Signs that a site may have been hacked include:
- A Dangerous site or Deceptive site ahead warning in Chrome or another browser
- Visitors being redirected to spam, gambling or pharmacy sites, sometimes only on mobile or only when arriving from search results
- Pages, posts, files or administrator users you didn't create
- Strange search results for your site, or a security warning from Google Search Console
- Spam sent through your site's forms, or emails from your site that you didn't send
Contact support right away
If you notice any of these, contact support immediately with your domain and what you saw. A member of our team handles every possible hack personally: we check the site for malware, clean it up with you, and restore a clean backup where that's the best option.
What you can do now
- Change the passwords of every WordPress administrator, and of the email accounts those administrators use.
- Under Users in your dashboard, note any administrators you don't recognise and tell us about them.
- Don't enter login or payment details on pages of your site that you don't recognise.
Keeping your site safe
Most hacks come through outdated or abandoned plugins and themes, or weak passwords. WordPress itself is updated automatically, but you update your plugins and themes, so:
- Update plugins and themes promptly, and delete any you don't use.
- Only install plugins and themes from trusted sources, never "nulled" (pirated) copies.
- Use strong, unique passwords and turn on two-factor authentication.
- Give administrator access only to people who need it.