Most WordPress compromises aren’t discovered by the site owner, they’re discovered by a visitor, a search engine, or a hosting provider. That delay is exactly why WordPress attacks tend to do more damage than they need to: by the time it’s obvious, the attacker has usually had access for weeks.
The signs worth taking seriously
- Google Search Console or your hosting provider flags the site for malware
- Unfamiliar administrator or editor accounts in your Users list
- Unexpected redirects, especially ones that only trigger for search-engine crawlers or first-time visitors
- A sudden, unexplained drop in search rankings
- Plugins or themes you don’t remember installing
- Spikes in outbound traffic or server resource usage with no matching increase in real visitors
- Pop-ups, fake “verify you are human” prompts, or ad injections that weren’t part of your site
- Your antivirus or browser warns visitors before the page loads
- Files with recent modification dates that you didn’t touch
What to do first
Don’t start by deleting the one file or plugin that looks obviously wrong, in most real compromises, that’s only the visible part of a larger foothold, and removing it alone often leads to reinfection within days. Put the site behind maintenance mode or take it offline if you can do so without losing evidence, change all admin passwords from a separate, clean device, and get a full audit rather than a spot fix.
For a real incident, our case study on a ClickFix malware clean-up walks through what a thorough response actually involves.