By the time a WordPress compromise is obvious (pharma spam on the homepage, a browser warning, a blacklist notice from Google), the attacker has usually had access for weeks. The early signals are quieter, and they show up in places most owners never look.
1. Unexpected admin users
Check Users → All Users and sort by registration date. Any administrator you did not create is a back door, not an accident. Attackers often give these accounts plausible names so they survive a casual glance.
2. Files modified after your last deploy
Compare modification timestamps against the last time you actually changed anything. A wp-config.php or .htaccess touched last Tuesday when you have not logged in for a month is worth a full investigation.
3. Scheduled tasks you did not schedule
WP-Cron is a popular persistence mechanism. Malicious cron entries re-infect a site minutes after you clean it, which is why so many “cleaned” sites are reinfected by the next morning.
4. Outbound traffic from your server
A compromised site frequently becomes someone else’s mail relay or proxy. Sudden outbound SMTP volume, or CPU that stays pinned with no matching visitor traffic, both point the same direction.
5. Search results that do not match your pages
Search site:yourdomain.com and read the results carefully. Cloaked spam is served only to search engine crawlers, so the pages look completely normal when you visit them yourself.
What to do next
Do not simply reinstall plugins and hope. A proper recovery means forensic identification of the entry point, removal of every persistence mechanism, and a credential rotation across hosting, database, and WordPress itself. Cleaning the visible symptom without closing the door just resets the clock. That is exactly what our Emergency Rescue service does, and a cleaned site then belongs on a Care Plan so the updates, monitoring, and backups that let it happen are handled from then on.
If you are seeing any of these signs right now, treat it as urgent rather than something to schedule for next month. Get in touch and we will tell you honestly whether you have been compromised and what it takes to fix it.