Member Avatar for Qqueen

I am having a problem with my Wordpress website and I think that it has been hacked. First of all, my site is really slow. I have also noted some funny content that has been added on my site. Could this be a sign that my site has been hacked? What do you suggest I do about it?

  • 7 Contributors
  • 6 Replies
  • 190 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by stokes

Dani AI

Generated

Slow site performance combined with unexpected or “funny” content is a strong indicator of compromise, but slowness alone is not definitive (hosting load, caching or local/browser issues can also cause delays). Early triage should separate server‑side infections from client/browser problems by fetching raw responses from different networks and by checking server logs and remote scanners rather than relying only on a single browser view.

Practical checks (run from the web root or ask the host for access):

# check HTTP headers and redirects
curl -I -L https://example.com

# find files changed in the last 30 days (sorted by newest)
find . -type f -mtime -30 -printf '%T@ %p\n' | sort -nr | head -n 50

# look for PHP files put into uploads
find wp-content/uploads -type f -iname '*.php'

# search for common obfuscation/malware patterns
grep -RIn --exclude-dir=wp-content/uploads -E "base64_decode|eval\\(|gzinflate|str_rot13|create_function" .

Verify admin accounts and recent registrations (WP‑CLI if available):

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

Containment and cleanup essentials: take the site into maintenance/static mode, make full file+DB backups, rotate all credentials (hosting control panel, SFTP/SSH, DB user, API keys and WordPress admin passwords), and compare core files against a clean copy (WP‑CLI has wp core verify-checksums). Add this to wp-config.php to prevent in-dashboard edits:

define('DISALLOW_FILE_EDIT', true);

Advice tied to earlier replies: echoing , reducing active plugins to essentials and rotating credentials is a good first move; as suggested, rate‑limit logins and add continuous file integrity/scan monitoring. As noted, use external safe‑browsing checks and view the site from a clean network to rule out local/browser issues. For persistent infections or unclear traces, professional malware removal is recommended because hidden backdoors are often left behind if cleanup is incomplete.

Recommended Answers

All 6 Replies

Member Avatar for Member #46692

Could be a plugin vulnerability... I would strip it down to only the essential core plugins, make sure wordpress is up-to-date. Remove all files, change your ftp details and username/passwords.

Member Avatar for xandermcnight

Same problem as mine. But thank you for this tips.

Member Avatar for <M/>

Also be sure to not share your admin account information with anyone. I recommend changing your password. On the side note, try not using Admin as your username, you will most likely be targetted for a hack :D

Member Avatar for stultuske

what kind of content has been changed?
if it's an image you linked to from another page, might just be the owner replaced the image. if it's part of the wordpress text, maybe there's been an update of their material.

anyway, wordpress isn't the best way to create a website anyway. you give way too much rights to other parties (since you're using their software).

but a site being slow,means nothing. might just be there's a lot of traffic on that server.

Member Avatar for DavidB

Hi, "Qqueen".

Did you get your problem resolved?

If not, what other steps have you taken to confirm one way or the other if your site has been hacked?

What browser do you use?
The reason I ask is because, if you use Firefox it usually accesses a database that documents bad sites and should block your site from loading if your site has been added to the known "bad" site list. So load your site in Firefox and see if any warnings appear.

Alternately, you can submit your site to some of Google's webmaster tools. For example, their diagnostics tool (replace "example.com" at the end of this URL by the domain of your own site):

www.google.com/safebrowsing/diagnostic?site=example.com

WordPress is notorious for getting hacked. I had a WordPress blog myself for a while, but it got hacked, and I decided to give up on it (I wasn't a prolific blogger anyhow.)

Please post back to let us know how this matter progresses.

Edited by DavidB
Member Avatar for stokes

Hi,
All the advice above is positive. I'm guessing you haven't gone very far into security, and as I've had a wordpress site hacked three times, it's obvious that I haven't either. First thing is that whether human or bot the bad guys may stay one step ahead of you, and we do what we can. Things on my 'to do' or 'doing' list which may help:
limit the number of login attempts
http://wordpress.org/plugins/limit-login-attempts/
install
http://wordpress.org/plugins/wordfence/
or something similar
password protect directories
modify .htaccess
delete the default admin account
hide the wordpress version - I'm sorry if I missed someone saying that before.
Plugins are definitely a weakness. In my case, I suspect a file in a google map plugin.
If the part beyond the links doesn't make sense, go with installing the plugins in the links. If you google 'wordpress security' you'll find lots more. Stay with the funny content, rather than slowness to see what's really happened. If you are with a commercial host and have, for example, cpanel, you might be able to see where it's come from by looking in the log. You can block specific IPs.
Just typing 'wordpress security' in google will bring up a ton of stuff.
For you and anybody else, if we start a new thread it could help people.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.