Signs Your WordPress Site Is Hacked: Redirects, Spam Users, Unknown Plugins, Safe Browsing & Host Suspensions

If you’re seeing weird redirects, strange users, unknown plugins, or antivirus warnings—your site is likely compromised. This guide lists the most common symptom-based problems site owners Google right before they call us. We explain what each sign means, why it happens, and how to fix it quickly. If you want hand-off cleanup with a guarantee, our WordPress Malware Removal Service is ready 24/7.

Quick rescue checklist (do this first)

Change cPanel/hosting, SFTP/SSH, and WordPress passwords (all admins) + rotate salts in wp-config.php.
Put the site in maintenance mode if it’s aggressively redirecting or serving malware.
Take a full backup (files + database) before you touch anything.
Enable a Web Application Firewall (WAF) at the edge (your CDN or plugin) to block active exploitation.
Scan files and database; compare against clean WordPress core checksums.
Remove backdoors, fix file permissions, and update core, themes, and plugins.

When in doubt, skip to: We’ll clean it for you.

1) Redirect Issues

My WordPress site redirects to spam sites when clicked from Google

Meaning: Conditional redirects are injected to trigger only when visitors come from search engines.

Fix fast: Check .htaccess, wp-includes, functions.php, and any MU-plugins for obfuscated or base64 code. Remove malicious redirect rules and harden the server.

WordPress redirecting users to pharmacy websites

Why does my website redirect to adult sites from search results

WordPress redirect hack fix casino gambling sites

My site redirects to fake virus warnings McAfee Norton

WordPress redirecting mobile users to spam sites

Website redirects to different sites but only from Google search

How to fix WordPress conditional redirect malware

My WordPress site redirects to scam prize pages

Website redirecting to phishing sites when clicked

WordPress redirect to malware detected by visitors

Site redirects to fake antivirus warning pages

Likely causes: Infected theme/plugin, malicious JS in header/footer, .htaccess rewrite rules, or database-injected payloads targeting referrers and mobile user agents.

How we fix: Find the redirect source (server rules, JS, PHP), clean payloads, remove backdoors, patch vulnerable components, and set WAF rules against known redirect kits.

2) Hidden or Unknown Admin Accounts/Users

Unknown admin user appeared in WordPress dashboard

WordPress hack created fake administrator account

How to remove unauthorized WordPress admin users

Found suspicious adminbackup user in WordPress

WordPress showing admin users I didn’t create

Strange email addresses in WordPress user accounts

WordPress backdoor admin account removal

How to delete unknown WordPress administrator

WordPress admin user with random email address

Unauthorized WordPress user with admin privileges

WordPress user list shows suspicious accounts

Meaning: Attackers escalated privileges to maintain access even after you “clean.”

Audit Users → All Users and delete unknown admins.
Check for role changes and rogue wp_users/wp_usermeta entries.
Rotate all passwords and revoke application passwords & REST API keys.
Look for user-creation backdoors in functions.php, mu-plugins, and custom plugins.

3) Unknown Themes/Plugins or Suspicious Code

WordPress plugin I didn’t install appeared

Found suspicious wp-compat plugin in WordPress

WordPress theme files contain unknown code

Suspicious PHP files in wp-content uploads folder

WordPress functions.php file has been modified

Unknown scripts in WordPress wp-includes folder

WordPress wp-config.php file contains malicious code

Suspicious files in WordPress root directory

WordPress core files have been modified

Found encoded base64 code in WordPress files

WordPress index.php file infected with spam code

Meaning: Malware often masquerades as “compatibility” or “performance” plugins, hides in uploads/ as .php, or drops backdoors into core.

Compare WordPress core with official checksums; replace anything altered.
Remove unauthorized plugins/themes; check autoload options for persistence.
Search codebase for base64_, gzinflate, str_rot13, assert, preg_replace with /e.
Tighten file permissions (644 files, 755 folders), disable direct file editing.

4) Antivirus/Security Warnings

McAfee warning my WordPress site has malware

Norton antivirus blocking my WordPress website

Avast detected malware on my WordPress site

ESET warning visitors about my website security

AVG antivirus flagging my WordPress site

Wordfence detected malware on WordPress site

Sucuri scanner found security issues

Google Safe Browsing warning on my WordPress site

Malwarebytes blocking my WordPress website

Chrome showing security warning for my site

Firefox blocked my WordPress site for malware

Meaning: Third-party blocklists or browser interstitials have flagged your domain.

Fix fast: Clean the infection thoroughly, then request reconsideration with each vendor (e.g., Safe Browsing). We include these delisting requests in our service.

5) Hosting/Server Warnings

WordPress hosting account suspended for malware

Web host detected malware on WordPress site

This account has been suspended WordPress fix

Hosting provider found spam scripts on my site

WordPress site disabled by hosting company

Server suspended WordPress site for security

cPanel account suspended malware detected

WordPress hosting suspension malware cleanup

Web host threatening to delete my WordPress site

Hosting company says my WordPress site is hacked

Meaning: The infection is affecting server resources or other tenants.

Fix fast: We work directly with your host, remove malicious files, stop spam processes, and supply a clean bill of health so your account is reactivated quickly.

6) Spammy Content or SEO Spam

Japanese keywords appearing in Google search results for my site

WordPress site showing pharmacy spam in search

Chinese characters on my WordPress website

Casino spam links on my WordPress site

Viagra Cialis spam appearing on my website

WordPress pharma hack Google search results

My site ranks for Japanese keywords I never added

Fake pharmaceutical pages on my WordPress site

WordPress showing spam casino content

Japanese text appearing in my website titles

Google showing my site with pharmacy keywords

Meaning: Database/templating injection creates hidden pages and cloaked content for bots, ruining rankings.

Fix fast: Clean database (posts, terms, options), remove cloaking code, regenerate sitemaps, submit reindexing in Search Console, and patch weak points to prevent reinfection.

7) Technical Signs (htaccess, emails, performance)

WordPress .htaccess file has been modified

My WordPress site is sending spam emails

WordPress website suddenly very slow

.htaccess file contains suspicious redirect code

WordPress sending bulk emails without permission

Website performance dropped after hack

WordPress .htaccess malware redirect fix

My domain is blacklisted for sending spam

WordPress site loading extremely slowly

Hosting provider says I’m sending spam emails

WordPress wp-admin very slow to load

.htaccess file contains unknown PHP code

Meaning: Server rules are hijacked, or your site is used for spamming/phishing or cryptomining; resources get maxed out.

Reset .htaccess to WordPress defaults; remove rogue AddHandler/RewriteRule.
Disable PHP execution in uploads/.
Check cron jobs and /tmp for miners or mailers; rotate SMTP/API keys.
Rate-limit login attempts and block XML-RPC abuse.

8) Additional Problem-Specific Queries

WordPress 404 errors on admin pages after hack

Likely cause: Core or rewrite tampering. Fix: Restore core files and permalinks.

Can’t access WordPress admin panel 403 error

Likely cause: WAF/.htaccess rule or file permissions. Fix: Correct permissions, review WAF, remove malicious rules.

Likely cause: Redirect hooks or replaced wp-login.php. Fix: Restore clean core; remove hooks.

My WordPress site shows blank white pages

Likely cause: Fatal errors from tampered PHP. Fix: Enable debugging, check error logs, restore affected files.

WordPress database infected with malware

Likely cause: Injected options/postmeta. Fix: Clean serialized payloads; secure DB creds; least-privileged DB user.

Google Search Console malware warnings

Fix: Clean thoroughly, fix sitemaps/URLs, submit for review.

WordPress site blacklisted by Google

Fix: Remove malware, fix cloaking/redirects, request delisting.

Visitors reporting popups on my WordPress site

Likely cause: Injected JS/adware from a plugin/theme or CDN resource. Fix: Remove payloads and blocklist domains.

WordPress contact form sending spam messages

Fix: ReCAPTCHA/Turnstile, honeypot, rate limits; clean mailer scripts.

My WordPress site is mining cryptocurrency

Fix: Kill processes, remove miners, rotate credentials, patch server.

WordPress RSS feed contains spam links

Fix: Clean content hooks and feed templates; purge caches.

Search engines not indexing my WordPress site

Likely cause: “Discourage indexing,” malicious robots.txt, or cloaking. Fix: Correct settings, remove cloaking, re-submit.

How we clean (and keep you clean)

Forensic scan of files + DB (catch redirect kits, spam payloads, backdoors).
Manual removal of malware (no half-measures, no “quarantine only”).
Patch & harden: update core/themes/plugins, least-privilege, disable file editing, lock down uploads/, set security headers, enable 2FA.
Delisting help: Safe Browsing, antivirus vendors, and host reactivation support.
Prevention plan: WAF rules, backups, monitoring, update policy, and incident playbook.

Need it done right now? Hire our WordPress Malware Removal Service.

DIY quick fixes (if you’re technical)

Replace WordPress core from a clean download (keep wp-config.php and /wp-content/).
Reinstall themes/plugins from trusted sources; remove anything unused.
Search & destroy common obfuscation patterns; scan uploads/ for .php.
Reset salts in wp-config.php and enforce 2FA for all admins.
Set file perms 644 and directories 755; owner should be the web user.
Block wp-login.php/xmlrpc.php by IP or at least rate-limit.
Add Content-Security-Policy to limit malicious JS injection.
Verify cron jobs and disable unknown scheduled tasks.

FAQ (ranked for common searches)

Why does my website redirect to adult sites from search results?

Cloaked redirects target search-engine referrers. Clean .htaccess, remove malicious JS/PHP, restore clean core, and harden to prevent reinfection.

My WordPress site redirects to fake virus warnings (McAfee/Norton).

That’s scareware. Remove the redirect kit and block its domains; then request delisting with vendors.

Found a WordPress admin user I didn’t create—what now?

Remove it, rotate all credentials, and hunt for user-creation backdoors in functions.php/MU-plugins.

Japanese keywords in Google results for my site—am I hacked?

Yes, likely SEO spam. Clean DB + templates, regenerate sitemaps, and request reindexing.

.htaccess contains unknown code—safe to delete?

Back it up, reset to WordPress defaults, and reapply only known-good rules.

On-page SEO extras

Primary intent: “WordPress hacked signs” + symptom-style queries (redirects, unknown admins, Japanese SEO spam, antivirus/hosting suspensions).
Internal CTA links: Repeated, descriptive anchor text pointing to WordPress Malware Removal Service.
Semantics: Use this page as the canonical “symptoms” hub; link out to deeper guides if you publish them later.

Suggested meta tags

Title: Signs Your WordPress Site Is Hacked: Redirects, Spam Users, Unknown Plugins, Safe Browsing & Host Suspensions

Meta description: Seeing redirects to spam, strange admin users, Japanese SEO keywords, or antivirus/host warnings? Learn the exact signs your WordPress site is hacked and how to fix it—or let our experts remove the malware fast.

Ready for a clean, safe site—today?

Stop chasing symptoms. We’ll remove the malware, close the holes, and help you get delisted and restored. 👉 Order WordPress Malware Removal

On this page