Has my WordPress site been hacked?

From outside: this tool, a "site:yourdomain.com" search in Google to spot pages you did not write, and a visit from a phone in private browsing to catch a redirection. From the inside: the accounts that can install plugins, the list of plugins with the "Must-Use" tab, the recently modified files and the access logs of your host. The "checks to do today" guide details each point.

Yes, if the site had an active UpdraftCentral key. The way in was a valid key, not an old version, and the box that creates this key is ticked by default when you link a site to your TeamUpdraft account. Update to 1.26.13 (2.26.13 for Premium), delete the key in the UpdraftPlus advanced tools, then check the accounts, plugins and files: the update alone removes nothing that was already installed.

A full copy off the server, then a change of every password (WordPress, FTP, database, hosting account, linked email) and of the secret keys in wp-config.php. Only then the clean-up: unknown accounts and plugins, recent files, redirections. If you cannot do it yourself, put the site in maintenance at your host and write to me.

Yes, all of them, as soon as there is a doubt, and a second time after the clean-up: WordPress (every administrator), FTP or SFTP, database, hosting account, TeamUpdraft account, and the email address that receives password resets. Change the secret keys in wp-config.php too: they close every open session, the attacker’s included.

Maybe. A critical error often has a mundane cause, such as a PHP update or an incompatible plugin. But the first variant of the fake plugins of October 2026 caused an "Undefined constant" error on uncached pages. If the message names a plugin you do not know, do not fix its code: move its folder off the site and follow the checks guide.

It is almost always a hack. Ask the host for the files or scripts involved and the logs, make the copy, then clean up or restore an earlier version. The site should only come back online once the passwords are changed and the updates done, or it may be suspended again.

Only if the backup predates the intrusion, so before 17 October for UpdraftCentral, and if you close the door right after. A backup from that date may still hold the old UpdraftCentral key: delete it again, change the passwords and secret keys, and update everything. The restore guide explains how to pick the right backup.

They help detect (modified files, suspicious logins) and block part of the attacks, but a command signed with a real key looks legitimate. They replace neither updates, nor deleting unused plugins, nor unique passwords with two-factor authentication.

The host maintains the server and the PHP version, not your WordPress, your plugins or your accounts. It can suspend a site that sends spam and give you the logs. The clean-up stays with you or your provider.

If the site keeps personal data (accounts, orders, stored forms) and an intrusion may have reached it, it is a data breach: in the EU, it is reported to the authority within 72 hours as soon as there is a risk for people, the people are told if the risk is high, and it is recorded in writing in all cases. A showcase site that stores no data has nothing to report.

It reads the home page once, as a browser would, then at most nine small public files: the RSS feed when the page hides its version, the readme.txt of the watched plugins, the public list of authors and the twenty latest published pages and posts. It also asks WordPress.org whether a plugin seen on the page was closed for a flaw. It recognises WordPress, its version when shown, a listed plugin below its fixed version, a page slipped in (links to casinos or pharmacies, text in a language foreign to the site, backdating), hidden links, a redirection, an encoded script, spam words, .php files in the uploads and a critical error. It scans nothing, sends no payload and keeps the result ten minutes in cache, no more. It cannot see a fake plugin that loads nothing on the page, nor a hack that only targets some visitors: only a check from the inside settles it.