{
    "title": "How to tell if my WordPress site is hacked: 8 infections to hunt down",
    "seo_title": "How to Tell if Your WordPress Site Is Hacked: 8 Infections",
    "h1": "How to tell if my WordPress site is hacked: 8 infections to hunt down",
    "description": "Japanese spam, mobile redirects, PHP in uploads, hidden admins, cron, database: how to detect each WordPress infection, with the commands to run.",
    "lead": "The eight most common infections of a WordPress site and, for each one, the symptom, the command or tool that confirms it and the false positives to know about.",
    "language": "en",
    "locale": "en-US",
    "type": "article",
    "url": "https://www.wp-masquerade.com/detect-hacked-wordpress-site/",
    "canonical": "https://www.wp-masquerade.com/detect-hacked-wordpress-site/",
    "markdown": "https://www.wp-masquerade.com/detect-hacked-wordpress-site/index.md",
    "json": "https://www.wp-masquerade.com/detect-hacked-wordpress-site/index.json",
    "published": "2026-05-14T06:00:00+00:00",
    "modified": "2026-10-29T13:54:24+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "How to tell if my WordPress site is hacked: 8 infections to hunt down",
            "url": "https://www.wp-masquerade.com/detect-hacked-wordpress-site/",
            "markdown": "https://www.wp-masquerade.com/detect-hacked-wordpress-site/index.md",
            "json": "https://www.wp-masquerade.com/detect-hacked-wordpress-site/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Comment détecter si mon site WordPress est piraté : 8 infections à traquer",
            "url": "https://www.wp-masquerade.com/fr/detecter-site-wordpress-pirate/",
            "markdown": "https://www.wp-masquerade.com/fr/detecter-site-wordpress-pirate/index.md",
            "json": "https://www.wp-masquerade.com/fr/detecter-site-wordpress-pirate/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Cómo saber si mi sitio WordPress está hackeado: 8 infecciones que rastrear",
            "url": "https://www.wp-masquerade.com/es/detectar-wordpress-hackeado-infecciones/",
            "markdown": "https://www.wp-masquerade.com/es/detectar-wordpress-hackeado-infecciones/index.md",
            "json": "https://www.wp-masquerade.com/es/detectar-wordpress-hackeado-infecciones/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "Wie erkenne ich, ob meine WordPress-Website gehackt ist? 8 Infektionen im Visier",
            "url": "https://www.wp-masquerade.com/de/wordpress-hack-erkennen-infektionen/",
            "markdown": "https://www.wp-masquerade.com/de/wordpress-hack-erkennen-infektionen/index.md",
            "json": "https://www.wp-masquerade.com/de/wordpress-hack-erkennen-infektionen/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Come capire se il mio sito WordPress è stato hackerato: 8 infezioni da scovare",
            "url": "https://www.wp-masquerade.com/it/capire-se-sito-wordpress-hackerato/",
            "markdown": "https://www.wp-masquerade.com/it/capire-se-sito-wordpress-hackerato/index.md",
            "json": "https://www.wp-masquerade.com/it/capire-se-sito-wordpress-hackerato/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Como saber se meu site WordPress foi invadido: 8 infecções para rastrear",
            "url": "https://www.wp-masquerade.com/pt/como-saber-site-wordpress-invadido/",
            "markdown": "https://www.wp-masquerade.com/pt/como-saber-site-wordpress-invadido/index.md",
            "json": "https://www.wp-masquerade.com/pt/como-saber-site-wordpress-invadido/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "Hoe weet ik of mijn WordPress-site gehackt is? 8 infecties om op te sporen",
            "url": "https://www.wp-masquerade.com/nl/gehackte-wordpress-site-opsporen/",
            "markdown": "https://www.wp-masquerade.com/nl/gehackte-wordpress-site-opsporen/index.md",
            "json": "https://www.wp-masquerade.com/nl/gehackte-wordpress-site-opsporen/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "How to tell if my WordPress site is hacked: 8 infections to hunt down"
        },
        {
            "level": 2,
            "text": "Why a hack goes unnoticed"
        },
        {
            "level": 2,
            "text": "The eight infections and how to spot them"
        },
        {
            "level": 3,
            "text": "1. SEO spam: Japanese keywords, pharma, casino"
        },
        {
            "level": 3,
            "text": "2. Unknown pages in the index and an extra owner"
        },
        {
            "level": 3,
            "text": "3. Redirects aimed only at mobiles or visitors coming from Google"
        },
        {
            "level": 3,
            "text": "4. Suspicious files on the server"
        },
        {
            "level": 3,
            "text": "5. Modified core files"
        },
        {
            "level": 3,
            "text": "6. Unknown administrator accounts"
        },
        {
            "level": 3,
            "text": "7. Scheduled tasks and hidden plugins that reinfect"
        },
        {
            "level": 3,
            "text": "8. Injections in the database"
        },
        {
            "level": 2,
            "text": "External signals: Search Console and blocklists"
        },
        {
            "level": 2,
            "text": "Summary table"
        },
        {
            "level": 2,
            "text": "Get alerted instead of searching"
        },
        {
            "level": 2,
            "text": "If you find something"
        },
        {
            "level": 2,
            "text": "Frequently asked questions"
        },
        {
            "level": 3,
            "text": "Key takeaways"
        },
        {
            "level": 2,
            "text": "Find out before your customers do"
        },
        {
            "level": 2,
            "text": "Sources"
        },
        {
            "level": 2,
            "text": "WordPress security, without the noise",
            "id": "wpm-nl-box-title"
        }
    ],
    "body": "To find out whether your WordPress site has been hacked, opening it in your browser is not enough: most infections hide from a logged-in administrator. You have to look for them where they live: in Google’s index, in certain files, in the database and in scheduled tasks. This guide walks through the eight most common infections and, for each one, the symptom, the command or tool that confirms it and the false positives to know about.\n\nIf you first want a quick triage of the warning signs, start with [the signs of a hacked WordPress site](https://www.wp-masquerade.com/wordpress-site-hacked-signs/), then come back here to confirm infection by infection.\n\n## Why a hack goes unnoticed\n\nAn attacker has every reason to stay quiet: a site that works normally for its owner keeps serving the attacker’s interests for months. So the malicious code checks who is asking. A logged-in administrator sees the normal page, a mobile visitor coming from Google is redirected, and Google’s crawler gets spam pages. In April 2026, the backdoor hidden in more than 30 acquired plugins (the EssentialPlugin suite) only showed its spam to Googlebot, which made it invisible to site owners.\n\n*The malicious code picks its answer based on the visitor: that is why the administrator sees nothing.*\n\nIn practice: always test from a point of view other than your own (private window, mobile network, Google’s URL Inspection tool, command line), and search the files and the database rather than the pages.\n\n## The eight infections and how to spot them\n\n### 1. SEO spam: Japanese keywords, pharma, casino\n\nThis is the most widespread infection. The attacker creates thousands of pages (often in randomly named folders) full of Japanese text, medicines or gambling, to ride on your domain’s reputation. Google describes this “Japanese keyword hack” in detail. To spot it, search Google for:\n\n```\nsite:yourdomain.com casino\nsite:yourdomain.com viagra OR cialis OR pharmacy\nsite:yourdomain.com 激安\nsite:yourdomain.com inurl:.html\n```\n\nThe third search targets a Japanese word that is very common in this spam (“rock-bottom price”). The last one brings up `.html` pages that WordPress does not normally produce. In Search Console, the Performance report also shows queries in a language you do not use.\n\n### 2. Unknown pages in the index and an extra owner\n\nIn Search Console, open Settings, then “Users and permissions”: an owner you do not know is a strong sign, because attackers add themselves to get their pages indexed. Then check the Sitemaps report: a sitemap you never submitted, or an exploding number of discovered pages, confirms the injection. The URL Inspection tool shows what Google actually received, even if the page seems to return a 404 error to you.\n\n### 3. Redirects aimed only at mobiles or visitors coming from Google\n\nYour customers complain about landing on a scam site and you cannot reproduce it? The redirect often targets only mobiles, visitors coming from a search engine, or a single visit per IP address. Test from the command line by imitating these visitors:\n\n```\ncurl -sI -A \"Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) Mobile\" \\\n     -e \"https://www.google.com/\" https://yourdomain.com/\n```\n\nA `Location` header pointing to another domain means a server-side redirect. If nothing shows up, the redirect may be done in JavaScript: open the site on a smartphone over the mobile network, in a private window, by clicking a Google result. Then look for rules added at the top of the `.htaccess` file.\n\n### 4. Suspicious files on the server\n\nConnect over SFTP or SSH. A few searches are enough to bring out the usual hiding places:\n\n```\n# PHP in the media folder: there should be none\nfind wp-content/uploads -type f -name \"*.php\"\n\n# .ico files that are not favicons, and @include lines that load them\nfind . -type f -name \"*.ico\" ! -name \"favicon.ico\"\ngrep -rlE --include=*.php \"@include.*\\.ico\" .\n\n# Files renamed .suspected by a hosting scanner\nfind . -name \"*.suspected\"\n\n# Functions often used to hide code (many false positives)\ngrep -rlE --include=*.php \"eval\\(|base64_decode\\(|gzinflate\\(|str_rot13\\(\" wp-content\n\n# PHP files modified in the last 14 days, newest first\nfind . -type f -name \"*.php\" -mtime -14 -printf \"%TY-%Tm-%Td %p\\n\" | sort -r | head -40\n```\n\nAn `.ico` file containing PHP, a name like `wp-user.php` in the root folder or a PHP file in `uploads` are strong clues. `.suspected` files mean a scanner has already found an infection: the code that created them may still be there. Also remember that a modification date can be faked with one command: a file dated 2019 is not necessarily clean.\n\n### 5. Modified core files\n\nWP-CLI compares your files with the checksums published by WordPress.org. It is the most reliable test for core and free plugins:\n\n```\nwp core verify-checksums --include-root\nwp plugin verify-checksums --all\n```\n\nThese commands cover neither themes, nor premium plugins, nor `wp-config.php`. So open that file and read the end: nothing should follow the line `require_once ABSPATH . 'wp-settings.php';`. That is exactly where the EssentialPlugin backdoor injected its code.\n\n### 6. Unknown administrator accounts\n\nSome backdoors hide their account from the user list in the Dashboard. Query the database directly (replace `wp_` with your table prefix):\n\n```\nwp user list --role=administrator --fields=ID,user_login,user_email,user_registered\n\nwp db query \"SELECT u.ID, u.user_login, u.user_email, u.user_registered\n  FROM wp_users u JOIN wp_usermeta m ON m.user_id = u.ID\n  WHERE m.meta_key = 'wp_capabilities' AND m.meta_value LIKE '%administrator%'\"\n```\n\nIf the SQL query returns more accounts than `wp user list` or the Users screen, an account is hidden. A registration date on which nobody worked on the site, or a disposable e-mail address, is enough to treat the account as hostile.\n\n### 7. Scheduled tasks and hidden plugins that reinfect\n\nYou deleted a file and it is back the next day? A scheduled task or a “must-use” plugin (the `mu-plugins` folder, loaded automatically and invisible in the usual list) recreates it.\n\n```\nwp cron event list --fields=hook,next_run_relative,recurrence\nwp plugin list --status=must-use\nwp plugin list --status=dropin\n```\n\nA hook with a random name, or one that matches no installed plugin, deserves a search in the code. Also check the server crontab and the scheduled tasks in your hosting control panel. Our definition of [cron](https://www.wp-masquerade.com/glossary/cron-wp-cron/) explains the difference between the two.\n\n### 8. Injections in the database\n\nSome infections touch no file at all: they live in the database. Three checks cover the common cases:\n\n```\n# Site address: a foreign value redirects the whole site\nwp option get siteurl\nwp option get home\n\n# Scripts injected into content\nwp db query \"SELECT ID, post_title, post_status FROM wp_posts\n  WHERE post_content LIKE '%\n```\n\nLegitimate results are possible (a widget with an analytics snippet, a post that shows code): review each line. On a WooCommerce store, an unknown script on the checkout page should make you think of card skimming and calls for an immediate response.\n\n## External signals: Search Console and blocklists\n\n- **Search Console**, “Security issues” and “Manual actions”: Google reports hacked content there, with sample URLs.\n- **Google Transparency Report** (Safe Browsing): it shows whether your domain is currently considered dangerous. If it is, follow [our guide to getting off the Safe Browsing list](https://www.wp-masquerade.com/google-dangerous-site-warning/).\n- **Remote scanners** (Sucuri SiteCheck, VirusTotal): they see the public pages and blocklists, nothing of what happens on the server.\n- **E-mail**: messages landing in your customers’ spam folders or mass “undeliverable” bounces can point to a spam-sending script.\n\n## Summary table\n\n| Infection | Symptom | Confirmation | Common false positive |\n| --- | --- | --- | --- |\n| SEO spam | Foreign titles in Google | site: searches, Search Console | Old deleted pages still cached |\n| Targeted redirect | Complaints from mobile visitors | curl with mobile User-Agent and Referer | Legitimate language or app redirect |\n| Backdoor | Often none | File searches, checksums | Encoded code from a commercial plugin |\n| Hidden account | None in the Dashboard | SQL query on roles | Technical account of the host |\n| Reinfection | Files that come back | Cron, mu-plugins, server crontab | Tasks of a cache or backup plugin |\n| Database injection | Unknown scripts in pages | Queries on content and options | Analytics snippets |\n\n*Each suspicion is confirmed by a check that does not depend on your browser.*\n\n## Get alerted instead of searching\n\nThese checks take an hour; nobody runs them every week. WP Masquerade Pro automates part of the detection, without pretending to be something it is not:\n\n- **[Integrity check](https://www.wp-masquerade.com/features/wordpress-integrity-check/)**: every day, core files are compared with the official WordPress.org list; modified and missing files and unknown PHP files in `wp-admin` or `wp-includes` are reported by e-mail.\n- **Activity log**: a new administrator, a role change, a plugin installed in the middle of the night, an account e-mail changed.\n- **Alerts**: an administrator logging in from an unknown device, a new known vulnerability in an installed plugin, a report every Monday.\n\nLimits to know: the integrity check covers core, not plugins, themes, media or the database; the log does not see what goes through FTP. WP Masquerade is not an antivirus: to scan `wp-content` and the database, add a scanner such as those covered in [Wordfence and WP Masquerade](https://www.wp-masquerade.com/wordfence-and-wp-masquerade/) or MalCare and WP Masquerade.\n\n## If you find something\n\nDo not delete anything in a hurry. Copy the suspicious files and the server logs (they date the intrusion), put the site in maintenance mode, then follow the [step-by-step cleanup procedure](https://www.wp-masquerade.com/clean-hacked-wordpress-site/). After the cleanup, apply [the method to secure WordPress](https://www.wp-masquerade.com/how-to-secure-wordpress-site/) to prevent reinfection, and request a review from Google if spam pages were indexed.\n\n*“How to Remove Malware & Clean a Hacked WordPress Site”, official Sucuri channel (in English, 2019): the cleanup team shows where it looks for infected files and database entries; the interfaces have changed, the approach still holds.*\n\n## Frequently asked questions\n\n**My site looks normal: can it still be hacked?**\n\nYes. Many infections only show themselves to search engine crawlers, mobile visitors or people who are not logged in. A backdoor can also stay silent until it is activated.\n\n**How can I check without SSH access?**\n\nRun the external checks (site: searches, Search Console, Transparency Report), browse the folders over SFTP sorted by date, and use phpMyAdmin for the SQL queries. A scanner installed in WordPress completes these checks.\n\n**Does a base64_decode match mean the site is hacked?**\n\nNot necessarily: legitimate plugins use it. It is the combination that raises the alarm: an encoding function, a file in an unusual location, a recent date and a name that imitates a WordPress file.\n\n**Does WP Masquerade detect malware?**\n\nPro detects changes to core files and suspicious account actions, and alerts you. It is not an antivirus: it does not scan the code of plugins, themes or the database.\n\n### Key takeaways\n\n- Infections hide from the administrator: test like Google, like a mobile and from the command line.\n- site: searches and Search Console reveal SEO spam and added owners.\n- Files: PHP in uploads, .ico files containing PHP, .suspected files, the end of wp-config.php.\n- Accounts and persistence: compare SQL with the Dashboard, read cron and mu-plugins.\n- Database: siteurl, scripts in content and options.\n\n## Find out before your customers do\n\nWP Masquerade Pro checks core integrity every day, logs administrator actions and alerts you by e-mail. The free version already reduces what bots can see of your site.\n\n[See Pro pricing](https://www.wp-masquerade.com/pricing/)\n\n[Download the free version](https://www.wp-masquerade.com/download/)\n\n## Sources\n\n- web.dev: Fix the Japanese keyword hack (https://web.dev/articles/fix-the-japanese-keyword-hack)\n- WP-CLI: wp core verify-checksums (https://developer.wordpress.org/cli/commands/core/verify-checksums/)\n- Google: Safe Browsing Transparency Report (https://transparencyreport.google.com/safe-browsing/search)\n- BleepingComputer: WordPress plugin suite hacked to push malware (https://www.bleepingcomputer.com/news/security/wordpress-plugin-suite-hacked-to-push-malware-to-thousands-of-sites/)\n\n## WordPress security, without the noise\n\nOne e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.",
    "categories": [
        "Monitoring and response"
    ],
    "format": "application/json"
}