Is your WordPress site infected? How to tell and what to do

An infected website rarely looks infected. Whoever breaks in does not want to be noticed: the page keeps loading as usual while the server sends spam, shows spam pages to search engines or redirects some visitors to third-party sites. It often takes weeks for anyone to notice.

Signs your site has been compromised

• Google shows odd results for your domain: search site:yourdomain.com and look for pages in Japanese, about pharmaceuticals or casinos that you never created.
• Visitors arriving from a phone or from Google end up on another site, while you see nothing wrong when you visit directly.
• Google or the browser warns that "this site may be hacked", or Search Console sends you a security alert.
• There are administrator accounts you don't recognise, or plugins you never installed.
• Your provider tells you the site is sending spam, or the domain is on a blacklist and your emails stop arriving.
• A blank page, database errors, or the site has become very slow for no reason.

What you should do

• Back up the site and the database before touching anything. Deleting blindly can lose content and also the evidence of how they got in.
• Change every password: WordPress administrators, the database, FTP and your hosting control panel.
• Compare the files with the official ones. With WP-CLI, wp core verify-checksums and wp plugin verify-checksums --all show which core and plugin files have been modified.
• Look for PHP files where there shouldn't be any, especially in wp-content/uploads, and check the .htaccess file: it is a common hiding place for redirects.
• Update WordPress, the theme and the plugins, and remove any you don't use or that came from unofficial sources.
• Once it is clean, ask Google to review it from Search Console.

Deleting the file you found is not enough: if you don't close the door they came in through, they usually come back within days. The most common causes are an outdated plugin or theme, a leaked password or an old PHP version, as happened with the PHP2Shell vulnerability.

How we handle it at Intergrid

Websites with WebSentinel are checked every night from the server, with checks a compromised site cannot fake:

• Every WordPress and plugin file is compared with the official original.
• A search for malicious code, including code hidden inside files that look like images.
• A comparison between what a visitor sees and what Google receives, to catch hidden spam.
• Automatic clean-up when the diagnosis is clear. If there is any doubt, one of our technicians reviews it before anything is touched.
• Nothing is deleted: whatever is removed is kept in quarantine for six months, in case it needs to be restored.
• We email you, in your language, with what was found and what was done.

If your site is hosted elsewhere and you think it is infected, we can move it to Intergrid free of charge and check it before putting it live. We tell you what we found and what needs doing, with a no-obligation quote.