Strange behaviour on a website is not always a sign of compromise. Plugins update, caches produce odd output, servers get misconfigured, and DNS changes propagate at different speeds for different users. But some symptoms are specific enough that they deserve a prompt, methodical check rather than a wait-and-see approach. This guide helps you separate the routine from the genuinely concerning.
Visible symptoms visitors may notice
The most obvious signs of compromise are ones visitors report before you notice them yourself. These include unexpected redirects to unrelated websites (spam, adult content, or fake retail sites), pages that display content you did not write, pop-ups or overlays that do not belong to your site, or a browser warning like "Deceptive site ahead" or "This site may be hacked."
Search results are another early warning. If you search Google for your business name and see unusual page descriptions — pharmaceutical spam, gambling content, or foreign-language text — it suggests that search engines have indexed injected content that your regular browser view is not showing you. This discrepancy between what Google sees and what you see is a hallmark of cloaking, where malicious content is shown only to search bots and not to logged-in admins.
A sudden sharp drop in organic search traffic without any other explanation — no recent content changes, no major Google algorithm update — is worth investigating. It can indicate that Google has detected and filtered malicious content on your site.
Hidden symptoms owners often miss
Not all compromise is immediately visible. Common hidden symptoms include new WordPress admin accounts you did not create, unfamiliar plugins or themes installed without your knowledge, unexpected files in your hosting file manager (particularly PHP files in image upload directories), and email delivery problems caused by your domain being used to send spam.
Check your website's server access logs if you can access them. A sudden spike in requests to a specific PHP file — especially one with a suspicious name — can indicate a web shell or backdoor that attackers are using to maintain access. Most hosting providers make access logs available through cPanel or a similar control panel.
An email from your hosting provider warning about resource usage, outbound spam, or suspended accounts is a strong signal that something is running on your hosting that you did not install. These notifications are easy to overlook in a busy inbox but are worth acting on promptly.
When to pause edits and preserve evidence
If you see multiple symptoms — particularly a combination of visible redirects, new admin accounts, and unusual files — pause any editing work on the site. Making broad changes (deleting files, updating plugins, restoring a backup) before documenting what is present can destroy evidence that would help you or a security professional understand how the compromise happened and whether it has been fully cleared.
Take screenshots of what you see. Note the date, time, and specific URLs. Download a copy of your access logs if possible. These details are useful if you need to involve your hosting provider, a security professional, or — in serious cases involving payment data or customer records — a breach notification process.
- Search Google for your site name and check that descriptions match your actual content.
- Log out of WordPress and visit your site as a regular visitor — not as an admin.
- Check the WordPress Users list for accounts you did not create.
- Look in your file manager for PHP files in
/wp-content/uploads/. - Check your hosting email notifications for resource or spam warnings.
- Before making changes, screenshot and document what you observe.
Not every strange website issue is a hack, but some symptoms deserve fast triage.
Check hacked website symptoms