What a hacked WordPress site actually looks like
A Montana organization we work with had a WordPress site that started bouncing visitors to a spam page. We traced the infection from the outside, and what we found is worth writing down, because the shape of it is the same across thousands of hacked WordPress sites right now.
The anatomy
The site ran a conditional redirect: certain visitors got thrown to a gambling-spam landing page. That landing page was not the attacker's server. It was hosted inside another hacked WordPress site that had no idea it was carrying the payload.
This is a mass campaign. The botnet compromises WordPress sites in bulk and uses each victim to host spam for the next.
The nastier part is the cloaking. The malware serves gambling spam only to Google's real crawler IP ranges. Humans get the normal site. Security scanners get the normal site.
The whole point is that the site looks clean from every chair you can sit in, while Google indexes hundreds of spam pages under the victim's domain.
"It got fixed" is doing a lot of work in that sentence
By the time we looked, the visible redirect was gone. Someone had cleaned it up. But removing the redirect you can see is painting over water damage without fixing the roof.
The stain was the symptom. The leak is a backdoor, and the whole reason these campaigns plant backdoors is to reinfect after the visible symptom gets cleaned.
On a compromised WordPress install, persistence hides in a short list of places: recently modified PHP files, PHP where it should never live (like the uploads folder), fake must-use plugins, injected rows in the options table, scheduled tasks, .htaccess rules, and large base64 blobs inside otherwise normal files. External scanning cannot see any of it. Only a scan on the server itself, files and database both, can.
How they get in
This site had 3 open doors, and none of them is exotic. A full development copy of the site sat on a public subdomain, indexed by Google. The REST API leaked the super-admin username to anyone who asked.
And the plugin list included an abandoned payment plugin that had not seen an update in years. Every aging WordPress site we audit has some version of this list.
What real cleanup means
If your site got hacked and your developer says it is fixed, ask one question: what did the server-side scan cover? The honest answer names files and the database, on the live server, plus a credential rotation and fresh WordPress salts afterward, so any stolen session or password dies with the infection. If the answer is "the redirect is gone and the site scans clean," you now know exactly what that is worth.
None of this means WordPress is doomed. It means a website is a thing you maintain, like anything else you own that sits outside in the weather. Patch it, retire dead plugins, keep dev copies off the public internet, and hacks like this one mostly never start.