Is My WordPress Site Hacked? Complete 100% Check Guide – Detect Hidden Redirects, Malicious Injections & Security Compromises

Is my WordPress site hacked?

Check whether my WordPress website is hacked or has malicious injections.

How to check your WordPress website security is compromised?

Is My WordPress Site Hacked? 100% Check (8-Step Method)

How to Check If Your WordPress Website Is Hacked (Hidden Redirects)

WordPress Hacked? Detect Malware & Redirects in 8 Easy Steps

Is Your WordPress Site Compromised? Full Security Check Guide

How to Know If WordPress Is Hacked (Even When It Looks Fine)

WordPress Malware Check: Find Hidden Injections Fast (2026)

Detect WordPress Redirect Hacks in 8 Steps (100% Method)

These are the exact questions thousands of website owners type into Google and YouTube every single day. The frustrating part is that modern WordPress hacks are designed to stay invisible. Your site may look completely normal when you visit it, yet it can still be redirecting real visitors to spam, pharmacy, gambling, or phishing pages.

This detailed guide gives you a complete, practical, and professional method to check whether your WordPress website is hacked or security-compromised — even when there is no obvious sign of injection or malfunction.

Why Most Site Owners Miss the Hack

Attackers rarely break the entire site. Instead, they use conditional redirects that only activate under specific conditions:

Mobile devices only
First-time visitors only
Traffic coming from Google or other search engines
Visitors who are not logged into WordPress admin

Because you (the owner) usually visit from a desktop while logged in, you never see the problem. Customers and search engines do.

The Complete 8-Step WordPress Hack Detection Meth

Step 1: Reproduce the Redirect Externally

The most important test is to see what a normal visitor experiences.

Test with an iPhone user-agent:

curl -I -L -A "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X)" https://yoursite.com

Test with a desktop Chrome user-agent:

curl -I -L -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" https://yoursite.com

Test with Googlebot + Google referrer (very important):

curl -sI -A "Googlebot" -e "https://www.google.com/" https://yoursite.com

Mobile + Google referrer combination:

curl -sI -A "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X)" -e "https://www.google.com/" https://yoursite.com

What to look for:
If you see a Location: header pointing to an unknown domain, or any 301/302 redirect that is not supposed to happen, the site is almost certainly compromised.

Also open the site in:

Incognito/private window
Mobile phone using cellular data (not the same Wi-Fi)
After clicking from a Google search result

Step 2: Run External Online Scanners

These tools see the site the same way Google and visitors see it:

Sucuri SiteCheck → sitecheck.sucuri.net
VirusTotal URL scan
Google Safe Browsing / Transparency Report
Google Search Console → Security Issues

Also search Google for:

site:yoursite.com

Look carefully for spam pages, Japanese or Chinese characters, pharmacy, casino, or adult content you never created. This catches SEO spam cloaking.

Step 3: Inspect with Browser Developer Tools

Open the homepage
Press F12 (or right-click → Inspect)
Go to the Network tab and reload
Watch for unexpected external domains or scripts
View Page Source and search for:
- eval(
- base64
- window.location
- document.write
- strange <script> tags
- hidden iframes

Step 4: Check WordPress Admin & Users

Go to Users → All Users
Look for any Administrator accounts you did not create
Some malware hides users from the dashboard. Check the database directly:

SELECT * FROM wp_users;

Also review:

Installed plugins and themes you don’t recognize
Scheduled tasks (install the free plugin WP Crontrol)

Step 5: File-Level Inspection (Most Critical)

Connect via FTP, SFTP, or your hosting File Manager and check these high-risk locations:

1. .htaccess (root and all subfolders)
A clean WordPress .htaccess is short. Look for extra rules, especially:

RewriteCond %{HTTP_REFERER}
RewriteCond %{HTTP_USER_AGENT}
RewriteRule

Any rule that redirects based on Google referrer or mobile user-agent is highly suspicious.

2. wp-config.php
Check the very top and bottom of the file for code containing:

eval(
base64_decode(
gzinflate(
str_rot13(

3. Active theme functions.php
Look for unexpected add_action hooks or obfuscated code.

4. wp-content/mu-plugins/
Any PHP file here loads automatically and cannot be deactivated from the dashboard.

5. wp-content/uploads/
There should be zero .php files. Any PHP file inside uploads is almost always a backdoor.

Useful search commands (SSH):

grep -rnw './' -e 'eval('
grep -rnw './' -e 'base64_decode'
grep -rnw './' -e 'gzinflate'
grep -rnw './' -e 'str_rot13'

Also check for PHP files in uploads:

find wp-content/uploads -name "*.php"

Step 6: Database Checks

Using phpMyAdmin or WP-CLI, search for injected code:

-- Check site URL options
SELECT option_name, option_value FROM wp_options 
WHERE option_name IN ('siteurl', 'home');

-- Search for malicious code in options
SELECT option_name FROM wp_options 
WHERE option_value LIKE '%base64_decode%' 
OR option_value LIKE '%eval(%' 
OR option_value LIKE '%gzinflate%';

-- Search posts for scripts
SELECT ID, post_title FROM wp_posts 
WHERE post_content LIKE '%<script%' 
OR post_content LIKE '%window.location%';

Step 7: Run a Full Security Plugin Scan

Install and run a complete scan with:

Wordfence Security (recommended)
MalCare
Sucuri Security

These plugins compare core, theme, and plugin files against clean originals and detect known malware signatures that external scanners often miss.

Step 8: Additional Verification Checks

Check Google Search Console for security issues and strange indexed pages
Review server access logs for unusual activity
Look at recently modified files (especially core WordPress files)
Test the site from multiple devices and networks
Check for unauthorized outbound emails

What the Results Mean

Clean responses on all curl tests + no unknown users + clean files = your site is currently safe
Any unexpected redirect, unknown admin, PHP file in uploads, or obfuscated code = the site is compromised and needs immediate cleanup

What To Do If You Confirm a Hack

Take a full backup of files + database first
Put the site in maintenance mode if possible
Clean or restore infected files
Change all passwords (WordPress, hosting, FTP, database)
Update WordPress core, themes, and plugins
Remove unused themes and plugins
Rotate security keys/salts in wp-config.php
Re-scan thoroughly
Request a Google Safe Browsing review if the site was flagged

Modern WordPress hacks are silent by design. The only reliable way to know if your site is compromised is to actively check using the methods above — especially the conditional redirect tests with different user-agents and referrers.

Bookmark this guide and run the full 8-step check at least once every month, or immediately if you notice traffic drops, strange Google results, or visitor complaints.

Stay safe.

Welcome

Is My WordPress Site Hacked? Complete 100% Check Guide – Detect Hidden Redirects, Malicious Injections & Security Compromises