A compromised WordPress site rarely advertises the fact. The attacker wants to stay invisible for as long as possible, because every extra day of access is more opportunity to send spam, abuse your hosting, or build search rankings on your domain. The earlier you spot a compromise, the less damage it does. Here are twelve practical red flags worth checking on any WordPress site you own or manage.
1. Unfamiliar pages or folders in the document root
WordPress puts its files in a known set of folders. Anything outside of wp-admin, wp-content, wp-includes, and the standard core files in the root should be investigated. A recent audit on a Sydney agency site revealed five new directories at the root, each named to mirror real WordPress pages. The files inside were the entire attack. The folders themselves were the giveaway.
2. Files with .php extensions in wp-content/uploads
The uploads folder is for media. PHP should not run there. If you find .php files in the uploads tree, especially ones with strange names or recent modification times, treat them as suspicious until proven otherwise. The exception is a small set of intentional stub files that hardening plugins add to block direct access. Anything beyond those is worth investigating.
3. New admin users you did not create
Open Users in your WordPress admin. Look at every account with the administrator role. If anyone is listed who you do not recognise, who has an email at a domain you do not know, or who appears with a registration date that does not match any onboarding you remember, that is a red flag. Attackers commonly create a backdoor admin account so they can return even after the original entry point is closed.
4. Drops or spikes in Search Console performance
Google Search Console is the early warning system most site owners ignore. Sudden drops in impressions or rankings can mean a manual action has been applied. Sudden spikes in impressions for queries that have nothing to do with your business can mean Google is now ranking cloaked content under your domain. Either way, dig in.
5. Unfamiliar indexed URLs
In Search Console, the Coverage report lists every URL Google has indexed under your domain. If you see URLs you did not create, especially in foreign languages or with unusual paths, that is a strong sign your domain is hosting cloaked content. The Sydney case study we mentioned earlier showed up first in indexed URLs that the owner had never seen before.
6. Hosting bill anomalies
A sudden jump in bandwidth or storage on your hosting bill, with no corresponding traffic or content change on the site, can mean the server is being used for something other than your site. Attackers sometimes use compromised WordPress sites to host phishing pages, malware, or spam content, and the bandwidth shows up in your usage statistics.
7. Spam comments or registrations even with filters on
If you have spam filtering installed but spam is appearing anyway, especially comments that get auto approved or user registrations that bypass your settings, something has bypassed normal WordPress flow. That can be a plugin misconfiguration, but it can also be a compromise that has disabled or worked around your protections.
8. Modified core WordPress files
The files in wp-admin and wp-includes are part of WordPress core. Site owners should never edit them, and routine updates should leave them in a known good state. A reputable security plugin like Wordfence can compare your core files against the official versions and tell you which ones have been modified. Any modifications you cannot explain are red flags.
9. Strange entries in your activity log
If your security plugin or your host provides an activity log, read it. Logins from countries you do not operate in, logins at hours that do not match any of your team’s usual patterns, settings changes you did not make, plugins being installed or activated outside of routine maintenance windows. Each of these is worth investigating.
10. Unexpected redirects from search results
Click on your own site from a Google search result, ideally from a fresh browser session or a mobile device. If you end up on a different domain, on an unfamiliar landing page, or on a page that does not match the title you clicked, something is intercepting search traffic. Attackers often write redirect rules that only trigger for visitors arriving from search engines, which is why the same URL looks fine when you type it in directly.
11. Browser warnings on your URL
Chrome, Firefox, and Safari will show a red warning page if Google Safe Browsing has flagged your domain as serving malware or phishing. If anyone reports seeing such a warning on your site, treat it as confirmed compromise until proven otherwise. The warning is not a false positive in the great majority of cases.
12. Customers reporting strange content
Sometimes the most reliable detector is a confused customer. If anyone reaches out to ask why your site is showing unrelated content, advertising products you do not sell, or asking for credentials in an unfamiliar form, listen carefully. Customers see the public side of your site under conditions you may not be testing.
What to do if you spot one of these
If any of these red flags appears, do not panic and do not try to clean up before understanding the scope. The most important first step is to take a snapshot of the current state, including a full backup of files and database, so a forensic audit can see what the attacker did. Then change every credential. Then begin systematic cleanup, ideally with the help of someone who has done it before.
Cleaning up too fast destroys the evidence you need to find the entry point. Without finding the entry point, the attacker will be back within days.
Need a hand?
If any of these red flags has appeared on your WordPress site, Smart Coding can run a forensic audit, identify the entry point, and walk you through a clean recovery. Get in touch as soon as you spot something. Time matters.
