A WordPress hack is any unauthorised access to your site’s admin area, file system, or database. Most are automated rather than personal. Bots that scan the public web for vulnerable plugins account for the overwhelming majority of compromises. The damage ranges from hidden spam links injected into your footer, through redirect attacks, to customer card details being skimmed at checkout, to full ransomware lockouts.
The most important thing to understand is that most hacked WordPress sites look completely normal to their owners. The homepage loads. The contact form works. Recent blog posts appear where they should. What the owner doesn’t see is that hackers have used the site to build hundreds or thousands of hidden pages and external links pointing to online casinos, counterfeit pharmacy stores, replica luxury goods sites, or essay-writing services. The hack isn’t designed to break the site. It’s designed to use the site’s domain authority and search visibility to boost the rankings of someone else’s content. By the time anyone notices, those links have already been indexed by Google and the damage to organic search performance is well underway.
The scale of the problem has shifted noticeably over the past two years. Patchstack, the vulnerability intelligence company that coordinates roughly two-thirds of all named WordPress disclosures, logged 7,966 new vulnerabilities across the WordPress ecosystem in 2024. That was a 34 per cent jump on 2023. The 2025 total climbed past 11,000. Of those, 96 per cent sat in plugins and 4 per cent in themes. The WordPress core itself accounted for seven vulnerabilities the entire year, none serious enough to pose a meaningful threat to ordinary sites.
That distinction matters. The platform isn’t broken. The ecosystem around it is sprawling, third-party, and uneven, and that’s where almost every hack starts.
This guide covers what a WordPress hack actually is, how attacks unfold, the warning signs most owners miss, what proper recovery looks like, and the prevention habits that genuinely reduce risk.
What “WordPress Hacked” Actually Means
The motive behind a WordPress compromise varies. Some attackers want your traffic, redirecting visitors to scam pages, affiliate-fraud destinations, or fake antivirus pop-ups. Some want your server’s CPU to mine cryptocurrency. Some want your customer list, your stored payment details, or the legitimacy of your domain to host phishing pages. A growing share want all three.
The single most common goal in 2025 and 2026, however, is search ranking manipulation. Compromised sites are used as link farms. The attacker injects hidden pages and outbound links pointing to online casinos (especially overseas-licensed sites targeting Australian punters), Indian and Pakistani essay-writing services, knock-off luxury watch and handbag retailers, counterfeit Viagra and Cialis stores, and increasingly, sports betting sites and unlicensed crypto exchanges. The injected pages are usually invisible to logged-in administrators. They’re served only to search engines and to visitors arriving from specific search queries. From the dashboard, nothing looks wrong. From Google’s perspective, your site is now endorsing thousands of pages it never agreed to.
The specific damage usually falls into one of a few categories: stolen user data, malware served to your visitors, your hosting account turned into a spam relay, or your search rankings hijacked to push the kind of content described above. The site keeps loading. From the outside, to a casual viewer, it can look fine. That’s part of why the average breach goes undetected for so long. The attacker has every incentive to stay quiet.
A useful framing: a hacked WordPress site is rarely “destroyed”. It’s repurposed. Your domain, your reputation, your hosting resources, and your audience now belong, at least temporarily, to someone else.
How WordPress Hacks Actually Unfold
Most agencies skip the technical anatomy when they talk to clients, which is a mistake. Understanding the sequence makes prevention obvious in a way that abstract advice never does. Almost every WordPress compromise follows the same five-stage pattern.
Stage one: reconnaissance. Bots crawl the public internet around the clock, fingerprinting WordPress installations by their telltale signatures, including default /wp-login.php paths, version numbers in meta tags, and plugin slugs visible in the page source. Wordfence, the most widely deployed WordPress security plugin, blocks roughly 55 million exploit attempts and 6.4 billion brute-force login attempts every month across its monitored network. That’s the steady-state baseline, not a crisis spike. The bots aren’t picking your site for any reason connected to your business. They’re picking every site that looks like a standard WordPress install and hasn’t been hardened.
Stage two: exploitation. Once a bot finds a fingerprint that matches a known unpatched vulnerability, it tries the exploit. The Patchstack 2025 mid-year data shows that 57 per cent of WordPress vulnerabilities required no authentication at all to exploit. No stolen credentials, no insider access, just a vulnerable plugin sitting on a publicly reachable site. The median time from public disclosure of a serious vulnerability to mass exploitation is now about five hours. Forty-six per cent of vulnerabilities have no patch available when they’re first disclosed.
Stage three: payload delivery. The attacker uploads a “web shell”, a small PHP file that lets them execute commands on the server through a browser. From there they can read your database, modify files, and create new admin accounts at will.
Stage four: persistence. This is where amateur cleanups go wrong. Hackers don’t rely on a single backdoor. They scatter several, often modifying core WordPress files like wp-config.php, hiding rogue admin users, scheduling cron jobs to re-infect cleaned files, and tampering with the security plugin itself to mask their presence. WeWatchYourWebsite, in research published through Patchstack, found that in 14 per cent of malware infections on sites running Wordfence, the malware had specifically modified Wordfence files to hide. That number has grown.
Stage five: execution. This is where the attacker’s actual goal plays out, whether that’s pharma SEO links, redirected traffic, mined cryptocurrency, encrypted data, or harvested credit cards. By the time you notice, you’re well past stages one through four.
The Common Types of WordPress Hacks
Not every hack looks the same. The flavours below cover roughly nine in ten compromised sites Australian agencies see.
SEO spam (the “pharma hack”)
This is the single most common WordPress compromise. The attacker injects thousands of hidden pages, links, or keywords aimed at boosting the rankings of unrelated products, usually counterfeit pharmaceuticals, online casinos, knock-off luxury goods, or essay-writing services. The injection is designed to be invisible to logged-in users, and bots that look like Googlebot get a different version of the page than human visitors do (a technique called cloaking).
A real-world pattern: a small bakery’s site started ranking on Google for “cheap online pharmacy AU” because hidden anchor text had been injected into the footer template. The bakery only discovered it when a customer asked, mostly out of bewilderment, why the bakery was suddenly selling diabetes medication. The owner had logged into wp-admin every week for months without noticing anything because the injected content was invisible to admins.
The reason this hack is so popular is straightforward economics. A WordPress site with even modest domain authority is genuinely valuable to spam SEO operators. They don’t need to compromise enterprise targets. A few thousand small business sites, each carrying a handful of links to a casino landing page, will do more for the casino’s search rankings than any legitimate marketing campaign at the same cost.
Malicious redirects
Scripted code looks at the visitor’s referrer and user agent, then redirects search-engine traffic, and only search-engine traffic, to scam landing pages, fake antivirus pop-ups, or affiliate-fraud destinations. Direct visits and admin logins see the normal site. This is why owners often can’t reproduce the redirect themselves and start to doubt the customers reporting it.
Ransomware and database wipes
Less common on smaller WordPress sites than on enterprise systems, but rising. The attacker either encrypts the database or deletes the entire /public_html/ directory and leaves a README.txt demanding payment in cryptocurrency. The Australian Signals Directorate’s Annual Cyber Threat Report 2024-25 logged 138 ransomware incidents in Australia over the financial year. As of 30 May 2025, businesses with annual turnover above $3 million are legally required to report ransomware payments and extortion demands under the new mandatory reporting regime.
Cryptojacking
Hidden JavaScript or PHP turns your server (and, in some variants, your visitors’ browsers) into a cryptocurrency miner, usually for Monero, which is harder to trace than Bitcoin. The site doesn’t visibly change, but server CPU pegs at 100 per cent, page-load times balloon, and the hosting bill quietly doubles. E-commerce stores tend to spot this fastest because checkout abandonment goes through the roof.
Card skimmers (Magecart-style)
Reserved almost exclusively for WooCommerce sites. The attacker injects a few lines of JavaScript into the checkout page that quietly forwards card numbers to a server they control. The customer’s order completes normally. The retailer notices when chargebacks start arriving weeks later, or, more often, when the payment gateway suspends the merchant account.
Credential and email harvesting
The site is turned into a phishing host. Attackers upload fake login pages mimicking Microsoft 365, Australian banks, or Australia Post, and use the legitimacy of your domain to slip past spam filters. Your hosting account gets blacklisted before you notice anything is wrong on the front end.
Who Gets Targeted (And Why It’s Probably You)
There’s a comforting myth that hackers only chase big names. The data is unambiguous that this isn’t true. Sucuri’s compromised-site analysis consistently shows that small-to-medium business sites make up the bulk of cleanup jobs, not because attackers prefer them, but because the bots don’t discriminate. Three groups face elevated risk.
E-commerce stores, especially WooCommerce builds running ten or more plugins, sit in the highest-risk bracket because the payment-data prize is genuinely valuable. High-traffic blogs and news sites get targeted for malvertising, since injecting infected ads into a site with an existing audience is faster than building a malicious audience from scratch. And corporate portals, particularly those with VPN connections to internal networks, are increasingly used as “jump boxes”, a foothold from which attackers pivot into the company’s actual infrastructure. Supply-chain compromises through CMS platforms have been a recurring theme in Patchstack’s annual threat reports.
If you run a WordPress site with more than zero visitors, you’re inside the target set. The question is just how much friction you’ve put between an automated scanner and your weakest plugin.
Signs Your WordPress Site Has Been Hacked
Most compromises announce themselves quietly, if at all. Because so many hacks are designed specifically to stay invisible to administrators, you can’t rely on looking at the front page or the dashboard to know whether you’ve been compromised. The table below covers the warning signs experienced cleanup teams check first.
| Warning Sign | What It Often Means | How to Verify |
| Search Console “Security issues” warning, or pages indexed in Russian, Japanese, or Chinese | SEO spam injection | Run “site:yourdomain.com” in Google and scroll the results |
| Unfamiliar admin-level accounts in your user list | Persistence backdoor | Check Users in /wp-admin/, then verify against the wp_users table in phpMyAdmin |
| Hosting “high resource usage” or suspension emails | Cryptojacking, spam relay, or malware distribution | Review CPU and bandwidth graphs in cPanel |
| Random .php files in /wp-content/uploads/, or recently modified core files | Web shell or injected backdoor | Uploads should only contain media files; audit via SSH or your host’s file manager |
| Site looks different in incognito mode or from another network | Cloaking attack hiding from administrators | Visit from a phone on mobile data, logged out, ideally on a different network than your office |
| Sudden 60 percent traffic drop, or 400 percent spike to obscure URLs | Domain blacklisted, or spam pages being indexed and driven traffic | Cross-check Google Analytics with the Search Console coverage report |
| Customers report receiving phishing emails apparently from your domain | Hosting account used as a spam relay | Review hosting control panel mail logs |
The single most reliable check on this list is the Google site search. Type “site:yourdomain.com” into Google and scroll through every result page. If pages mentioning casinos, online pharmacies, payday loans, or knock-off luxury brands appear, you’ve been hit by an SEO spam injection regardless of what your dashboard tells you. Australian hosts including SiteGround, VentraIP, Conetix, and Crucial will often catch the cryptojacking and spam-relay variants before the owner notices, and their first warning email is almost always worth treating as a security issue rather than a performance one.
One pattern worth flagging from the Patchstack and Monarx 2026 joint report: attackers in 2025 increasingly inject malicious code directly into legitimate WordPress core, plugin, and theme files rather than dropping standalone malicious files. The old “scan and delete” approach to malware detection misses this entirely. If a site has been compromised once and the cleanup didn’t include a full file-integrity check against fresh wordpress.org copies, the infection is probably still there.
How To Recover a Hacked WordPress Site
There is no version of this process that’s both fast and complete. Anyone selling a “one-click malware removal” subscription is either exaggerating what their product does or hoping you don’t ask. Done properly, recovery has six stages.
1. Quarantine first, investigate second. Take the site offline before doing anything else. Most hosts let you put a maintenance page up at the cPanel or DNS level. The longer infected pages stay live, the deeper the SEO damage and the higher the chance Google’s Safe Browsing list adds your domain, which is far harder to get removed than to avoid in the first place.
2. Preserve evidence before cleaning. Take a complete backup of the compromised site, even though it’s infected. You may need it for forensic analysis, insurance claims, or regulatory disclosure if the incident is ASD-reportable. Store it offline.
3. Identify the entry point. This is the step amateurs skip and pay for later. Cleaning the malware without finding the original vulnerability guarantees re-infection, often within hours. Cross-reference your installed plugins and themes against the Wordfence Intelligence database and Patchstack’s vulnerability database, look at server access logs for suspicious POST requests around the time the malware appeared, and check wp-config.php and .htaccess for unauthorised modifications.
4. Clean systematically. Replace WordPress core files with a fresh download from wordpress.org. Replace every plugin and theme by downloading clean copies. Never trust files that are already on the server. Delete anything in /wp-content/uploads/ that isn’t an actual media file (no .php, .js, or .html files belong in there). Restore the database from a known-clean backup if one exists. Otherwise, run a malware scanner against the database for injected content in posts, options, and user metadata. Pay particular attention to the wp_options and wp_posts tables, where SEO spam injections most commonly hide.
5. Rotate every credential. All admin passwords. The database password (update wp-config.php to match). All FTP and SSH credentials. The hosting control panel login. Any API keys for Stripe, Mailchimp, or other services that were stored in plugins. Two-factor authentication should be enforced on every remaining account.
6. Patch and harden. Update every component to its current version. Remove anything you don’t actively use. The average WordPress site runs 20-plus plugins, of which roughly half are non-essential. Roughly 40 per cent of all plugins in the WordPress directory haven’t received an update in over two years. Each unused plugin is a free attack surface for the next hacker.
After all this, request a review through Google Search Console if your domain was flagged, and submit a reconsideration request. Expect 24 to 72 hours before the warning is removed.
Why DIY WordPress Cleanups Often Fail
The recovery process described above looks linear on paper. The reality is uneven. Re-infection rates on owner-cleaned sites are substantially higher than on professionally cleaned ones, and the failure modes are predictable enough to list.
The entry point gets missed. Owners delete the visible malware files but don’t trace the original vulnerability. Within hours, the same automated bot that found the original hole exploits it again. The site looks clean, then it doesn’t, then the owner cleans it again, and the cycle repeats until something breaks more visibly.
Persistence mechanisms get overlooked. Backdoors hide in places most owners never think to check: scheduled cron jobs, must-use plugins (mu-plugins), modified core files that look fine on a casual inspection, malicious code injected into legitimate plugin files rather than as standalone uploads, and rogue database entries in wp_options or wp_posts that re-trigger malware on every page load. The “scan and delete” approach catches the obvious files and misses the rest.
Backups turn out to be infected. If the owner doesn’t know exactly when the breach happened, restoring from a “recent” backup often just restores the malware alongside the content. A clean recovery requires a backup from before the compromise, plus the discipline to identify which backup that is and verify it works.
Google flags don’t lift. Even after a site is technically clean, the Safe Browsing warning and Search Console security flag remain until a reconsideration request is filed correctly, with documentation of what was found and removed. Owners frequently submit incomplete requests and wait weeks longer than necessary.
SEO damage compounds. A 24-hour clean costs you a handful of rankings. A 14-day clean, where the cycle of clean-and-reinfect drags on while spam pages stay indexed, can cost six to twelve months of recovered SEO performance once Google fully re-trusts the domain. The economic case for fast, complete cleanup is rarely close.
For a small marketing site with a single, simple SEO spam injection, working through the recovery steps above is reasonable. For an e-commerce site, a site holding stored customer data, a site that’s been compromised before, or a site where the owner doesn’t have the technical confidence to audit cron jobs and inspect database tables, engaging a WordPress-experienced agency or a dedicated security specialist saves both time and the more expensive failures listed above. A professional clean recovery typically costs a fraction of the combined price of a second compromise plus the SEO rehabilitation work that follows it. The honest test is whether you’d be confident explaining to Google, in a reconsideration request, exactly what was wrong and exactly what you did to fix it. If the answer is no, the cleanup probably isn’t finished.
Prevention: The Habits That Actually Matter
Sucuri’s analysis of compromised WordPress sites consistently finds that 81 per cent of breaches involve weak or stolen credentials as a contributing factor. The rest come down to unpatched software and exposed attack surface. The same handful of practices, repeated weekly, prevent the overwhelming majority of compromises.
Apply the principle of least privilege.
Far too many WordPress sites have four, five, or eight administrator accounts when they need one. A guest blogger does not need an Admin account. The Contributor role lets them write and submit posts without touching plugins, themes, or users. A marketing assistant who manages content needs Editor, not Administrator. Audit your user list quarterly and downgrade or remove anyone who doesn’t strictly need their current permissions. When a staff member leaves, delete the account on the same day, not “next time we get to it”.
Enforce two-factor authentication
A password by itself is no longer a security control. It’s a username with extra steps. Plugins like WP 2FA and Wordfence Login Security add a second factor, usually a code from an authenticator app, that renders stolen passwords useless. The Australian Cyber Security Centre’s Essential Eight maturity model lists multi-factor authentication as one of the eight foundational mitigations for a reason. It blocks the overwhelming majority of credential-based attacks at zero ongoing cost.
Use a Web Application Firewall (WAF)
A WAF inspects incoming HTTP requests and blocks the patterns that match known attacks (SQL injection, cross-site scripting, path traversal, brute-force attempts) before they reach WordPress. Cloudflare’s free tier is genuinely useful and takes about ten minutes to set up. For sites handling customer data, paid options like Sucuri Firewall, Cloudflare Pro, or Wordfence Premium offer application-layer rules that catch WordPress-specific exploits the free tiers don’t. Patchstack’s 2026 analysis notes that 87.8 per cent of WordPress-specific exploits bypass network-level hosting firewalls because those firewalls don’t understand the application semantics. Meaning a WordPress-aware WAF is worth more than a generic one.
Patch everything, weekly at minimum.
WordPress core updates are a solved problem if you turn on automatic minor updates, which apply security patches without breaking sites. Plugins and themes are harder. The pragmatic standard for any commercial site is a weekly maintenance window: check for updates, apply them on a staging copy first if the site is mission-critical, then push to production. The five-hour median between disclosure and exploitation makes “update when you remember” a losing strategy.
Take backups that you’ve actually tested.
A backup you’ve never restored is theoretical. UpdraftPlus, BlogVault, and Jetpack VaultPress all do the job. The variable that matters more is whether you’ve ever restored from one. At least once a year, restore your site to a staging environment from the latest backup and confirm it actually works. Store backups offsite, not on the same server as the live site, because if the server is compromised, on-server backups are compromised too.
Reduce attack surface ruthlessly.
Every plugin you install is code written by someone you’ve never met, running with full database access. Most well-built sites get by with 10 to 15 plugins. If you’re running 35, half of them aren’t earning their keep. The same applies to themes. Keep only the active theme and one default fallback (like Twenty Twenty-Four). Delete the rest.
Monitor, don’t just defend
Set up email alerts for new admin user creation, file changes in core directories, and unusual login activity. Wordfence does this out of the box. So does Patchstack. Site monitoring services like UptimeRobot will tell you within minutes if your site goes down or starts redirecting unexpectedly, which is often the first signal of a serious compromise. Schedule a manual “site:yourdomain.com” Google search once a month. It takes thirty seconds and catches SEO spam injections that automated scanners often miss.
The Australian Context
Local operators face one wrinkle that overseas guides skip. Since 30 May 2025, the Australian Government’s mandatory ransomware reporting regime applies to businesses with annual turnover above $3 million and to entities responsible for critical infrastructure. If a WordPress hack involves ransomware or extortion, you’re now legally required to report payments and demands within prescribed windows. The Australian Signals Directorate’s ACSC also runs the Australian Cyber Security Hotline (1300 CYBER1) around the clock, and small businesses can lodge incident reports through ReportCyber. The ACSC’s Essential Eight maturity model, covering patching, MFA, application control, restricted admin privileges, and the rest, is genuinely sensible guidance. It’s worth working through methodically, regardless of whether your business is large enough for compliance to be mandatory.
It’s also worth knowing that Australian-based hosts like VentraIP, Conetix, and Crucial tend to be more proactive about suspending compromised accounts than offshore budget hosts. A local provider will usually catch a cryptojacking or spam-relay infection within hours rather than weeks. The trade-off is slightly higher monthly fees. After your first cleanup bill, that maths becomes obvious.
People Also Ask
How do I know if my WordPress site has been hacked?
The earliest signs are usually environmental, not visual. A sudden traffic drop, a Google Search Console security warning, a hosting suspension email, unfamiliar admin accounts, or a customer report that your site redirected them somewhere strange. Run a “site:yourdomain.com” Google search and scroll through the results. If pages mentioning casinos, pharmacies, or essay services appear, you’ve almost certainly been hit by an SEO spam injection. Open the site in incognito mode on a phone using mobile data. If it behaves differently than it does when you’re logged in, you’re looking at a hack designed to hide from administrators.
Can a hacked WordPress site be fully recovered?
Yes, in almost all cases, but recovery is a process, not a button. The four indispensable steps are: scan and identify all malware, remove every infected file (replacing core, plugins, and themes with fresh copies rather than cleaning in place), rotate all credentials including database and FTP passwords, and patch the underlying vulnerability that allowed the breach. Skip the last step, and you’ll be back here in a week.
Does WordPress get hacked easily?
WordPress core is mature, well-maintained, and rarely the source of a breach. Only seven core vulnerabilities were registered across the entire ecosystem in 2024, none of them critical. The weak link is almost always third-party code: outdated plugins, abandoned themes, or weak admin passwords. The platform is as secure as the operator chooses to make it.
How much does it cost to clean up a hacked WordPress site?
Estimates from cybersecurity industry sources put the average small-business cleanup cost at around US$14,500 once you factor in lost revenue, reputational damage, customer notification, forensic analysis, and developer hours. A proactive security plugin and a managed-hosting plan with WAF protection together cost roughly $20 to $50 per month. The cost asymmetry is severe enough that “we’ll think about security later” is rarely a defensible business decision.
Should I pay a ransom if my WordPress site is held to ransom?
The Australian Signals Directorate’s standing advice is no. Payment doesn’t guarantee data recovery, doesn’t prevent the attacker from selling stolen data anyway, and funds further attacks. If you’re a business with $3 million-plus annual turnover, you also have new mandatory reporting obligations to comply with. Engage a specialist incident-response firm and report through cyber.gov.au.
My site looks fine. Could it still be hacked?
Yes, and this is the most common scenario. The majority of WordPress hacks are designed specifically to be invisible to the site owner and visible only to search engines or to specific visitor segments. The injected casino, pharmacy, or essay-mill links are added to pages that don’t appear in your navigation and are hidden from logged-in users. The only reliable way to check is to search Google for “site:yourdomain.com” and inspect what shows up, plus view the site in an incognito browser on a different network.
Closing Thoughts
A hacked WordPress site is rarely the result of one catastrophic mistake. It’s almost always the cumulative result of small decisions deferred. The plugin update skipped because the site looked busy. The admin account left active for a developer who finished the project two years ago. The staging environment that quietly became another way in. Hardening a WordPress site doesn’t require enterprise budgets or a full-time security team. It requires somebody to own the maintenance, do it consistently, and treat “the site is loading fine” as the lowest possible bar for confidence rather than the highest.
If you suspect your site has been compromised right now, take it offline before you do anything else. Don’t try to figure out what happened from a live site that’s actively spreading malware or building hidden links to someone else’s casino. Quarantine first, investigate second. The damage stops growing the moment the front door closes, and that buys you the room to recover properly instead of in a panic.
