A symptom is a starting point
Slow pages, a login problem or an unusual traffic pattern can have ordinary explanations. None proves a compromise by itself. Look for unauthorised changes and supporting evidence, and note when each symptom first appeared.
1. Traffic changes you cannot explain
Review unexpected spikes or drops alongside campaigns, tracking changes and outages. Analytics and server logs can help distinguish a normal change from suspicious activity.
2. Unfamiliar administrators
A new administrator or unexpected permission change needs checking. Confirm it with the people who manage the site and preserve the account details and relevant logs for investigation.
3. Redirects or pop-ups you did not add
Record the page, device and route that triggered the behaviour. Some redirects appear only to particular visitors. Avoid following suspicious destinations while gathering the details.
4. Browser or search security warnings
Read the warning and check the information available through your hosting provider or search-management tools. A warning needs investigation; bypassing it does not resolve the cause.
5. Content you did not authorise
Unexpected links, changed text or a replaced homepage may indicate unauthorised access. Save examples and compare them with known content before making changes.
6. Files that do not belong
Unexpected executable files, altered configuration or unexplained code changes warrant review. A filename alone is not enough to decide whether something is malicious. Ask someone familiar with the installation to assess it.
7. Unusual resource use
High CPU use or a sudden slowdown can come from ordinary application faults as well as abuse. Compare the timing with recent changes, background tasks and hosting logs.
8. Email activity you cannot account for
Unexpected messages, delivery failures or sending alerts can point to an abused account or website. They can also involve forged senders. Check the sending evidence rather than assuming every bounce came from your server.
9. Lost access to administration
A changed account, failed login or unexpected access restriction needs checking against password resets, provider controls and recent maintenance. Use a known support route to recover access.
10. Unexpected theme or plugin changes
Compare changes with legitimate updates and the work of your developers. Unexplained modifications or newly installed components should become part of the investigation.
What to do next
Write down what happened, when you noticed it and what changed recently. Contact your host or technical support and preserve relevant evidence before a clean-up. If visitors are being exposed to harmful content, ask your provider to help contain access.
Follow a recovery plan that addresses the cause as well as the visible symptom. Our WordPress clean-up guide explains the wider process.
Further reading: WordPress.org: My site was hacked ↗
Get help with your website
Tell us about your website and what you need. We can work through the options with you.
Explore the service ↗