{"id":4525,"date":"2026-09-29T00:58:22","date_gmt":"2026-09-28T22:58:22","guid":{"rendered":"https:\/\/www.cint-consulting.com\/the-6-most-common-wordpress-hacks-and-how-to-detect-them\/"},"modified":"2026-11-05T22:06:04","modified_gmt":"2026-11-05T21:06:04","slug":"the-6-most-common-wordpress-hacks-and-how-to-detect-them","status":"publish","type":"post","link":"https:\/\/www.cint-consulting.com\/en\/the-6-most-common-wordpress-hacks-and-how-to-detect-them\/","title":{"rendered":"The 6 most common WordPress hacks and how to detect them"},"content":{"rendered":"

When we think of a hacked website, we imagine the homepage replaced by a message from the attacker. That hardly happens anymore. Today, attackers want the site to keep running normally so they can exploit it for months without anyone noticing. These are the attacks we find most often on websites built with WordPress, and the signs to detect them.<\/p>\n

1. Backdoors: PHP files where there shouldn’t be any<\/h2>\n

This is the first thing an attacker leaves behind once they gain access: a small hidden PHP file, often in the images folder (wp-content\/uploads<\/em>) or with a name that looks like WordPress. This file allows them to re-enter whenever they want, even if you change passwords or update plugins.<\/p>\n

The uploads folder should only contain images and documents. A .php<\/em> file there is almost always a backdoor.<\/p>\n

2. Theft of your customers’ data<\/h2>\n

This is the most serious attack because it affects third parties. The malicious code copies what is entered in contact forms, registration fields, or store checkout (names, emails, phone numbers, addresses, and even credit card details) and silently sends it to the attacker’s server. There are also attacks that directly steal the customer list from the database.<\/p>\n

The website works perfectly fine and orders continue to come in, so no one suspects anything. However, a personal data breach requires notifying the Data Protection Agency and, where applicable, the affected individuals.<\/p>\n

3. Redirects to other websites<\/h2>\n

The visitor lands on your site but ends up on a scam page, fake prize offer, or dangerous download page. Most commonly, the redirect only triggers in specific cases: from mobile devices, when arriving via Google, or on the first visit. You, accessing directly while logged in, never see it; your customers do.<\/p>\n

4. Spam posts with advertisements<\/h2>\n

The attacker creates hundreds or thousands of pages and posts featuring ads for adult websites, casinos, pharmacies, or brand replicas, often hidden so they don’t appear in the menu or the WordPress dashboard. The goal is to exploit your domain’s reputation on Google to rank their links.<\/p>\n

The consequence for you is twofold: Google starts showing results that aren’t yours under your company name, and if detected, it may flag your website as dangerous or remove it from search results.<\/p>\n

5. Administrators no one created<\/h2>\n

A new administrator account with an unfamiliar name is one of the clearest signs. The attacker creates it to have their own independent entry point, separate from the backdoor. Sometimes they even hide it from the user list in the dashboard.<\/p>\n

6. Your server working for others<\/h2>\n

The infected website is used to send spam email, attack other sites, or mine cryptocurrencies. You notice this because the site runs slowly, your hosting provider warns you of excessive consumption or suspends your account, and your company emails start landing in your customers’ spam folders because your server has ended up on a blacklist.<\/p>\n

Signs that your WordPress may be hacked<\/h2>\n