Being the victim of a website hack isn’t always obvious. Here are ways to tell if your WordPress website has fallen victim to a hacker, and they’re not what you might expect. 

• Defacement or Spam

The most obvious way to tell if your WordPress website has been hacked is that it is not your website, meaning that the front page has been defaced with a political message or a cry to the peers of the attacker. Or, bad actors put code, often through the header or footer, to inject spammy content into every page on the website. This could be pharmacy spam or commercials for falsified luxury items, or worse, code sending visitors to malicious websites.

• Broken Website or Design

Not every problem with a WordPress website is now due to a hack. Though this might be a symptom. If your website lacks functionality when no valid code changes have occurred, or the design is disabled inexplicably (see number 1), this could be a sign of malicious activity. Again, a broken website could be an ongoing hack, an attempted hack that broke part of the website, or it could be a totally unpleasant problem.

• Search Engine Warning

Most search engines require a webmaster to register an explicit crawling of their WordPress website in exchange for suggestions for better search results. The search engine can find malicious content in the process of indexing a website and notify the webmaster. Of course, getting a tourist or potential customer tell you that your website is block because it may be compromised is a less than ideal way to find out which search engine flagged your website.

• Unknown Users or Loss of Access

If an unauthorized admin user appears in the dashboard for WordPress, or you lose access to your admin account, this is a strong indication of a hack. Sure, attackers have ways to add admin users without logging into the WordPress dashboard.

• Website Held Hostage by Ransomware

Perhaps the worst way to discover your WordPress website has been compromised is perhaps also the newest. Ransomware, like Cryptowall and Cryptolocker, is hacking machines, encrypting key data files found on local machine and network drives, and keeping the encrypted files hostage for a considerable amount of Bitcoin. A new strain of ransomware targets website and webserver files, and finding an unresponsive website and a text file called README FOR DECRYPT.txt on the server is an unpleasant way to get the news that your website has been hacked.

• Bad Links Added to Your Website

One of the most common signs among hacked WordPress sites is data injection. Hackers create a backdoor on your WordPress site which gives them access to modify your WordPress files and database.

Some of these hacks add links to spammy websites. Usually these links are add to the footer of your website, but they really could be anywhere. Deleting the links will not guarantee that they will not come back.

• You are Unable to Login to WordPress

If you are unable to login to your WordPress site, then there is a chance that hackers may have deleted your admin account from WordPress.

Since the account doesn’t exist, you would not be able to reset your password from the login page. There are other ways to add an admin account using phpMyAdmin or via FTP. However, your site will remain unsafe until you figure out how a hacker got into your website.

• Unknown File and Scripts on Your Server

If you’re using a site scanner plugin like Sucuri, then it will alert you when it finds an unknown file or script on your server.

You need to connect to your WordPress site using a FTP client. The most common place where you will find malicious files and scripts is the /wp-content/ folder.

Usually, these files are name like WordPress files to hide in plain sight. Deleting these files immediately will not guarantee that these files will not return. You will need to audit the security of your website specially file and directory structure.

• Failure to Send or Receive WordPress Email

Hacked servers are commonly used for spam. Most WordPress hosting companies offer free email accounts with your hosting. Many WordPress site owners use their host’s mail servers to send WordPress emails.

If you are unable to send or receive WordPress emails, then there is a chance that your mail server is hack to send spam emails.

• Suspicious Scheduled Tasks

Web servers allow users to set up cron jobs. These are schedule tasks that you can add to your server. WordPress itself uses cron to setup scheduled tasks like publishing scheduled posts, deleting old comments from trash, and so on.

A hacker can exploit cron to run scheduled tasks on your server without you knowing it.