A hacked WooCommerce store rarely announces itself with an obvious warning. More often, a customer reports an unexpected redirect, Google flags the domain, or you find an administrator account you don’t recognize.
These are the first signs I look for when a store owner or agency suspects a WooCommerce site has been compromised.
Customers land somewhere they did not expect
Redirects to spam sites, phishing pages, or fake checkout pages are some of the clearest signs of a compromised store. Sometimes the homepage looks normal on your computer but behaves differently on mobile devices, or only redirects visitors who aren’t logged in.
This is often deliberate. Attackers may hide malicious code from administrators so the site appears normal while you’re signed in. That’s why it’s important to test the store as a regular visitor, not just from the WordPress dashboard.
New users, plugins, or files appear on your site
Check the Users screen for administrator accounts you don’t recognize. Then compare the plugin list with what you actually installed and approved.
Unexpected PHP files in wp-content/uploads, changes to wp-config.php, or modifications to index.php are worth investigating. File timestamps can help narrow down when something changed. A recent timestamp isn’t proof of malware on its own, but it gives you a place to start.
Spam content appears in search results
Hacked stores sometimes develop hidden pages targeting pharmaceutical products, gambling, or other unrelated search terms. You may not see these pages in the WordPress dashboard.
Google Search Console, an XML sitemap containing unfamiliar URLs, or a Google search for site:yourstore.com can help uncover them. The checkout may still accept orders while these pages run in the background.
Checkout, email, or payment behavior changes
Watch for checkout scripts you don’t recognize, payment instructions that no longer match your processor, or customers who report paying but can’t find their orders.
Malicious code can be injected into checkout pages to capture payment details. Similar symptoms can also come from a broken plugin or payment gateway integration. Treat the situation as urgent either way, and inspect the checkout in a clean browser session without an administrator login cookie.
Your host, Google, or a customer warns you
Google Safe Browsing warnings, hosting provider notifications about outbound spam, or bounced emails caused by suspicious server activity should not be ignored.
If outgoing email volume suddenly increases, investigate whether something on the website or server is sending it. Don’t assume it’s a normal mail delivery issue until you’ve checked.
What to do before you start clicking
Ask your hosting provider to take a snapshot of the current site if possible. Preserve its state before making changes, and don’t blindly restore an old backup until you have a better idea of when the infection started.
Changing the administrator password is a sensible precaution, but it isn’t a cleanup. Any malicious files, database changes, or compromised access points still need to be investigated.
If you need help working through these issues, I provide Hacked WordPress and malware removal. Send the store URL and a description of what you’re seeing through the contact form.