A frequently askedquestion is what are the signs that your WordPress website has beenhacked. There are a few ways to help you identify a hacking and inthis post, we will outline the most common ones.
Difficulty Logging In
The most common telltale sign is that you are not able to log into your site. It’s also highly likely that you have just forgotten your password, so it’s better to first try resetting it before making any assumptions. If that doesn’t work, then you have most likely been hacked.
Some hackers like to change passwords or remove users so that they can prevent you from accessing your website. Your user account could have been deleted, which is a clear sign of hacking.
Your site lookcompletely different
Another form ofhacking is when your homepage looks entirely different and has beenreplaced with a static page or isn’t using your theme.
You may not noticethe changes at first, as they may be subtle. Some random content maybe added on certain pages or links to inappropriate sites. If you seelinks that you did not add in your footer, and they are in a tinyfont size or hidden, you are probably hacked.
Before taking anymeasures, make sure you check with other admins or editors of yoursite if they have made any changes without consulting you.
Also, if your themeisn’t from an official source and you have just updated it, thiscould be the culprit.
Site isRe-directing
In some cases,hackers add links to spammy sites, which could be located anywhere.Deleting them does not always mean they will not come back.
In order to removeto problem entirely, you need to locate the backdoor used to add thedata into your website.
For more info aboutthis type of hacks, you can read our previous blog post here.
Browser and Search Engine Warnings
If your browserdisplays warnings that your website is compromised, this could beanother sign that you’ve been hacked. Another reason for this couldbe a faulty theme or plugin which you need to remove, or an issuewith your domain’s SSL.
Sometimes, when yougoogle your website, a warning is displayed then you’ve beenhacked. This most that google has detected
malicious code onyour site so it is alerting users about this before they access yoursite.
Unknown Scripts and files on your Server
In this case youneed to connect to your site using an FTP client. The most likelyplace you will find malicious files is the /wp-content/ folder ifyour site is wordpress, or, in the root directory if it’s not.
Such files areusually named like WordPress files so they are not easily noticed. Beadvised that deleting them does not guarantee the files won’treturn. We recommend you make an audit of your security. Of course,we can help so let us know ASAP.
Drop of website traffic
If you notice asudden drop in your website traffic, this is a likely sign your sitewas hacked.
A large number oftrojans and malware are designed to hijack your traffic and redirectit to other malicious websites. Some of them don’t redirect loggedin users which helps them to go unnoticed to quite some time.
Unusual Activity in Server Logs
Server logs areactually plain text files which are stored on your server. They keeprecords of errors on your server as well as your internet traffic. You can check thisfrom your hosting account cPanel dashboard, located under statistics.
The logs can providea better understanding of what’s going on with your website.
What to do if your website IS hacked?
First and foremost,don’t panic! Our Fixed team handles such cases on a daily basis andwill help you identify the reason and secure your website. Has your websiteever been a hacked? How did you deal with the issue? Share yourstories in the comments bellow, we would love to hear your thoughts!
