been Hacked?

Is your site behaving strangely, is there spam or malicious advertising?  

Or maybe you've lost access to your WordPress website? Or has Google banned your site and it's no longer available in search? If your WordPress site has been hacked, how do you check and what do you do? In a way, this is good news, because now you know for sure that your site needs to be treated and restored.

Most owners of infected sites do not even realize that the site has long been a source of viruses and a threat to everyone who visits it. There are more than 18 million infected websites in the world, and only 15-20% of them are blacklisted and blocked by Google. The rest continue to operate.

Most likely, your website has been hacked.

Moreover, it must have happened a long time ago, because viruses and malware that have infected a website often remain dormant for a long time and do not show their activity. Hackers need as many simultaneously infected websites as possible for their goals and objectives. A few sites with malicious code will not help hackers to conduct their massive attacks and spread their virus further across the network.  

Moreover, if Google and other browsers have already reacted to your infected website by blocking it, this is an accurate indicator that the site was infected quite a while ago, because it takes a long time for a search engine to detect malicious code on a website. Hackers can do a lot of damage to your online business, ranging from simple spam ads to redirecting your users to other dangerous resources.

Once identified, Google will blacklist your site and remove it from search results. Visitors trying to access your website will encounter a browser warning about potential danger.

Your hosting provider will also notify you and restrict access to the site until anyl malicious code has been completely removed—even if you have an SSL certificate and your site operates over HTTPS.

What to Do to Clean Your Site?

First and foremost, stay calm. Your site can be restored. Begin by performing a thorough and accurate check for hacks and viruses.

How to Check if My Site Is Hacked?

Start by looking for common signs of a hacked website:

• Pop-ups appear on your website that were not created by you or your team. 
• Your website redirects users to another website you don't know.  
• Spam ads on your website with adult content, drugs, gambling or other illegal activities.  
• Your website is ranked for spam keywords in Google Analytics or another analytics tool.  
• Your visitors are blocked in the browser with a warning from Google: ‘Site contains malware’. 
• You receive an email from your web host that your website has malicious code.

These indicators suggest your site has been hacked, though occasionally, they can be false alarms. It’s crucial to confirm the issue with a detailed and accurate inspection of your website.

The easiest and most effective way to check for issues is to use a malware scanner.

A good online scanner will automatically detect malicious code. The most complex and risky method for checking a WordPress site is conducting a manual review, which involves directly interacting with WordPress files and folders. This method is risky because it requires technical expertise and can potentially harm the site if done incorrectly.

Ways to check if your site is hacked:

1. Scan Your Site Using a Malware Scanner

One of the scanners is MalCare, a malware scanner.

Detects new types of malware by analyzing code behavior.

Finds hidden malicious programs by thoroughly scanning every file on your site.

Does not slow down your site during the scanning process.

As mentioned earlier, MalCare evaluates the behavior of the code rather than relying solely on pattern matching or structural comparison. This ensures it doesn't make blind assumptions about whether code is malicious, thereby reducing the number of false positives. 

To scan your website using MalCare, follow these steps:

Install the MalCare Security Plugin on your website.

Go to your website's admin dashboard and select MalCare from the menu.

On the MalCare page, enter your website's URL and start a free malware scan. If the scan detects that your website is hacked, you will receive a notification with the number and locations of infected files.

2. Check Google Search Console for “Security Issues”

Google Search Console helps monitor your website’s traffic and performance, and it alerts you if there are any security issues on your site. If your site contains malware, Search Console can detect it. What you need to do: 

Log in to your Google Search Console account.

From the left-hand menu, select Security Issues.

If your website is hacked, you will see a warning stating that “unwanted software” or malware has been detected on your site. It is very Important: to enable Google Search Console to detect security issues, you must set it up and verify ownership of your website. If you haven’t done this yet, complete the verification process to allow Google to monitor your site effectively.

3. Check Your Site Using Google Safe Browsing Tool

Enter your website’s domain into the Google Safe Browsing Tool, and it will display any issues detected on your site. This tool is highly reliable as it is developed by Google. It scans your site for malware and notifies you if any malicious software is found.

4. Check Alerts from Hosting Providers, Search Engines, and Browsers

If your WordPress site has been hacked (and you’re unsure what to do or how to check), it’s likely that you’ve received warning emails or messages from your hosting provider. Search engines and browsers, such as Google, Yahoo, and Bing, will also display warning messages on your site and in search results to alert visitors that your site has been compromised. This can significantly impact your site’s search performance, causing your site to lose rankings or even disappear from Google search results for a certain period.

Hosting Provider

Hosting providers manage thousands of websites. To ensure the security of their platform, they regularly scan all hosted websites for potential malicious activity. A single compromised website can negatively affect other websites on the hosting platform, jeopardizing the provider's entire business.

Therefore, when they detect a hacked website, they immediately suspend the hosting account and notify the website owner to fix the problem. To check if your hosting provider has detected a hack, review your email inbox or check the notifications in your hosting account's control panel.