If your WordPress site is suddenly slow, redirects visitors to unfamiliar pages, or Google is flagging it as "This site may be hacked," you're likely dealing with a compromise — not a bug.
1. Check for unknown administrator accounts
Go to Users → All Users in wp-admin and look for any account you don't recognize, especially ones with the Administrator role created recently.
2. Look for unfamiliar or out-of-date plugins
Attackers frequently install a lightweight plugin purely to keep backdoor access. Anything you don't remember installing is suspect — and any plugin several versions behind current is a common entry point in the first place.
3. Check outbound requests and search rankings
A hacked site is often used to send spam or host redirect chains. If your hosting dashboard shows unusual outbound traffic, or your site disappeared from search results overnight, that's a strong signal.
4. Run a plugin/theme vulnerability scan
Manually checking every plugin's changelog against the WordPress vulnerability database isn't realistic to do by hand. An automated WordPress scan checks installed plugins and themes against known CVEs and flags exactly which ones are exploitable right now.
If you've spotted any of the signs above, the fastest next step is scanning the site rather than guessing — it tells you precisely which plugin or misconfiguration is the entry point.