Is My WordPress Site Hacked? 7 Warning Signs for Small Businesses

“Is my WordPress site hacked?” is rarely answered by a dramatic black screen. For most small businesses in the US and Canada the first hint is small and easy to dismiss: a customer says your link sent them somewhere strange, the host emails about suspicious files, or the phone goes quiet in a week that should be busy.

The sooner you notice, the less you lose in leads, data and customer trust. The first rule is simple: stay calm, and do not click through everything at once.

Three things worth knowing before you start

Seven signs of a hacked WordPress site

• Redirects to places you did not choose. Visitors end up on a casino, a fake store or a blank page. It is often inconsistent: only on phones, only when they arrive from Google, or only the first time they visit. You may never see it yourself while logged in.
• A browser or Google warning. A red “Deceptive site ahead” screen in Chrome, a “this site may be hacked” label in search results or a security issue in Search Console will cost you trust and traffic quickly.
• Pages you never created. Attackers can publish thousands of junk pages (pharmacy offers, crypto, fake brand products) that never appear in your menu. Search Google for site:yourdomain.com and scroll through what comes back.
• New or changed administrators. Open Users in WordPress. An admin you do not recognize, an odd email address or a role that was changed without you is a red flag.
• Files that changed on their own. PHP files in wp-content/uploads, in the theme or in plugins, especially with dates from days when nobody worked on the site.
• A site that suddenly got slow. Slowness alone proves nothing, but injected code, spam pages and bots hammering the login page all add load to the server.
• A note from your host. “Infected files found”, “account restricted” or “malware detected” deserve attention. They do not mean you should start deleting everything in sight.

What not to do in the first hour

Hurried moves can destroy evidence, break the site or make recovery harder. Do not delete random files without a backup. Do not update everything at once with no copy to return to. Do not switch off every plugin with no plan, install three security plugins at the same time, swap themes on a hunch or edit the database by hand when you are not sure what you are looking at.

Safe first steps

If the site still loads, take a copy of the files and the database. Check the user list and Search Console. Save every email from your host. Write down when you first noticed something wrong; that date helps a lot later. From a computer you trust, change the passwords for hosting, WordPress and the email account tied to the site. And do not give access to anyone who contacted you through an ad or a cold message.

A proper cleanup goes well beyond deleting one file. Someone has to find the malicious code, check the theme, plugins, uploads and database, update whatever was vulnerable, replace passwords and put basic protection in place. If only the visible problem is removed, the way in stays open and the hack comes back.

A hypothetical example from a small business

Say a dental office in Calgary sees its Google listing click-throughs dropping and a patient mentions that the site “went to some pharmacy page” on her phone. Nothing looks wrong on the office computer. In the WordPress admin there is an extra user with an email address nobody recognizes, and the host has sent a warning that went to an old inbox. These are not three separate problems. They are one, seen from three angles, and the right move is a copy first, diagnosis second, cleanup third.

When it makes sense to call for help

A hack usually becomes costly not because of the cleanup itself but because of what builds around it: ads pointing at a flagged page, appointment requests that stop, Google lowering its trust in the domain, and a few stressful evenings with no clean backup to fall back on. For contractors, clinics and shops that rely on “near me” searches, a few days of warnings in search results can hurt in the middle of a busy season.

If you suspect your site is already compromised, read about WordPress malware removal; cleanups start at $100, in US dollars. To avoid a repeat, look at backups and website recovery.

If you see redirects, a Google warning, emails from your host or unfamiliar administrators, do not experiment for too long. I can take a backup, trace the malicious activity, clean the files and database and set up regular monitoring afterward. If you prefer to try yourself, the safe checks above are a fair place to start. If your time matters more, hand it over and get back to running the business.