WordPress Malware Detected? What to Do

Wordfence found suspicious files. Or Google Search Console shows "Malicious software detected on [yoursite.com]". Or your hosting provider suspended your account with a "Malware Found" warning.

Your first instinct: panic. Your second: panic more. Your third should be: follow this guide step by step.

Malware removal is not mysterious. It's systematic. Do these steps in order. Don't skip. Don't guess. Follow exactly.

---

Before You Start: Understanding What Happened

You have one of these malware types:

1. Backdoor (Most Dangerous)

• Hidden PHP files allowing attackers to regain access
• Often obfuscated: eval(base64_decode(...))
• Common locations: wp-content/uploads/, theme files, mu-plugins/
• Fake filenames: wp-content.php, wp-includes.php (mimic real WordPress files)
• How you got it: Outdated plugin/theme, weak password, SQL injection

2. Pharma/SEO Spam (Most Common)

• Injects spam links (viagra, casino, cialis) into posts
• Often hidden with JavaScript cloaking (display: none, is_user_logged_in())
• Visible to Google and logged-out users, hidden from you (the admin)
• Damages SEO and gets your site blacklisted
• How you got it: Compromised plugin, spam bot, weak admin

3. Drive-By Download (Distributes Other Malware)

• Injects code to download malware onto visitor's computer
• Shows fake "your computer is infected" warning
• Asks user to install "antivirus" (which is malware)
• How you got it: Malicious plugin, compromised theme

4. Redirect/Hijack (Traffic Theft)

• Silently redirects visitors to attacker's site
• You might not notice (they're redirected instantly)
• Only visible if you check page source or server logs
• How you got it: Compromised plugin, fake theme

---

Step 1: IMMEDIATE — Take Your Site Offline (5 Minutes)

STOP. Do not delay. Do this now.

While you clean, attackers can still access your site. Stop them immediately.

Option A: Maintenance Mode (Fastest)

1. Go to WordPress admin (if you still have access)
2. Tools > Site Health > scroll to "Recovery Mode"
3. If available, enable Recovery Mode (WordPress 5.2+)
4. This disables all plugins and reverts to default theme (stops malware from running)

Option B: Disable All Plugins (Via FTP)

1. Connect via FTP or File Manager
2. Go to /wp-content/
3. Rename the "plugins" folder to "plugins-disabled"
4. All plugins instantly deactivate (malware in plugins can't run)
5. Your site might look broken, but that's fine — it's safe for now

Option C: Change All Passwords (If Can't Access Admin)

1. Change WordPress admin password via hosting control panel (cPanel/Plesk)
2. Change FTP/SFTP password in hosting control panel
3. Change hosting account password
4. This locks attackers out of everything

Option D: Move Site to Staging (Nuclear Option)

1. If you can't control the live site, move it to a staging domain
2. Or restore from a recent clean backup (if available)
3. This buys you time while you investigate the live site

Expected result: Your site is no longer actively infected. Malware can't run. Attackers can't access it.

---

Step 2: Check if You Have a Clean Backup (5 Minutes)

A clean backup is the fastest way to recover.

Where to look:

• Hosting control panel (cPanel: Backups, Plesk: Backup Manager)
• Third-party backup plugin: UpdraftPlus, Duplicator, BackWPup, Jetpack
• Manual backups you created: local files, Dropbox, Google Drive

What qualifies as "clean"?

• From BEFORE the infection (so it doesn't have malware)
• Ideally from 1-2 weeks ago (captures content but not malware)
• NOT from "3 days ago if you just noticed the infection 2 days ago" (it might have been infected already)

If you have a clean backup: Skip to "Restore from Backup" section below.

If you DON'T have a clean backup: Continue to Step 3 (manual cleaning).

---

Step 3: Scan With a Security Plugin (10-30 Minutes)

A security scanner tells you exactly what malware is on your site.

Option A: Wordfence (Most Popular)

1. If you disabled all plugins, rename "plugins-disabled" back to "plugins" (temporarily)
2. Go to Plugins > Add New
3. Search for "Wordfence Security"
4. Install and Activate
5. Go to Wordfence > Scan
6. Click "Start a new scan"
7. Wait for scan to complete (could be 5-30 minutes depending on site size)
8. Review scan results carefully

What Wordfence reports:

• Critical: Known malware, backdoors, suspicious files
• High: Vulnerable plugins, outdated themes
• Medium: File modifications, suspicious patterns

⚠️ IMPORTANT: 14% of infected sites in 2025 contained malware specifically designed to tamper with Wordfence files, making it report 'clean' while malware remains active. Do NOT trust Wordfence alone. Run MalCare too (next option).

Option B: MalCare (Catches What Wordfence Misses)

1. Go to Plugins > Add New
2. Search for "MalCare Security"
3. Install and Activate
4. Go to MalCare > Dashboard > Run Emergency Scan
5. Wait for scan to complete
6. Compare results with Wordfence

MalCare advantage: Cloud-based scanning (doesn't slow your site) and deep detection of obfuscated malware.

Option C: Sucuri Security (External Scan)

1. Go to Plugins > Add New
2. Search for "Sucuri Security"
3. Install and Activate
4. Go to Sucuri > Scan Website
5. Click "Scan Now"
6. Wait for external scan to complete

Expected result: You have a list of infected files, malware types, and severity levels. You know exactly what's wrong.

---

Step 4: Option A - One-Click Cleanup (If Available)

Some plugins offer automatic malware removal. If available, use it.

Wordfence One-Click Cleanup:

1. Go to Wordfence > Scan Results
2. Look for suspicious files with a red circle icon
3. If there's a "Delete" or "Fix" button next to each item, click it
4. Wordfence removes or cleans the file
5. After cleanup, run scan again to verify removal

MalCare One-Click Cleanup:

1. Go to MalCare > Scan Results
2. Click "Auto-Clean" button if available
3. Confirm you want to remove detected threats
4. MalCare removes malware automatically
5. Re-run scan to confirm it's gone

⚠️ Limitation: One-click cleanup works for straightforward infections. Complex, deeply obfuscated, or custom backdoors may not be fully removed. Proceed to Step 4B (manual) if one-click doesn't fully clean.

Expected result: Malware removed. Re-scan shows clean (or minimal findings).

---

Step 4: Option B - Manual Cleanup (If Needed)

For infections that automated cleanup missed.

Delete Suspicious Files

1. Connect via FTP or File Manager
2. Go to /wp-content/uploads/
3. Look for PHP files (they shouldn't be there — images/media only)
4. Filenames like: shell.php, uploader.php, admin.php, config.php, etc.
5. Delete them immediately

5. Go to /wp-content/mu-plugins/ (must-use plugins directory)
6. This folder is often empty. Any files here are suspicious unless you created them.
7. Check the content. If you see eval(base64_decode(...)), it's malware.
8. Delete the file

8. Go to /wp-content/themes/
9. Look for modified/added files (check "modified date" in FTP)
10. Backdoors often hide in functions.php or theme files with obfuscated code
11. Compare current version with clean version from wordpress.org or your backup
12. If code was added, remove it manually (carefully) or replace entire file with clean version

Reinstall Plugins & Themes

1. Go to WordPress > Plugins > Installed Plugins
2. Deactivate all plugins
3. Note which plugins you actually need (delete the rest)
4. Reinstall each plugin from WordPress.org (get fresh copy, not from your server)

5. Go to WordPress > Themes > All Themes
6. If you have a nulled/pirated theme (common source of malware), delete it immediately
7. Replace with a legitimate theme from wordpress.org or verified vendor

Clean WordPress Core Files

1. Download fresh WordPress from wordpress.org (matching your current version)
2. Via FTP, replace these files/folders with the fresh versions:
   • /wp-admin/ (entire folder)
   • /wp-includes/ (entire folder)
   • wp-load.php
   • wp-settings.php
   • index.php
3. Do NOT replace wp-config.php (contains your database settings)
4. Do NOT replace /wp-content/ (has your customizations)

Expected result: All malicious files deleted or replaced with clean versions.

---

Step 5: Clean Your Database (Complex but Important)

Malware doesn't just live in files — it also hides in your database.

Check for spam posts (Pharma/Casino injections):

1. Go to WordPress > Posts > All Posts
2. Search for common spam keywords: "viagra", "casino", "cialis", "porn", "gambling"
3. Delete all posts that contain these terms
4. Also check for posts with suspicious/hidden content (titles you didn't create)

Check for hidden users (backdoor accounts):

1. Go to WordPress > Users > All Users
2. Look for accounts you didn't create: "officialwp", "admin2", "backup", etc.
3. Click on each suspicious user > Delete (choose "Delete all their posts" or "Attribute to [admin]")
4. Also verify no new admin users were added (everyone should be subscriber/editor/contributor, not admin)

Advanced: Database Injection (Optional, Requires phpMyAdmin)

If scans found database injections, you need phpMyAdmin (usually in hosting control panel):

1. Go to cPanel/Plesk > phpMyAdmin
2. Select your WordPress database
3. Go to wp_options table
4. Look for suspicious options (keys like "hdracore", "blacklisted_keys", etc.)
5. Delete rows with suspicious keys

⚠️ Only do this if you're comfortable with databases. One wrong deletion = site breaks.

Expected result: No spam posts, no rogue users, no malicious database entries.

---

Step 6: Reset All Passwords (Critical)

Attackers likely harvested your passwords. Reset everything.

1. WordPress admin: Settings > Users > Your Profile > Change Password (use a strong, unique password)
2. FTP/SFTP account: Hosting control panel > Change password
3. Hosting control panel: Account Settings > Change password
4. Database credentials: Hosting control panel > reset MySQL password
5. Email account: Go to your email provider > Change password
6. Any API keys: If you use SendGrid, Stripe, etc., regenerate API keys

Password requirements: 16+ characters, mix of upper/lower/numbers/symbols, never used before

Expected result: All old credentials are useless. Attackers can't log back in.

---

Step 7: Verify Malware Is Gone (10 Minutes)

Run scans AGAIN to confirm removal. Do not skip this.

1. Wordfence > Scan > Start a new scan
2. Wait for completion
3. Review results — should show no critical issues
4. If still finding malware, go back to Step 4B (manual cleanup)

5. MalCare > Run Emergency Scan
6. Compare with Wordfence results
7. If MalCare finds something Wordfence missed, manually delete it (Step 4B)

8. Google Search Console: If Google blacklisted your site, submit "Request a Review"
9. Wait 24-72 hours for Google to re-scan (should show clean now)

Expected result: Multiple scans show zero critical malware. Site is clean.

---

Step 8: Restore From Backup (If You Have One)

This is the SAFEST method, if you have a clean backup from BEFORE infection.

1. Note current date/time (so you know when site became infected)
2. Go to your backup (UpdraftPlus, cPanel, etc.)
3. Choose a backup from at least 2 weeks ago (before infection likely occurred)
4. Click "Restore"
5. Wait for restoration to complete (usually 5-30 minutes)
6. Your site reverts to the clean backup state
7. Any posts/changes made after the backup are lost (acceptable trade-off for removing malware)

After restoration: Update all plugins, update WordPress core, update all themes to latest versions (so vulnerabilities that led to infection are patched).

Expected result: Site is completely clean. Malware is gone along with any data added after backup.

---

Step 9: Harden Your Site (Prevent Reinfection)

Malware got in once. Close the doors so it can't again.

Update Everything Immediately

• WordPress core: Dashboard > Updates > Update Now
• All plugins: Plugins > Updates > Update All
• All themes: Themes > Check for updates > Update

Disable File Editing

1. Connect via FTP or File Manager
2. Open wp-config.php
3. Add this line (near the top, before "That's all, stop editing!"):

define( 'DISALLOW_FILE_EDIT', true );

4. Save and upload
5. This prevents attackers (and you) from editing theme/plugin files via WordPress admin

Install a Web Application Firewall

1. Install Wordfence Security or Sucuri (both include firewalls)
2. Both block malicious requests BEFORE they reach WordPress
3. This is your first line of defense

Set Strong File Permissions

1. Connect via FTP
2. Set directory permissions to 750
3. Set file permissions to 640
4. Set wp-config.php to 600 (most restrictive)

Delete Unused Plugins & Themes

1. WordPress > Plugins > Installed Plugins > Deactivate & Delete any you don't use
2. WordPress > Themes > Delete any themes you don't use
3. Fewer plugins = fewer vulnerabilities

Change Admin Username

1. Create a new admin user with a unique, random username
2. Delete the default "admin" user (attribute posts to new user)
3. Attackers commonly target "admin" username

Enable Two-Factor Authentication

1. Install "Wordfence Security" or "Jetpack" (both support 2FA)
2. Enable 2FA for all admin accounts
3. Now even if password is compromised, attacker can't log in without the 2FA code

Set Up Automatic Backups

1. Install UpdraftPlus (free version is fine)
2. Go to UpdraftPlus > Settings > configure daily backups to cloud storage (Google Drive, Dropbox)
3. Now if malware hits again, you have a clean backup to restore from

Expected result: Site is hardened. Vulnerabilities that allowed initial infection are closed. Reinfection is unlikely.

---

Professional Help (When to Call In Experts)

Do you need professional malware removal?

YES, hire a pro if:

• Your site was infected multiple times (missed backdoors likely remain)
• You don't have technical PHP/server knowledge
• Scans still show malware after manual cleanup
• Your hosting provider demands removal proof within 24 hours
• It's a high-traffic site and you can't afford downtime for troubleshooting

Cost:

• Wordfence Site Cleaning: $490 one-time per site
• Sucuri Malware Removal Service: $199.99/year (unlimited cleanups)
• Codeable/Fiverr freelancers: $100-500 depending on complexity

DO NOT: Hire someone who charges per hour and doesn't guarantee removal. Malware removal is project-based, not hourly.

---

Timeline: How Long Will This Take?

Simple infection (one-click cleanup works):
Step 1-2: 5 minutes
Step 3-4A: 30 minutes
Step 6-7: 10 minutes
Total: ~45 minutes

Complex infection (manual cleanup needed):
Step 1-2: 5 minutes
Step 3-4B: 2-4 hours (finding and removing all backdoors)
Step 5: 30 minutes
Step 6-7: 15 minutes
Total: 3-5 hours

Complete restoration from backup:
Step 1-2: 5 minutes
Step 8: 30 minutes (restore)
Step 9: 30 minutes (hardening)
Total: 1 hour

Hiring professional:
Depends on pro's availability. Usually 24-48 hours.

---

The Real Talk

Malware happens. Not because you did anything wrong, usually. It's because:

• You used a nulled/pirated theme (common malware vector)
• A popular plugin had a vulnerability you didn't patch
• Someone brute-forced your weak password
• You're on super cheap shared hosting (poor security)

The removal process is straightforward but tedious. There's no magic shortcut. Follow steps in order. Run scans multiple times. Verify removal. Harden the site. Backup regularly.

Most sites can be cleaned in 1-2 hours if you follow this guide. Professional removal costs $200-500 and takes 24-48 hours. Pick based on your technical comfort and time available.

After cleanup, your site works again. Traffic recovers. Google unblocks you. But next time? Backup daily, update weekly, and use a firewall. Prevention beats cleanup every time.