Before paying anyone to fix your WordPress site, run through this checklist yourself — it takes about ten minutes and tells you what you’re actually dealing with, so you’re not paying for a guess.
Signs it’s hacked, not just slow
- Google shows a “This site may be hacked” warning directly in search results, or Search Console has flagged a security issue.
- Strange redirects to unfamiliar sites, especially noticeable on mobile visits.
- Unfamiliar admin users showing up in your WordPress users list that nobody on your team created.
- Your hosting provider has suspended the account for “abuse” or malware, usually with an email notice you may have missed.
- Unfamiliar PHP files sitting inside
wp-content/uploads, a folder that should only ever contain media files, never executable code. - Your site’s homepage briefly flashes different content, or shows spam/gambling content to search engines but not to you directly (a technique called cloaking, used to hide the infection from the site owner).
Signs it’s just slow, not hacked
- Loads fine but takes 4+ seconds, especially noticeable on mobile data rather than office wifi.
- PageSpeed Insights shows a poor mobile score with no security warnings anywhere in Search Console.
- Everything behaves normally content-wise, it’s simply sluggish under real use.
- The slowness got gradually worse over months, rather than appearing suddenly — a pattern consistent with accumulated plugin bloat or database growth rather than an attack.
What to do next, for each case
If it’s hacked: change all your passwords immediately — WordPress admin, hosting/cPanel, database, and FTP/SSH — and don’t wait to “investigate first.” The longer a compromised site stays live, the more damage accumulates, including the real risk of your domain getting blacklisted by browsers and email providers, which is far harder to reverse than the original infection.
If it’s slow: hosting and caching are the first places to look, not random plugin tweaks. Check your Time to First Byte specifically — if that’s high even on a near-empty page, the server itself is the bottleneck, and no amount of image compression will fix that.
A quick self-test you can run right now
- Search
site:yourdomain.comin Google and look for anything unfamiliar in the results — unexpected pages, foreign-language content, or spam-looking titles are a hacked-site signal. - Open your site on mobile data (not wifi) and time how long it takes to become usable, not just visually loaded.
- Check your WordPress Users page for any account you don’t recognize.
- Run PageSpeed Insights and note the mobile score and Time to First Byte specifically.
I cover the full fix process for both scenarios in detail: the WordPress security and hacked-site recovery guide, and the WordPress speed guide.
Not sure which one you’re dealing with, or want a second opinion before spending money on a fix? Send me a screenshot on WhatsApp and I’ll tell you straight.
