WordPress Malware Checklist: 7 Signs Your Site Is Infected (And How to Confirm in 2 Minutes)

Why WordPress Malware Is Designed to Hide From You

Here's the thing about modern WordPress malware: it's not designed to crash your site. That would be counterproductive. A crashed site gets fixed immediately. Malware that runs invisibly for six months earns the attacker vastly more value.

The technique is called cloaking. The malicious code checks whether the visitor looks like a site owner (admin cookie, direct browser visit, logged-in session) or looks like a search engine crawler or search-referred visitor. If you look like the owner, you get the normal site. Everyone else gets the malicious version.

This is why the warning signs below often don't come from looking at your own site — they come from what Google, visitors, and your hosting company are reporting back to you.

---

Sign 1: Visitors Report Redirects You Can't Reproduce

Visitors — especially on mobile — are getting redirected to spam, phishing, or adult sites. When you try to reproduce it on your computer, everything looks fine.

This is a classic conditional redirect: the malware checks if the visitor is on mobile, came from a search engine, or hasn't visited before (no cookie), then redirects them.

// The redirection logic typically looks like this:
if (strpos($_SERVER['HTTP_USER_AGENT'] ?? '', 'Mobile') !== false
    && !isset($_COOKIE['seen_redirect'])
    && strpos($_SERVER['HTTP_REFERER'] ?? '', 'google') !== false
) {
    setcookie('seen_redirect', '1', time() + 86400);
    header('Location: https://pharma-spam-site.com');
    exit;
}

The cookie ensures repeat visitors (including if you check from an incognito window without clearing cookies first) don't get redirected.

What to do: Run an external scan at wp-scan.org/malware-check with mobile user-agent simulation enabled.

---

Sign 2: Google Search Console Alerts

Go to Google Search Console → Security & Manual Actions → Security Issues.

Alerts here mean Google's crawlers have already detected the infection. Common warnings:

• •"Hacked content" — spam or malicious pages indexed
• •"Malware" — actively harmful code detected on your pages
• •"Unwanted software" — files or downloads that violate Google's policies

If you haven't set up Search Console for your site, do it now — it's free and often provides the earliest warning of a compromise.

Time sensitivity: Once Google flags your site, you typically have 72 hours to clean it before rankings begin to drop significantly.

---

Sign 3: Your Host Suspended the Account

Hosting companies monitor outbound email and network traffic. If your site is:

• •Sending spam email to thousands of addresses


• •Participating in DDoS attacks


• •Serving known malware files

...they will suspend it. Usually with an email titled something like "Your account has been suspended for Abuse / Malicious Activity."

A suspension is alarming but it's actually useful information — it often means the compromise is a file-level infection that your host's server-side scanner caught. Check the suspension email carefully; it often names the specific infected file.

---

Sign 4: A Google Search Reveals Spam Pages

Search for your domain on Google:

site:yourdomain.com

Scroll through results. You're looking for:

• •Pages with titles in Japanese, Chinese, or other languages you don't publish in (a classic indicator of Japanese SEO spam — one of the most common WordPress hacks)
• •Pages with pharmaceutical, gambling, or adult content in titles or descriptions
• •Pages with dates that are in the past or future — fake dates are a spam indexing technique
• •Hundreds of new pages you didn't create

If Google shows spam pages, the attacker has been using your site to build SEO value for their spam domains. The damage is already compounding. Cleaning quickly limits how much you'll need to recover.

---

Sign 5: Unknown Admin Users

Go to WordPress Admin → Users → All Users.

Any account you don't recognise — especially administrator-level accounts — is a backdoor. Attackers create these to maintain persistent access even if you find and remove their injected code.

Common backdoor usernames: wp_support_helper, admin2, wpadmin, system_user, support_agent, random-looking strings like xk9m3a.

Delete any you don't recognise. Then immediately:

1. 1Change the passwords on every remaining admin account


2. 2Regenerate WordPress security keys/salts (to invalidate all active sessions)


3. 3Run the external scan to check for residual infection

---

Sign 6: Sudden Unexplained Traffic Drop

A sharp drop in organic search traffic — particularly a drop of 30–70% over 1–2 weeks — is often the first measurable sign of an infection that's been running for a while.

What's happening:

1. 1Google's crawler has been seeing spam content on your pages


2. 2Google quietly penalises or de-indexes the affected pages


3. 3Your organic traffic falls as those pages disappear from results

By the time you notice this in Google Analytics, the infection has typically been running for 4–12 weeks. The SEO recovery takes 3–6 months after cleanup.

Monthly external scanning catches the infection before Google flags it — before the traffic drop happens.

---

Sign 7: Browser Antivirus Warnings

If your browser (or a visitor's browser) shows a warning when loading your site — "This site may harm your computer" or "Deceptive site ahead" — your domain has been added to a threat intelligence blacklist.

Blacklists used by browsers include:

• •Google Safe Browsing (affects Chrome, Firefox, Safari)


• •Microsoft SmartScreen (affects Edge)


• •McAfee WebAdvisor / Norton Safe Web

Getting delisted after cleanup requires a formal review submission to each blacklist. Google's is at safebrowsing.google.com/safebrowsing/report_error/. Processing typically takes 1–3 business days.

The wp-scan.org/malware-check scan checks your domain against major blacklists automatically.

---

How to Confirm in 2 Minutes

Whether you've spotted one of the seven signs or you just want to rule it out, the fastest confirmation is an external scan:

wp-scan.org/malware-check

Enter your URL. In under 2 minutes you get:

• •Malware detection results (with specific indicators found)


• •Blacklist check (Google Safe Browsing, Norton, McAfee, Spamhaus)


• •Security header assessment (6 headers checked)


• •XML-RPC exposure status


• •User enumeration vulnerability check


• •WordPress version and plugin CVE exposure


• •Dangerous file exposure (.env, webshells, debug logs)

This is the only check that works when malware is cloaked — because it scans from outside your server, exactly the way an attacker or Google would.

---

Next Steps Based on What You Found

Clean bill of health: Schedule a monthly reminder to re-scan. Proactive scanning is how you stay clean.

Spam links / redirects detected: You have an active infection. Follow the emergency response guide.

Blacklisted: After cleanup, submit reconsideration requests to Google Safe Browsing and any other blacklists flagged in the scan results. Include the scan report as documentation that the issue has been resolved.

Outdated plugin with known CVE: Update immediately. The scan report includes the specific plugin, version, and CVE so you know exactly what to address.

→ Run your free scan at wp-scan.org/malware-check

Free external scan — 22 checks, instant report. No plugin, no account.

Run Free Scan → wp-scan.org/malware-check

Tags: wordpress malware malware symptoms wordpress infected wordpress security check malware detection wordpress hacked signs

📬 Enjoyed this article?

Get the next one in your inbox — free WordPress security guides, weekly.

Subscribe