If you’re here because something feels off, an odd email from your host, a strange redirect, a friend saying your site looks weird, you don’t need a sales pitch right now. You need a clear way to check. Here’s one, in order of how likely each thing is to actually confirm something’s wrong.
Start With the Obvious Things
Visit your own site in an incognito window. Not logged in, no cached anything. If you get redirected somewhere unexpected, especially to a completely unrelated site, that’s a real, strong signal. Malicious redirects are one of the most common symptoms of a compromised WordPress site, and they’re often invisible to a logged-in admin, since some malware specifically avoids showing itself to logged-in users.
Check Google Search Console, if you have it set up. Google actively flags sites it believes are compromised, and will show a warning directly in Search Console under Security Issues if it’s found something. This is one of the more reliable early signals, because Google’s own crawlers are looking at your site from the outside, the same way an attacker’s target audience would.
Search site:yourdomain.com on Google. If your search results show pages you didn’t create, especially ones in a different language or clearly spam-related (this happens often enough to have a name, “Japanese keyword hack” is a real, well-documented pattern), that’s a strong sign someone’s injected content specifically designed to be found by search engines, not by you.
Check Who Has Access
Go to Users in your WordPress admin and actually read the list. Not skim it, read every entry. Look specifically for any account with Administrator access you didn’t create. This is one of the single most common things attackers do once they’re in: create a new admin account as a backup way back in, in case you find and fix whatever got them in the first place.
Check when each admin account was created, if your user list shows that. An admin account created at 3am, that nobody remembers setting up, is worth investigating immediately, even if nothing else looks wrong.
Check the Files Themselves
Look for anything unfamiliar in wp-content, particularly inside your active theme’s folder. A malicious file often gets named to look boring on purpose, things like wp-class.php or cache-tmp.php, designed to blend in rather than stand out.
Compare your core WordPress files against the official version, if you’re able to. WordPress publishes official checksums for every release specifically so this comparison is possible. A modified core file, one that doesn’t match what WordPress.org actually shipped, is one of the most direct, hard-to-fake signs of compromise there is. This is genuinely more reliable than eyeballing file names, because it’s not guesswork, it’s a direct comparison against a known-correct original.
Check Performance and Behavior
Is your site suddenly slow, or is your host warning you about resource usage? Compromised sites are sometimes used to send spam email, mine cryptocurrency, or participate in attacks against other sites, all of which show up as unexplained load on your server.
Check your outgoing email, if your host gives you visibility into it. A sudden spike in outbound email you didn’t send is a classic sign of a compromised site being used as a spam relay.
If You Find Something
Don’t panic, and don’t immediately delete everything you find. A few things worth doing in order:
- Change your WordPress admin password immediately, and any FTP/hosting passwords too, in case the original entry point was a stolen credential rather than a software vulnerability.
- Remove any admin account you didn’t create. Don’t just downgrade it, remove it, after confirming it’s genuinely not something a real team member set up.
- Update everything. Core, every plugin, every theme, right away. If the entry point was an outdated plugin, this closes it. If you’re not sure which plugin was the problem, updating all of them is still the right move.
- Check with your host about a backup from before the compromise. Most hosts keep some rolling backup history. Restoring to a genuinely clean point is often faster and more certain than trying to manually hunt down and remove every piece of injected code.
- If you’re not confident you’ve actually found and removed everything, get a second opinion. A site that looks clean but has a backdoor left behind will just get compromised again.
Why Most of This Is Hard to Do Manually, Every Time
Checking user lists, comparing core files against official checksums, watching for new admin accounts, all of this is genuinely useful, and genuinely tedious to do by hand on a regular basis. It’s also exactly the kind of checking that’s easy to automate correctly and easy to get subtly wrong if you’re doing it manually under stress, which is usually exactly when you’re doing it.
SecondGate runs the core file comparison daily against WordPress.org’s own official checksums, flags new admin accounts that appear close in time to a suspicious file change, and keeps a tamper-evident log of what actually happened and when, so if something ever does go wrong, you’re working from a real record instead of trying to remember what you saw.
