How do I know if my WordPress site has been hacked?
The clearest signs: Google or your customers' antivirus flags the site as dangerous, your host suspends it, admin users or plugins appear that nobody installed, or the site redirects to strange pages. If you see any of these, treat the site as compromised until you can prove otherwise.
WordPress's official hacked-site FAQ adds a few more: the site is used to attack others, sends spam from your server or is visibly defaced. In practice, what we see most at companies is quieter:
- Redirects that only happen on mobile or from Google results, not when you type the address. That's why owners take weeks to notice.
- New pages on your domain selling products or pharmacy items you don't sell, showing up in Search Console.
- «.php» files inside «wp-content/uploads», where only images and documents should live.
- An administrator or editor nobody recognizes, or your own account no longer working.
- A modified «.htaccess», «index.php» or «functions.php» that nobody on the team touched.
- Your email starts landing in spam because the server sent junk mail.
How do attackers get into WordPress?
Rarely through an up-to-date WordPress core. They get in through vulnerable plugins and themes, stolen or reused passwords and servers running old PHP. Three real examples from the last few weeks:
- Bricksforge (CVE-2026-85097). A plugin for the Bricks builder let anyone upload files without logging in and run code on the server. Patchstack saw the first attacks on October 7, 2026. Version 3.1.8.9 and earlier are affected, 3.1.8.10 fixes it, and the typical trace is «login_admin_*.php» files in the uploads folders. SecurityWeek reported that the attacks look automated.
- Fake backdoor plugins. On October 18 and 19 someone holding valid UpdraftCentral keys installed backdoored plugins on connected sites. Patchstack counted 99 different names, such as «Site Health Cache», dressed up as maintenance tools. It wasn't a bug in UpdraftPlus code: the commands were signed with real keys.
- WordPress core (CVE-2026-87902). A critical flaw fixed on September 22 that CISA added on September 25 to its Known Exploited Vulnerabilities catalog. The fixed releases are listed in WordPress's advisory; sites with automatic security updates got it on their own.
Your host's PHP version counts too. A PHP flaw like PHP2Shell affects every WordPress site on that server, even if WordPress and its plugins are current. WordPress recommends PHP 8.3 or later and warns that the older versions it still runs on no longer get fixes. If your host is still on PHP 7.4 or 8.1, read how to upgrade PHP without breaking the site.
What should I do if my website was hacked?
Order matters. Delete first and you lose the evidence of how they got in, so they come back the same way. Restore without changing passwords and they come back with the same keys. These are the steps, based on WordPress's official guide and on what has worked for us:
- Document. Write down what you saw, when, and what changed beforehand: a new plugin, a theme edit, access given to a vendor. Take screenshots.
- Preserve evidence. Make a full copy of the infected site (files and database) and the server access logs, and store it off the server. It's your reference for what happened, not something to restore.
- Isolate. Put the site in maintenance mode or restrict access by IP while you work. Tell your host: on shared hosting the problem can reach other sites.
- Rotate every credential. Passwords for every WordPress user, the hosting panel, FTP or SFTP, SSH and the database. Generate new keys in «wp-config.php» to end open sessions. Do it from a clean computer: WordPress notes that many infections start on the owner's machine.
- Review users. Remove administrators and editors nobody recognizes. In the UpdraftCentral campaign, the backdoor created an editor with admin capabilities.
- Restore from a clean backup taken before the attack, if you have one. If not, replace «wp-admin» and «wp-includes» with an official copy of the same version, and reinstall plugins and themes from their official source, not with the dashboard's reinstall button.
- Hunt for leftovers: «.php» files in uploads, unknown plugins, changes to «.htaccess», «index.php», «header.php», «footer.php» and «functions.php», and odd scheduled tasks.
- Update everything: WordPress, every plugin and every theme. Delete what you don't use. Check the server's PHP version.
- Change the passwords again, now that the site is clean. The official guide is explicit: the ones you changed when you found the hack may have been exposed during cleanup.
- Request a Google review. If Search Console flagged the site, ask for a review once it's clean, and check whether your domain landed on email spam lists.
wp core verify-checksums # core files that don't match the official release wp plugin verify-checksums --all # same for plugins from the official directory wp user list --role=administrator # current administrators wp plugin list # installed plugins and their status find wp-content/uploads -name '*.php' # PHP code where there shouldn't be any wp option get updraft_central_localkeys # any output means active UpdraftCentral keys
How do I keep my WordPress site from getting hacked again?
Nobody can promise a site will never be attacked. What you can do is close the most-used doors and find out fast when something changes. WordPress's hardening guide is the baseline:
- Automatic WordPress updates, plus a weekly review of plugins and themes. Delete what you don't use: a deactivated plugin is still code on your server.
- Plugins only from the official directory or well-known vendors. No free «premium» copies from sketchy sites.
- Long, unique passwords and two-factor authentication for every administrator.
- File permissions: folders at 755, files at 644 and «wp-config.php» at 400 or 440.
- «define( 'DISALLOW_FILE_EDIT', true );» in «wp-config.php» so nobody can edit PHP from the dashboard.
- Automatic backups of files and database, stored off the server, with several restore points, and tested. A backup you've never restored isn't a backup.
- A supported PHP version on the host, with the version hidden from response headers.
- Review which outside services hold keys or access to your site and remove the ones you no longer use.
To hear about flaws like Bricksforge in time, we publish the ones that matter each week in security alerts. And if you want to know today whether your server advertises a vulnerable PHP version, the free check takes seconds.
Passive check: it only reads your homepage's public response, like a browser. Use it only on domains you own or manage.
Check my site for freeFrequently asked questions
How can I tell if my website has malware?
The most common signs are Google or antivirus warnings, redirects to other sites, users or plugins nobody installed and PHP files in the uploads folder. With WP-CLI, «wp core verify-checksums» tells you whether core files changed.
What's the first thing to do if my WordPress site is hacked?
Document what you see, save a copy of the infected site and its logs off the server, and isolate the site. Then rotate every credential and clean up. Delete first and you lose the trail of how they got in.
Is restoring a backup enough?
No. If you restore without changing passwords or closing the hole they used, the attacker comes back. The backup has to predate the attack, and after restoring you still need to update everything and rotate credentials.
Will a security plugin stop my site from being hacked?
It helps detect and block known attacks, but it doesn't replace keeping everything updated, unique passwords, two-factor authentication and tested backups. It also can't help if the flaw is in the server's PHP version.
Does the PHP version affect WordPress security?
Yes. A PHP flaw affects every site on the server even if WordPress is current. WordPress recommends PHP 8.3 or later.
What is the Bricksforge vulnerability?
It's CVE-2026-85097, a critical flaw in the Bricksforge plugin that lets attackers upload files and run code without logging in. It has been exploited since October 7, 2026 and is fixed by updating to version 3.1.8.10 or later.
Why does my hacked site only redirect on mobile?
A lot of malicious code only fires for certain visitors, such as people arriving from Google or on a phone, so the owner doesn't notice. Test from another device and look for changes in .htaccess and the theme files.
Sources
- WordPress.org: FAQ My site was hacked
- WordPress Developer: Hardening WordPress
- WordPress.org: requisitos (PHP recomendado)
- Patchstack: critical exploited flaw in Bricksforge (CVE-2026-85097)
- SecurityWeek: Bricksforge WordPress plugin vulnerability exploited in the wild
- Patchstack: UpdraftCentral keys used to install backdoors
- WordPress: GHSA-7hp8-65ch-5whp (CVE-2026-87902)
- CISA: Known Exploited Vulnerabilities Catalog
Written by Samuel Hinojosa and the wITS security team · Updated Oct 25, 2026 · Markdown
