The most common signs a WordPress site has been hacked are unexpected redirects, spam pages showing up in Google, browser security warnings, unfamiliar admin accounts, and content you didn’t write. For a public health organization, any one of these deserves prompt attention, because people rely on your site for accurate, trustworthy information.
This checklist walks through what to look for, how to decide what’s urgent, and when it’s time to call in professionals.
Why a Checklist Helps Public Health Teams Spot a Hack Early
Most website compromises don’t announce themselves. Attackers often prefer to stay hidden so they can keep using your site to send spam, redirect visitors, or boost their own search rankings. Some hacks only appear to certain visitors, such as people arriving from Google on a phone, so your staff may never see the problem when they log in.
Public health organizations also face higher stakes than many other site owners. Your site may publish vaccination schedules, clinic hours, outbreak updates, or program eligibility details. If someone tampers with that content, or if your site starts sending visitors to a scam page, the damage goes beyond the website itself. It can undermine community trust you’ve spent years building.
A checklist gives your communications or operations staff a simple, repeatable way to look for trouble, even if nobody on the team is a developer. It turns a vague worry into a set of concrete things to check.
The Checklist: Signs Your WordPress Site Has Been Hacked
Work through these items on a regular schedule, and anytime something feels off. You don’t need technical skills for most of them.
- Search results look wrong. Search Google for your own organization and look at the titles and descriptions. Spammy text about pharmaceuticals, gambling, counterfeit goods, or text in a language you don’t publish in is a classic warning sign.
- Visitors see a security warning. A full-screen browser message calling your site deceptive or dangerous means it has likely been flagged for malware or phishing.
- The site redirects somewhere else. Try opening your site on a phone, in a private browser window, and by clicking through from a Google search. Some redirects only trigger under these conditions.
- Content has changed without explanation. Look for edited health guidance, new pages nobody created, hidden links in your footer, or pop-ups your team didn’t add.
- There are admin accounts you don’t recognize. In WordPress, review the Users screen. Any administrator you can’t account for is a serious red flag.
- You can’t log in, or you’re getting unexpected password reset emails. This can mean someone has changed credentials or is actively trying to get in.
- Plugins or themes appeared on their own. Unfamiliar plugins, especially ones with vague names, can be a way for attackers to keep access.
- Your email is behaving strangely. If messages from your domain land in spam folders, or people report receiving odd emails that appear to come from you, your site may be sending spam.
- The site suddenly slows down or goes offline. Malicious code can consume resources. Performance problems aren’t always a hack, but they’re worth investigating alongside other signs.
- Forms aren’t working as expected. If contact, intake, or registration forms stop delivering submissions, or the form looks different, someone may be intercepting data.
- Google Search Console shows a security notice. If your organization uses Search Console, check for security issue alerts or new verified owners you didn’t add.
One sign on its own isn’t always proof of a hack. A slow site might just need maintenance. But if you see two or more of these together, assume there’s a problem until someone qualified rules it out.
How to Prioritize What You Find
When you spot signs a WordPress site has been hacked, it’s tempting to start deleting things. Resist that urge. Removing files or users without a plan can destroy evidence and leave the real entry point untouched. Instead, sort what you’ve found by urgency.
Act immediately
- Any sign that personal information submitted through your forms may have been exposed or redirected
- Altered health guidance, contact details, or service information
- Redirects to scam, phishing, or malicious sites
- Browser or search engine security warnings
- Unknown administrator accounts
Act the same day
- Spam pages or links appearing in search results
- Unfamiliar plugins, themes, or files
- Reports of spam email coming from your domain
Investigate soon
- Unexplained slowdowns or brief outages
- Minor layout changes you can’t explain
While you’re sorting, take a few sensible first steps. Write down what you saw and when, with screenshots. Change passwords for WordPress administrators and your hosting account from a device you trust. Let your leadership know. If the site collects personal information, bring in your privacy or compliance lead early, since they’ll want to understand what happened before deciding on any next steps.
When to Bring In Professional Help
Some cleanup tasks are within reach for a confident staff member. Most real compromises are not. Hacks often leave behind hidden backdoors, which are small pieces of code that let attackers return even after the obvious damage is cleaned up. Removing visible spam while missing a backdoor usually means the problem returns within days.
It’s time to call in professionals when:
- You’ve confirmed more than one sign from the checklist
- Your site shows a security warning to visitors
- Your site handles personal information through forms or registrations
- You’ve already cleaned up once and the problem came back
- Nobody on your team is comfortable working with server files or databases
A thorough response typically includes finding how the attacker got in, removing malicious code and accounts, restoring clean files, patching outdated software, requesting removal from security blocklists, and putting monitoring in place so you’ll know quickly if anything happens again.
At Lookit, this is everyday work for our web security team. We protect WordPress sites with a firewall, malware scanning, intrusion detection, and 24/7 monitoring, so suspicious activity gets flagged before it turns into a public problem. We also use scheduled visual checks to catch unexpected layout or content changes. For organizations whose websites carry public health information, that early warning matters.
Frequently Asked Questions About Hacked WordPress Sites
How can I tell if my WordPress site has been hacked?
Look for unexpected redirects, spam in your search results, browser security warnings, unfamiliar admin users, and content changes you didn’t make. Check your site on a phone and from a Google search, since some hacks only appear in those situations. If you notice more than one of these signs WordPress site hacked checklists warn about, treat it as a likely compromise.
Why would hackers target a public health or nonprofit website?
Most attacks are automated and look for any site with outdated software or weak passwords, regardless of who owns it. Health and nonprofit sites can be especially appealing because they tend to have good reputations with search engines and visitors. Attackers borrow that trust to spread spam or scams.
Can a hacked WordPress site be fixed without losing content?
In most cases, yes. A careful cleanup removes malicious code while keeping your legitimate pages, posts, and media intact. Having recent, clean backups makes recovery faster and safer.
How do I keep my WordPress site from being hacked again?
Keep WordPress, plugins, and themes updated, and remove anything you no longer use. Use strong, unique passwords with two-factor authentication for every admin account, and limit how many people have administrator access. Ongoing security monitoring helps you catch problems early instead of hearing about them from your community.
Talk to Lookit About Web Security and Monitoring
Your website is part of how you serve the public, and it deserves the same care as any other critical resource. Whether you’re dealing with an active problem or want to make sure you never have to, our team has been protecting and managing WordPress sites in Brooklyn and beyond since 2004. If you’re seeing any of these warning signs, or want ongoing monitoring in place, get in touch with our team.
