Enter a URL. We fetch it via api/fetch-proxy.php and look for common signs of compromise in the HTML: obfuscated scripts, injected spam links and keywords, hidden iframes, and unexpected external scripts. This spots indicators, it is not a substitute for a full server-side malware scan.
Tick what you are seeing. The playbook below re-orders itself by urgency.
Who uses this and why
The scariest and most urgent case. Get an immediate indicator scan and a step-by-step plan to isolate, clean, and secure before more damage is done.
A "this site may be hacked" label tanks clicks. The playbook covers cleaning and requesting a review so the warning is lifted.
You need to act but do not know where to start. The triage orders the steps and points you at the host's scan log first.
No symptoms, but peace of mind. Run the indicator scan and follow the prevention steps to reduce your risk.
What a hacked WordPress site looks like
Compromises show up in recognisable ways: visitors redirected to spam or scam sites, a browser or Google warning, spammy pages appearing in search results for your domain (often pharma or essay-writing keywords), unknown admin users, files you did not create, a defaced page, a sudden slowdown, or your server sending spam email. Sometimes there is no visible symptom at all because the malware is cloaked, it serves malicious content only to search engines or first-time mobile visitors, so the owner sees a normal site while Google sees spam. That is why a front-end scan like the one here is an indicator, not a verdict.
The recovery order that actually works
Panic leads to mistakes, so the sequence matters. Back up first (you need a forensic copy and a way to compare files), take the site offline to stop serving malware, then scan server-side because that is where infections hide, in PHP files, wp-config, .htaccess, and the database, not just the HTML. Remove the infection or, faster and safer, restore from a known-clean backup, then reinstall core, themes, and plugins from official sources so you are not trusting tampered files. Only then rotate every credential and replace the wp-config security keys to log out all sessions. Finally, harden the site, because the single most common outcome of a rushed cleanup is reinfection through the same unclosed entry point, frequently a nulled plugin or an outdated component.
Triage buys time; full removal is specialist work
This gets you moving in the right order, but a thorough cleanup, finding every backdoor, confirming the database is clean, identifying and closing the entry point, and getting warnings lifted, is meticulous work where a missed backdoor means it all comes back. For a site that runs your business, that is not a place to guess.
Digital Success cleans and hardens hacked WordPress sites and puts monitoring in place so it does not recur. Get expert help recovering your site.
Frequently asked questions
How do I know if my WordPress site is hacked?
Is this malware checker free?
Why does a clean scan not mean my site is safe?
What is the first thing to do if my site is hacked?
How do I stop my site being hacked again?
Can Digital Success clean my hacked site?
This tool provides general, illustrative guidance for planning and does not guarantee results. The checklist is shown above so you can verify each item yourself. Last reviewed September 2026 by the Digital Success web & SEO team.
Hacked site? Get it cleaned properly
Triage stops the bleeding; complete removal and hardening keep it gone. Digital Success cleans, secures, and monitors hacked WordPress sites so the infection does not return. Get expert help now.
Get urgent cleanup helpWant proof first? See how we grow ecommerce and content sites in our case studies.