Guest Post by Ankit Pahuja
Do you know what happens when somebody hacks your WordPress site and infects it with malicious code (aka, malware)?
Usually, when hackers infect your site with malware, there’ll be subtle signs to indicate that something’s wrong. From abnormal spikes in website traffic to customer complaints about external redirects or pop-up ads, you’ll get many cues to act quickly — if you’re paying attention.
Let’s see them in more detail below.
What happens where there’s malware infecting your WordPress site?
Here are six things that definitely signal something’s up with your WordPress site:
#1. Compromised user experience and performance
The most coveted element of any WordPress site is the user experience it provides. Once the view of your visitors changes, this affects your site’s reputation and trust factor permanently. Any special services or original content you offer at this point will not make a difference to a customer impacted by malware.
Hacked sites infected with malware are bound to slow down as the server resources are diverted by the hackers to hacker-controlled domains. We all know that today’s viewer has a limited attention span (from 12 seconds to eight seconds), so a slow website is, bad for business.
#2. Unwanted ads and external redirects
Another issue that usually comes up is pop-up ads which are completely unrelated to the original content of the site and malicious in nature. They’re usually external redirects to other sites that trick the user into buying something or clicking other links that install viruses and/or malware on their systems.
These kinds of pop-up ads are due to hackers inserting malicious Javascript or iFrame resources. When the site loads, it takes double the time to load because of this malware, thus testing the customer’s patience and can simultaneously cause possible loss of sensitive information.
#3. Cryptocurrency mining
While we may all be familiar with cryptocurrencies like Bitcoin or Ethereum, some of us are less familiar with the concept of ‘mining.’ As these currencies gain traction, people have recognized crypto as a way to invest and get quick returns.
Therefore, hackers who are in the know about crypto install cryptocurrency miners and associated malware. So, every time the WordPress site loads, they use it to mine (think of dig, but virtual) cryptocurrency. If your site suddenly slows down without any obvious reasons, it may indicate the presence of mining malware.
#4. High usage of resources
Another thing that happens when there\’s malware infecting your WordPress site is that your site\’s server resources shrink.
As hackers snatch your server’s resources in terms of space and efficiency, your site is left with none. Hackers will ensure that they’re using your assets to their advantage, resulting in a slowed-down site for you.
For example, some hackers use multiple sites as a front for attacking other sites. Since using a single site can detected and blacklisted easily, the hackers use multiple reputable sites.
They also use a large amount of disk space, as hackers may have to store a large amount of malicious files. Even if you’ve a unlimited hosting plan, there’s a limit to the space you’re provided. Adding these files will make it difficult for you to add your authentic content.
Since they only use your resources and the most visible impact is a slowly loading site, most of us don’t suspect anything. However, look out for signs like your site becoming unavailable for some time because it’s being used for malicious activities.
#5. Spam emails
A strong indication your site’s been hacked is when your customers complain they’re getting a lot of spam emails. Around 60% of the internet traffic can be attributed to such spam emails. After the spam starts, even your own emails end up in the reader’s their spam folder, making them miss important information.
How do email servers detect spam emails? They’re on the constant lookout for IP addresses of servers that are blacklisted or keep sending spam emails. So, hackers work around this and search for clean IP addresses to send their spam emails. Usually, your host provider finds out something’s not right and warns you about it. By then, you may already have been blacklisted by search engines and suspended by hosts.
#6. SEO spam
Also known as pharma hacks, hackers fill your WordPress site with SEO spam that redirects users to other sites featuring illegal merchandise and medications. These spammy keywords often trick your users into getting infected by malware or installing viruses on their systems. Eventually, you’re at the risk of getting blacklisted by Google.
These are only a few ways of how WordPress sites generally get affected after malware is placed. If you’ve identified that your website is suffering an ongoing attack, read the WordPress malware removal guide for step by step malware removal. If you come across anything suspicious that isn’t on this list, do let us know in the comments below!
Ankit Pahuja
Marketing Lead & Evangelist at Astra Security
Ankit Pahuja
Marketing Lead & Evangelist at Astra Security.
Ever since his adulthood (literally, he was 20 years old), he began finding vulnerabilities in websites & network infrastructures. Starting his professional career as a software engineer at one of the unicorns enables him in bringing “engineering in marketing” to reality. Ankit is also an avid speaker in the security space and has delivered various talks in top companies, early-age startups, and online events.
