WordPress security warning signs you can check yourself

Unexpected redirects, unfamiliar users and content you did not publish deserve investigation. A clean-looking homepage does not establish that the installation is secure, and a public login page does not prove it is compromised.

Look for unexplained changes

Check administrator accounts, recent plugin additions, failed logins and files or pages that appeared without a known reason. Confirm the report through your own trusted login route rather than links in an alarming email. If the site handles purchases, preserve the evidence and coordinate with the relevant providers.

Contain and investigate deliberately

A backup is useful only if you know what it contains and how to restore it. Restoring an infected backup or deleting symptoms without fixing the cause can repeat the incident. An access-based security review should identify the affected scope, clean it and address the likely entry point.

A practical checklist

• Keep supported software updated.
• Use strong individual credentials.
• Review administrator access.
• Keep backups outside the live installation.

What to do next

Start with one important page and one clearly defined problem. Keep a record of the original behaviour, make a controlled change and check the result. If you are not comfortable changing the site, the record gives a developer a useful starting point and makes the scope easier to agree.

A CHD website check can add public-page evidence to that conversation. The free result includes a score and up to three findings. The full $29 teardown includes the measured findings, practical guides, a private report and a PDF. Any repair work is reviewed and quoted before payment.

Reference: WordPress hardening guidance.