WordPress Malware Removal: Step by Step

Your WordPress site is hacked. What do you do first?

Stop. Don’t start deleting files or reinstalling WordPress yet. The wrong move here can destroy evidence you need to find the entry point, or worse, trigger a backup restoration that’s also infected.

The first 30 minutes determine whether this is a 4-hour fix or a 4-day nightmare. Here’s the priority order:

1. Confirm the infection is real (not a false positive)
2. Contain the damage (prevent it from spreading)
3. Preserve evidence (you need this to find the entry point)
4. Clean the infection
5. Find and close the entry point
6. Harden against reinfection

Skip step 5 and you’ll be cleaning the same site again in two weeks. Most reinfections happen because someone cleaned the malware but never found how the attacker got in.

How to confirm your WordPress site is infected

Not every weird behavior is malware. Plugin conflicts, PHP errors, and hosting issues can mimic infection symptoms. Confirm before you panic.

Quick external scan: Run your URL through Sucuri SiteCheck (sitecheck.sucuri.net). It checks for known malware signatures, blacklisting status, and suspicious redirects from outside your server.

Check Google Search Console: Go to Security & Manual Actions > Security Issues. If Google has flagged your site, they’ll tell you exactly what they found and on which URLs.

Check your hosting panel: Many hosts (SiteGround, GoDaddy, Bluehost) run automated malware scans. Check your hosting dashboard for security alerts or suspension notices.

Signs that confirm infection:

Step 1: Contain the damage

Before cleaning anything, limit the blast radius.

Change all passwords immediately:

• WordPress admin accounts (all of them)
• Database password (update wp-config.php after changing)
• SFTP/FTP credentials
• Hosting panel (cPanel) password
• Any connected services (email, CDN, DNS)

Revoke all active sessions: Add this to wp-config.php temporarily to force all users to re-authenticate:

// Invalidate all existing cookies
define('COOKIEHASH', md5('new-random-string-' . time()));

Take the site offline if it’s actively spreading malware. Create a maintenance page at the server level (not through WordPress, since WordPress itself may be compromised):

# In .htaccess (temporary)
RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^YOUR\.IP\.ADDRESS$
RewriteRule .* /maintenance.html [L]

Replace with your actual IP so you can still access the site while it’s offline for everyone else.

Step 2: Preserve evidence and create a backup

Back up the infected site before cleaning it. You need this to:

• Compare against clean files to find what was modified
• Identify the entry point after cleanup
• Restore specific content if you accidentally delete legitimate files

Download a full backup: all files via SFTP and a database export via phpMyAdmin. Label it clearly as “infected backup” so nobody accidentally restores it.

Step 3: Scan and identify infected files

WordPress core files

Compare your core files against the official release:

wp core verify-checksums

Any file that fails the checksum has been modified. Common targets: wp-includes/version.php, wp-admin/includes/class-wp-upgrader.php, and index.php in the root.

Plugin and theme files

wp plugin verify-checksums --all

This only works for plugins from the wordpress.org repository. For premium plugins, you’ll need to compare against a fresh download from the vendor.

The uploads directory

Search for PHP files where they shouldn’t exist:

find wp-content/uploads -name "*.php" -type f

There should be zero PHP files in uploads. Any you find are almost certainly backdoors. Common disguises: wp-tmp.php, class-wp-cache.php, or files with names mimicking WordPress core.

Database injections

Check for JavaScript injections in post content:

SELECT ID, post_title FROM wp_posts
WHERE post_content LIKE '%<script%'
AND post_content NOT LIKE '%youtube%'
AND post_content NOT LIKE '%twitter%';

Also check the wp_options table for injected code in siteurl, home, active_plugins, or widget content.

Step 4: Clean the infection

Replace WordPress core

Don’t try to clean individual core files. Download a fresh copy of your exact WordPress version and replace the entire wp-admin/ and wp-includes/ directories:

wp core download --force --skip-content

This overwrites all core files with verified clean copies. Your content, plugins, and themes in wp-content/ are untouched.

Clean or replace plugins

For any plugin that failed checksum verification: delete it and reinstall from wordpress.org or the vendor. Don’t try to identify which specific file was modified. A fresh install is faster and more reliable.

Clean the database

Remove any injected scripts from post content. If the injection is consistent (same script tag across many posts), a SQL query handles it:

UPDATE wp_posts
SET post_content = REPLACE(post_content, '<script src="https://malicious-domain.com/inject.js"></script>', '')
WHERE post_content LIKE '%malicious-domain.com%';

Check wp_options for modified siteurl and home values. Verify active_plugins hasn’t been tampered with to auto-load a malicious plugin.

Remove backdoors

Backdoors are the files attackers leave behind to regain access after you clean the obvious malware. Common patterns to search for:

grep -r "eval(" wp-content/ --include="*.php"
grep -r "base64_decode" wp-content/ --include="*.php"
grep -r "str_rot13" wp-content/ --include="*.php"
grep -r "\$_REQUEST" wp-content/uploads/ --include="*.php"
grep -r "FilesMan" wp-content/ --include="*.php"

Not every eval() or base64_decode is malicious. Some legitimate plugins use them. But any occurrence in the uploads directory or in files that don’t belong to a known plugin is suspicious.

Step 5: Find the entry point

This is the step most people skip. If you don’t find how the attacker got in, they’ll get back in the same way.

Check your access logs. Look for POST requests to unusual files, especially in wp-content/uploads/ or plugin directories. The timestamp of the first suspicious request tells you when the compromise started.

Check plugin vulnerability databases. Cross-reference your plugin list (including versions from before the hack) against WPScan’s vulnerability database or Patchstack. If a plugin you were running had a known exploit during the timeframe of the hack, that’s likely your entry point.

Common entry points in 2026:

• Vulnerable plugin with a public exploit (90% of cases)
• Compromised admin credentials (weak password, no 2FA)
• Vulnerable theme (especially nulled/pirated themes)
• Compromised hosting account (shared hosting neighbor attack)

Step 6: Prevent reinfection

After cleanup, harden the site so the same attack can’t work again. Our guide on how to harden WordPress beyond plugins covers the full server-level approach. At minimum:

• Update everything (core, plugins, themes, PHP)
• Remove the vulnerable plugin that was the entry point (replace with an alternative)
• Enable 2FA on all admin accounts
• Set correct file permissions (755 directories, 644 files, 600 wp-config.php)
• Block PHP execution in uploads via .htaccess
• Disable XML-RPC if not needed
• Install a file integrity monitoring solution

What about professional cleanup services?

If you’re not comfortable with SSH, SQL queries, and file-level forensics, hire someone. The cost of a professional cleanup ($200-$500 for standard infections) is almost always less than the cost of extended downtime, lost revenue, and potential Google blacklisting.

What to look for in a cleanup service:

• Same-day or next-day response time
• They find and document the entry point (not just clean symptoms)
• They harden the site after cleanup (not just restore and walk away)
• They provide a written report of what was found and fixed
• They offer a reinfection guarantee (30-90 days)

Next step

If you’re reading this because your site is actively compromised: change your passwords right now. All of them. Then follow the containment steps above before touching any files.

If you’re reading this preventatively: run wp core verify-checksums and check your uploads directory for PHP files. If both come back clean, your immediate priority is ensuring your plugins are updated and your admin accounts have 2FA enabled. Prevention is always cheaper than cleanup.