What Actually Happens When a WordPress Site Gets Hacked?

When a WordPress site gets hacked, the first thing attackers usually do is make sure you do not notice. Visible damage gets discovered and cleaned up quickly. Invisible damage runs quietly for months.

Understanding what actually happens after a compromise helps you look for the right things, not just the obvious ones.

The invisible hack is the most common kind

Most people imagine a hacked website as one with a defaced homepage or error messages. That type of attack exists, but it is not the norm. It is loud. Loud attackers get removed quickly.

A skilled attacker who wants sustained access to your site has every reason to keep it looking normal. They want to use your resources: your server, your domain reputation, your traffic. All of that value disappears if you find out and clean up.

Roughly 13,000 WordPress sites are hacked every day. The majority of those owners do not know it for weeks.

What attackers typically do

Installing a backdoor is usually the first step. A backdoor is hidden code that provides re-entry independent of your login credentials. Even if you change every password, the backdoor still works. Most cleanup efforts that miss backdoors lead to re-compromise within days.

Adding spam pages is a common second step. Attackers insert dozens or hundreds of pages into your site, often in a different language, promoting products or services. These pages are hidden from you but visible to search engines. Your domain’s trust helps them rank. You see nothing. Your site quietly builds someone else’s SEO.

Sending bulk email is another common use. Your server sends thousands of spam emails per day. Your domain has a sending reputation that took time to build, and attackers exploit it until it triggers blacklisting. You find out when your own emails stop arriving.

Traffic redirection is subtler. Attackers install code that redirects some visitors to other sites. Not all visitors, not your logged-in sessions. Specific visitors, often on mobile, often coming from search engines. You test your own site and see nothing. Your customers experience something different.

File storage uses your server space to host content the attacker needs stored somewhere. This is often illegal content. You are not involved, but your server is the host.

The damage you see weeks later

Most of the consequences of an invisible hack appear long after the intrusion.

Google crawls your site and finds the spam pages. Your search rankings drop. Your domain gets flagged. Google’s Safe Browsing blacklists your site and visitors see warning pages.

Your email domain gets blacklisted because your server sent too much spam. Your legitimate emails land in spam folders. Customers stop receiving your replies.

A customer notices the redirect and asks what happened. Or mentions it publicly.

Your host contacts you because your server is using abnormal resources.

By the time any of these signals appear, the hack may have been running for weeks.

What you can do today

1. Run a Google search for site:yourdomain.com and look carefully at every result for pages you did not create.
2. Check Google Search Console for security warnings.
3. Check your domain on MXToolbox to see if it is on any email blacklists.
4. Look at your admin user list for accounts you did not add.
5. Run a free malware scan at Sucuri SiteCheck.

Why this keeps happening

Attackers are patient and methodical. They have automated tooling that finds vulnerable sites, compromises them, installs backdoors and payloads, and moves on. The attack itself may take seconds. The impact runs for months.

In 2025, 91 percent of new WordPress vulnerabilities came from plugins. The attack likely came through a plugin. The attacker did not read your content or care about your business. They wanted a server.

Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free. If your site has no plugin attack surface, there is nothing for automated tools to find and exploit.

Find out what is wrong in 60 seconds

Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.