7 Signs Your WooCommerce Store Has Been Hacked (and How to Check Each One)

Written by a working vulnerability researcher who reads WooCommerce plugin source for a living. This is the checklist I run when a store owner suspects a compromise - in plain language, no fluff.

1. Unexpected admin or shop-manager accounts

The most common goal of a WooCommerce attack is a persistent foothold. Go to Users -> All Users and sort by role. Any admin or shop-manager account you don't recognize - or any account created on a date that matches a traffic spike - is a red flag. Attackers often use innocuous names (wpsupport, backupadmin).

2. Orders marked paid that never settled

A whole class of plugin bugs I find lets a buyer tell the checkout to charge $1 (or $0) while the order total stays full price, or lets an unauthenticated request flip an order straight to payment complete. Reconcile your WooCommerce order totals against what actually landed in Stripe/PayPal/your gateway. A gap means either a bug in a payment add-on or active abuse.

3. New scheduled tasks or unknown files in wp-content

Check Tools -> Site Health -> Info -> WP-Cron for tasks you didn't create, and look for recently-modified PHP files in wp-content/uploads (uploads should never contain .php). Web-shell backdoors hide there after an upload-validation bug.

4. Your storefront redirects or injects spam

Open your store in a private window from mobile data (not your office IP - many injections whitelist logged-in admins and known IPs). Look for pop-ups, pharma/SEO spam in page source, or redirects to another domain. View source and search for base64_decode, eval(, or unfamiliar external script tags.

5. Plugins you didn't install, or ones that silently reactivated

Attackers install their own plugin as a payload delivery mechanism, or reactivate an abandoned one with a known bug. Audit Plugins -> Installed and remove anything unused. Every plugin runs with your store's full privileges.

6. Outbound spam or a blacklisted domain

Compromised stores get used to send spam. If customers report phishing from your domain, or your transactional emails start landing in spam, check your domain against a blacklist lookup and review your mail logs.

7. Admin settings that changed on their own

Check your payment gateway API keys, admin email, and site URL (Settings -> General). Several plugin vulnerabilities let an unauthenticated request overwrite stored settings - including the account that receives your payouts.

What to do if you find something

• Take a full backup first (evidence + rollback point) before you change anything.
• Reset all admin passwords and force logout of all sessions; rotate payment gateway API keys.
• Update or remove every plugin; delete any you don't actively use.
• Restore from a known-clean backup if you can't be sure the store is clean.

Prevent the next one

Most WooCommerce compromises trace back to a vulnerable or abandoned plugin, a payment add-on that trusts client-supplied data, or an admin account without 2FA. I built a free, browser-only self-assessment that scores your store across exactly these areas in about five minutes - it uploads nothing and asks for no login: WooShield free WooCommerce security checklist.

About: I do defensive security research on WooCommerce/WordPress plugins and have reported real unauthenticated vulnerabilities in e-commerce add-ons. The checklist and a deeper field guide live at smeltworks.com/wooshield.