Malware on a WordPress site is not usually loud. It is written to survive and to keep working, which means blending in. Still, it almost always leaves traces. Here are the ones worth paying attention to.
The signs
- Unexpected redirects sending visitors to pages you did not create, often only on mobile or only from search.
- Pop-ups or ads appearing on the site that you never added.
- Spam pages in Google — search your domain and you find pages in another language or about products you do not sell.
- Unknown admin accounts or users you did not create.
- Modified or unfamiliar files, especially in the site root or
wp-content. - Suspicious code in theme or plugin files, often long strings of scrambled characters.
- A browser or Google warning that the site may be unsafe.
- Outbound spam email from your domain, or your host warning you about it.
- Unexplained slowness or resource spikes as malicious scripts run in the background.
- Settings that revert or reappear after you change or remove them.
What to do about it
One of these might be a coincidence. A few of them together usually is not. The right next step is not to guess — it is to investigate: confirm what is actually infected, understand how it got in, and clean it properly rather than deleting the first suspicious file and hoping.
Deleting a symptom without finding the entry point is how a site gets reinfected a week later.