Signs your PHP website has been hacked: the checks to run
How to tell if a PHP site has been compromised: unfamiliar files, new admin users, odd plugins and unexplained server load. Five checks in plain English.
Nikolas Gannon · · 2 min read · Systems and security
With PHP2Shell and the WordPress wp2shell chain both in the news this year, it is a good time to run a few checks on any PHP site. Most of the time you will find nothing. If something is wrong, it is better to know early. These five checks cover the common signs.
Check 1: PHP files you did not create
A webshell is a small PHP file that lets someone run commands on your server. Look through your web root for PHP files that changed recently and that you did not create or update. On WordPress, wp core verify-checksums flags core files that do not match the official release.
Check 2: Admin users you do not recognise
Attackers often add an account so they can get back in later. Go through your admin and user list and look for names you do not know, new admin roles, or accounts created recently.
Check 3: Plugins and themes you did not install
Look through your plugins and themes folders. Anything you do not recognise is worth asking your developer or host about.
Check 4: Unexplained server load
A compromised site is sometimes used to mine cryptocurrency or send spam. If your site has suddenly become slow, or your host flags unusual traffic or email volume, it is worth looking into.
Check 5: Unusual requests in your logs
If you have access logs, look for large numbers of requests to the same unusual address, or requests from tools you do not recognise. Your host can help you read these.
If you find something
Deleting the file you found is usually not enough, because there may be another way back in. Restore from a clean backup taken before the problem started, change every password and API key, remove unknown accounts, and update PHP, your CMS and plugins. If you are not sure where to start, your host or a developer who does this regularly can help.
Keeping it from happening again
For most sites, regular updates and good passwords cover a lot of it. Some businesses decide they would rather not maintain PHP at all and move to a static site, which has no PHP or plugins to update. If you want your site checked, or want to talk through options, the audit is free.
Free resource: Website security check
Free resource: Website health check
Read next: PHP2Shell: critical PHP vulnerability patched October 2026 · Is WordPress safe after PHP2Shell and wp2shell? · What attack surface means for a small business website
Questions
What are the most common signs a site has been hacked?
PHP files you did not create, admin users you do not recognise, or a sudden jump in server load.
Can my host tell me if I was hacked?
Often yes. Ask your host for access logs and scan results. Many hosts also block or quarantine known malicious files.
Should I just delete the suspicious files?
Usually not. Restore from a clean backup, change every credential and update whatever was out of date, so the same gap cannot be used again.