I think I was hacked

What you are seeing

Most compromised sites stay online, because the attacker wants your traffic and your server. The symptom tells you what kind of infection you are dealing with.

What you see	What it usually is
Google results for your site with Japanese or pharmacy titles, or This site may be hacked under your listing	SEO spam: thousands of generated pages or a cloaked spam layer shown only to search engines.
A red full-page warning: Deceptive site ahead or The site ahead contains malware	Google Safe Browsing has flagged the site. Search Console lists it under Security issues.
Visitors from Google or on phones land on a scam site, but you never see it	A conditional redirect that skips logged-in users and repeat visitors.
Admin users you did not create	A backdoor account, often created through a vulnerable plugin.
PHP files in wp-content/uploads, or files with random names in the site root	Web shells or backdoors.
Bounces you never sent, or a host notice about outgoing spam	A mailer script on the site or a compromised mailbox.
A suspension notice for malware or phishing	Your host’s scanner or an outside abuse report found it.
A fake Verify you are human box that tells visitors to press Win+R, or to paste a command into Terminal or PowerShell	A ClickFix overlay injected into the site to trick visitors into running malware. See fake CAPTCHA and ClickFix.

Confirm it in two minutes

1. Look at your site the way search engines see it.

curl -s -A 'Googlebot/2.1 (+http://www.google.com/bot.html)' https://example.com/ | grep -ioE 'viagra|cialis|casino|slot gacor|replica' | sort | uniq -c

Run it on your own computer, replacing example.com with your domain. -A sends the Googlebot user agent, which cloaked spam is set up to answer. Good: no output. Bad: spam words that do not appear when you view the page normally.

2. Look at it the way a phone user from Google sees it.

curl -sI -A 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148' -e 'https://www.google.com/' https://example.com/ | grep -iE '^(HTTP|location)'

Run it on your own computer. -e pretends you arrived from Google; -A pretends to be an iPhone. Good: HTTP/2 200 and no location line, or a location on your own domain. Bad: a location pointing at a domain you do not own.

3. Search Google for pages you did not write.

site:example.com

Type this into Google search. Scroll several pages. Titles in other languages or about products you do not sell mean spam pages exist or existed.

4. Find PHP files where none should be.

find wp-content/uploads -type f -name '*.php'

Run it in an SSH terminal inside the site’s folder (the one with wp-config.php). The uploads folder holds images and documents. Good: no output, or only an empty index.php placed by a plugin. Bad: any other PHP file.

5. Check plugin files against the official copies.

wp plugin verify-checksums --all

Run it in the same SSH terminal, in the site’s folder. --all checks every installed plugin against the files published on WordPress.org. Good: Verified for each one. Bad: File was added or Checksum does not match. Premium plugins not hosted on WordPress.org are reported as unverifiable, so check those against a fresh download.

Most likely causes, in order

These are the usual ways in. Knowing which one happened decides whether your cleanup holds.

1. An outdated or abandoned plugin or theme with a known vulnerability. Tell: the oldest malicious file’s timestamp lines up with POST requests in the access log to that plugin’s files, admin-ajax.php or a REST route. Fix: update or remove it; delete anything that no longer gets updates.
2. A stolen or reused admin password, with no 2FA. Tell: a successful POST /wp-login.php from an unfamiliar IP, followed by a plugin upload or a theme file edit. Fix: new unique passwords and 2FA for every admin.
3. A nulled (pirated) premium plugin or theme. Tell: it came from an unofficial download site, and obfuscated code such as eval(base64_decode( sits inside it from the day it was installed. Fix: delete it and install a licensed copy.
4. Cross-contamination from another site in the same hosting account. Tell: infected files in several site folders with similar timestamps, often spreading from an old forgotten install. Fix: clean every site in the account at once, or the clean one gets reinfected.
5. Leaked SFTP or hosting panel credentials. Tell: files changed with no matching web requests in the access log, and entries in the FTP log. Information-stealing malware on a PC that saves passwords is a common source. Fix: scan the computer, then change every hosting credential.
6. Leftover tools in the web root. Tell: old backup archives, database admin scripts, phpinfo files or migration installer scripts reachable by URL. Fix: delete them and keep backups outside the public folder.

What it usually is not

• "The host got hacked." Server-level compromises happen but are rare. The way in is almost always the site or a password.
• "I see nothing wrong, so it is fine." Conditional malware hides from logged-in users, repeat visitors and your office IP. Use the checks above.
• "The security scanner says clean." File scanners miss code stored in the database and anything the scanner has no signature for.
• Your own device. If only your browser shows pop-ups or redirects on every site you visit, check your browser extensions before blaming the website.

What to send your host

• The list of suspicious files with full paths and modified dates.
• When you first noticed, in UTC, and when the oldest bad file was changed.
• A request for raw access logs and FTP logs covering that window. Hosts keep logs only for a limited time, so ask on day one.
• Any malware or abuse notice ID they sent you.
• Admin usernames you did not create, and the IPs in the logs.
• A request to check other sites and mailboxes on the same account.
• Confirmation that you changed all credentials, so they can lift a suspension.