Last updated December 6th, 2023 05:52
As WordPress is currently one of the most popular content management systems for website creation, unfortunately, it is also a frequent target of attackers. Additionally, websites built on WordPress are often created by people with only basic knowledge of its security. Consequently, it is very common to see websites that have not been updated for months or even years, which makes them an easy target for attacks. In this article, I will discuss 10 signs that your WordPress has been hacked.
Your WordPress has been hacked. 10 signs to look out for.
You notice a sudden, significant drop in traffic
If you track your website traffic through any measurement tools, such as Google Analytics, the first alarming signal could be a significant drop in traffic. This can happen for two reasons. First, a malicious attacker may have redirected your website to another page that does not display your site. Therefore, when a user enters your website’s domain, they end up on another page, usually with fraudulent content or malware. This will naturally affect your statistics because the tracking code on your website will not be executed.
The second reason for such a drop could be that Google has detected that your website is under attack and is warning potential users of the danger. As a result, they will close the browser even before your website loads, and therefore, no visit will occur. Therefore, if you monitor visitor statistics more than just your website and its behavior, a drop in visits could indicate a problem.
Suspicious links on your website that may indicate your WordPress has been hacked
Attackers can gain access to the content of your website and insert links to other, often infected, websites. They can gain access to the content either by penetrating the database or by using a user with admin rights. Therefore, if you notice strange inserted links in your website content, you may have a problem. Do not click on the links. Instead, you can copy the links and check their security using a service like virustotal.com. If you open links directly from the website, you may compromise the security of your device and the sensitive information stored on it.
It is important to be careful and not underestimate the risk of malware attacks. Therefore, you should use safe methods to access resources on the Internet. Always check links using specialized tools like virustotal.com before opening them.
Your website displays completely different content
Here, you may not need to worry about anything and may notice that your website has been attacked at first glance. Attackers usually do this for phishing purposes. This is a practice where they place content on your website that copies other websites. Usually banks, social networks, and so on.
Attackers attempt to lure users of your website into providing sensitive data. It could be passwords, logins, credit card numbers, and more. If such content is displayed on your website, immediately deactivate WordPress, for example, using a maintenance information plugin. The fewer users who encounter such content, the fewer people will be deceived.
The fact that WordPress has been hacked may be related to the inability to log in to the WordPress administration.
Many attackers are trying to restrict your access to the website management, which is another sign of an attack. It is possible that one of their steps was to change the admin user’s password. This can be done quite easily if the attacker has access to the database. They can simply change the password hash in the user table to their own, thereby changing your own password as well. If they also change the contact email, you will not be able to perform the classic recovery of forgotten details. The only option is to log in to the database management (PhpMyAdmin) and manually overwrite the data in the xx_users table. You need to modify the admin user’s email and insert a new password hash.
Suspicious User Accounts
From time to time, it’s highly recommended to check the “Users” section in the left-hand administration menu of your WordPress website. If you come across any suspicious user accounts, especially those with administrator privileges, it’s likely that someone has hacked into your website. It’s important to delete these accounts immediately and perform a thorough check of your website’s security.
Unknown Files on FTP
Another reason to suspect a compromised website is the presence of files and folders on the FTP server that you did not create and have suspicious names. When you log in to your FTP server, you can see the files that WordPress uses. Among them, there may be files with strange names that you can open with an FTP client and examine the source code. If you’re not a programmer, you can test such files on the website virustotal.com to check if the file is malicious or not. If the test confirms that the file contains a virus, you must go through the entire directory structure of your website and search for other infected files. Your web hosting provider can often help you with such problems, as they have tools to scan for malicious code.
Website has become very slow and is returning errors
A slow WordPress website is a nightmare for many developers. However, not all slow speeds are caused by plugins or website settings. If the response time and speed of your website are very slow without any radical changes, it may be another signal that there is a problem on your website that needs to be resolved.
Contact forms have stopped working
This problem may originate from your web hosting provider, who may have disabled the mail function in PHP, making it impossible to send emails through your contact form. Providers may take such measures after discovering spam being sent from your website. Attackers can send spam either by hacking into your website or by exploiting the lack of protection on your contact forms (whether it’s protection against comment spam or protection on contact forms).
Incorrect meta information in search results (e.g. using Google)
If you find your website in Google search results for your targeted keywords, but the meta information in the description is false or different from what you’ve set, it could mean that someone has gained access to your WordPress and changed these meta tags. As search engine robots revisit and re-index your website, they will pick up the new meta tags. Therefore, if you come across strange meta information in your website’s search results, it’s a sign that something is definitely wrong. The first step is to check the meta descriptions of your articles and pages, which you likely use an SEO plugin for. If you discover that the meta tags are in disarray, it’s recommended to immediately stop website operation and conduct a complete check.
White screen of death
The white screen of death refers to a situation where you only get a blank white screen after entering your domain name into a browser. This issue arises from a code damage on your website, and usually, you’ll have to look for the cause in php logs. These logs should help you determine where the problem is originating. If you don’t have access to your server logs, you should contact your web hosting provider to obtain them.
Conclusion – How to tell if your WordPress has been hacked?
We’ve made it to the end. The signs listed above may not be all of the ones that indicate a hacked website, but they are among the most common. It’s therefore good to be aware of these 10 signs and check them occasionally. Prevention is only possible with thorough care of your website.
The website is created with care for the included information. I strive to provide high-quality and useful content that helps or inspires others. If you are satisfied with my work and would like to support me, you can do so through simple options.
Subscribe to the Newsletter
Stay informed! Join our newsletter subscription and be the first to receive the latest information directly to your email inbox. Follow updates, exclusive events, and inspiring content, all delivered straight to your email.
