Is our WordPress site hacked or just a broken plugin? How can we tell if someone's inside?

The reason your customers see it and you don't is User-Agent and Referer filtering. The malicious PHP serves a clean page to direct visitors, but triggers the redirect for traffic arriving from Google searches or external referrers. Check .htaccess and index.php in your site's root directory. You'll likely spot eval, base64_decode, or strange external includes tucked right at the top.

To clean this up without wiping out the evidence, do this: 1) Download the raw access.log for the last 30 days from your hosting panel immediately. 2) Take a full database dump via phpMyAdmin. 3) Note the exact creation timestamp of that suspicious user in the wp_users table. 4) Filter your access logs around that timeframe to see which PHP file or vulnerability received the POST request.

Went through the exact same thing last year at our spare parts shop in Hannover. Our dev stalled us for five days claiming it was just a caching glitch. Once Google slapped a security warning on the site, our 4,000 EUR weekly order volume instantly dropped to zero. We ended up paying 850 EUR for an expert cleanup, but clearing the search engine penalty and getting our revenue back took six weeks. Don't waste time.

Your dev's claim that a plugin update broke the database makes zero sense. A broken plugin doesn't create rogue admin accounts in the database or inject spam keywords into Google search snippets. Either they used a nulled plugin from an untrusted source, or they don't want to admit an unpatched vulnerability. Get a third-party security specialist to look at it, not that developer.

The most urgent move right now is putting the site into maintenance mode. If customers are being sent elsewhere at checkout, credit card details might be getting skimmed. Trying to clean up files on a live site will only expose your customers to more risk. Lock down site access in your hosting panel so only your office IP can connect and cut off external traffic immediately.

open up the uploads folder via ftp and search for .php files right away. nothing should ever be in there except images and pdfs. delete anything you find and drop an htaccess file in that folder to block php execution. otherwise even if u clean it up the site will turn back into a zombie tomorrow morning.

What does your hosting environment look like? Are you on shared hosting or a dedicated VPS? If you're hosting multiple domains or staging environments under the same account, could the attackers have pivoted into the main site through an abandoned subdomain? Do the logs show any cross-directory access?

You mentioned unauthorized redirects on the checkout page. If customers' credit card details or personal data have been compromised by third parties, you may be legally required under German Data Protection Regulations to notify the supervisory authority within 72 hours. Treat this not just as a technical issue, but as a legal matter as well, and make sure server logs are preserved with proper forensic integrity.

Thanks for posting.

This thread is archived.

You're right.

Let me summarize what's been said so far. Solutions that work at a small scale collapse when you grow; I learned this late.

If I understood correctly, you're saying: Taking notes for two weeks yields better results than a six-month estimate.

When we decide without measuring, we always end up in the same place. If you post the result here, it will help others too.

i didn't know that. if the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Absolutely. If I were to add anything: Forgotten test environments are more often the entry point than live systems.

Correct me if I'm wrong.

Let me write how it's done in practice. If 2FA is on, a stolen password alone is useless.

Hasty decisions become decisions you have to fix six months later. If you have questions, write them; I'll answer as best I can.

Quick summary for newcomers: Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Of course, it varies if your situation is different.

There's a trap here let me mention it. Trying to do this alone is the most expensive way.

When making a decision, first look at what data you have on hand. That's all, sorry if I went on too long.