If Your Site “Works Fine,” That Might Be the Worst Sign of All

If you run a business and your website “works fine,” it’s tempting to think everything is in order. The problem is that most attacks on WordPress sites don’t break anything visible — on the contrary, they try to stay unnoticed for as long as possible while using your domain, your reputation, and your SEO against you.

These are the signs almost no one checks in time:

1. Your site looks different in Google than in the browser

Search for your own business on Google and look at the snippet: title, description, and the content Google indexed. If you see words in another language, references to Viagra, casinos, watch replicas, or anything you never wrote, your site is serving different content to Google’s bots than to real visitors. It’s one of the most common cloaking techniques on compromised sites.

2. Sudden drops in organic traffic for no apparent reason

If traffic collapsed and you didn’t change anything, don’t automatically attribute it to an algorithm update. Before assuming that, check Search Console: manual penalties, spikes in 404 errors, or indexed URLs you never created (typically folders like /wp-content/uploads/2023/spam/ full of junk pages) are a sign that Google detected the problem before you did.

3. Files you don’t recognize on your hosting

Go into your hosting’s file manager (or via FTP) and look inside folders like /wp-content/uploads/, /wp-content/plugins/, or directly in the root. Files with names like wp-temp.php, class.wp.php, or any stray .php in an images folder have no reason to be there. Uploads are for images, not for executable code.

4. Admin users you didn’t create

Go to Users in your WordPress panel and review the full list, not just the latest ones. It’s common to find an account with the Administrator role created months ago with a generic name or one almost identical to yours, waiting silently to be used when the attacker needs it.

5. Your own hosting warns you (and you ignore it)

Many hosting providers send an email warning that malware was detected, and we treat it as spam because we don’t quite understand what it says or it looks like a generic message. That email is usually the first and only real alert you’ll get before the problem escalates — it’s worth reading carefully instead of filing it away.

What to do if you spotted any of these signs

A compromised site isn’t fixed by deleting the malware by hand and crossing your fingers. You need to:

• Rebuild the chain of includes and core files, comparing them against a clean WordPress installation
• Recover the original assets (images, CSS) from a CDN or backup if the hosting has no clean copies
• Change all credentials (hosting, WordPress, FTP, database)
• Review and remove unrecognized admin users
• Add basic protections: a honeypot on contact forms, plugin updates, login attempt limits

In the case we mentioned, beyond the cleanup, we took the chance to rebuild the site with a faster and better-protected version — because an attack, as much of a headache as it is, is also the opportunity to leave the site better than it was before.