WordPress Site Infected With Malware - Complete Removal Guide

You get an email from Google.

"Your site has been infected with malware."

Or your hosting provider calls: "We've disabled your site due to suspicious activity. You have 24 hours to fix it or we'll delete it."

Or your site redirects to a spam page you didn't create.

Or you notice strange files in your wp-content/ folder that you didn't upload.

Your WordPress site is infected.

A client's WordPress site got hacked while they were on vacation. Hackers installed a backdoor. They uploaded shell files. They injected code into wp-config.php. The site was pushing malware to every visitor.

By the time the client noticed (a user complained about malware warnings), the site had been compromised for 2 weeks. Google had blacklisted it. Every backup was infected.

We had to manually dig through 40,000 files, identify the malware, remove it, and rebuild the site's reputation with Google.

It took 4 days of work. It cost thousands of dollars. It could have been prevented with $200 worth of security plugins.

Malware removal is complex. It's not just deleting a file and moving on. Hackers leave backdoors. They obfuscate code. They hide in unexpected places. If you miss one piece, they reinstall everything.

But if you follow a systematic process, you can remove malware completely. And you can stop it from happening again.

How WordPress Gets Infected

Understanding how you got infected helps prevent future infections.

  • Outdated WordPress: Running old version with known vulnerabilities. Hackers exploit them automatically.
  • Outdated plugins: Plugin has security flaw. Thousands of sites automatically scanned and exploited.
  • Weak password: Brute force attack. Attacker guesses admin password. Installs malware from inside wp-admin.
  • Unpatched theme: Vulnerable theme code. Hackers inject malware through it.
  • Malicious plugin: You installed a plugin that was trojanized. Looks legitimate but contains backdoor.
  • FTP credentials stolen: Attacker had your FTP password. Uploaded malware files directly.
  • Database exposed: Database accessible from internet. Attacker modified database directly.
  • Infected backup: You restored from backup that was already infected.
  • Trusted user account compromised: A user with access had weak password. Attacker used their account.

In most cases, it's outdated software. Running old WordPress, old plugins, old themes is an open door.

Step 1: Assess the Damage

Before you remove anything, understand what you're dealing with.

Check Google Search Console

  1. Go to Google Search Console (search.google.com/search-console/)
  2. Check your site
  3. Look for "Security Issues" section
  4. Google will tell you:
    • What kind of malware detected
    • When it was detected
    • How many pages infected
    • Sample URLs
  5. Take note of all this info

Check your hosting provider

  1. Check email for warnings from hosting
  2. Log into hosting control panel
  3. Look for any alerts or notifications
  4. Check if your site was suspended
  5. Ask support what they detected

Scan for malware

  1. Install security plugin (Wordfence, iThemes Security, Sucuri)
  2. Run full malware scan
  3. Let it complete (can take 30-60 minutes)
  4. Note all files it flags as infected
  5. Download the scan report

Check access logs

  1. Ask hosting for server access logs
  2. Look for suspicious access patterns
  3. Check for:
    • Failed login attempts (brute force)
    • Unusual file uploads
    • Access to admin files
    • Requests to wp-admin from unknown IPs
  4. This tells you how attacker got in

Step 2: Take Complete Backup (Before Cleaning)

Backup the infected site. You need the malware files for analysis if cleaning fails.

Back up database

  1. Open phpMyAdmin
  2. Select your database
  3. Click Export
  4. Save the .sql file as "infected-backup.sql"
  5. Label it with date: "infected-2025-08-26.sql"

Back up all files

  1. Connect via FTP
  2. Select entire WordPress root folder
  3. Download all files
  4. Zip them locally
  5. Label: "infected-files-2025-08-26.zip"

This is your emergency copy. If you make a mistake during removal, you can reference this to find what you missed.

Step 3: Identify Malware Files

Find exactly what was infected. Use multiple tools for accuracy.

Use Wordfence scan results

  1. Go to Wordfence > Scan
  2. Look at "Alerts" section
  3. Click each alert to see details
  4. Note file path and type (malware, backdoor, suspicious code, etc.)
  5. Write down each file name

Look for common malware locations

Attackers hide files in predictable places:

  • wp-content/uploads/ (looks like legitimate uploads)
  • wp-content/plugins/ (fake plugins or compromised real ones)
  • wp-content/themes/ (backdoors in themes)
  • wp-content/ root (shell files)
  • wp-admin/ (modified core files)
  • Root directory (backdoor scripts)
  • wp-includes/ (modified core files)

Look for suspicious file names

Common malware file names:

  • shell.php, shell123.php, admin.php
  • config.php (in unexpected locations)
  • index.php (duplicates in various folders)
  • Files with random names: abc123.php, xyz.php, a.php
  • Files with no extension: shell, backdoor, access
  • Files in wp-content/uploads that aren't images: .php, .jar, .exe files
  • Files with suspicious dates (newer than your last legitimate update)

Check file modification dates

  1. Connect via FTP
  2. Sort files by "Date Modified"
  3. Look for files modified after infection date
  4. These are likely suspicious
  5. Check each one before deleting (make sure it's not legitimate WordPress file)

Use security plugin scanner

  1. Wordfence, iThemes Security, or Sucuri will flag suspicious files
  2. Trust their assessment
  3. They have databases of known malware signatures
  4. If they say it's malware, it's malware

Step 4: Remove Malware Files

Delete every identified malware file. Be thorough.

Delete via FTP

  1. Connect via FTP
  2. Navigate to first malware file location
  3. Right-click the file
  4. Select "Delete"
  5. Confirm deletion
  6. Repeat for every file on your list

Delete via hosting file manager

  1. Log into hosting control panel
  2. Open File Manager
  3. Navigate to each malware file
  4. Right-click and delete
  5. Confirm each deletion

Delete via SSH command line

For multiple files, SSH is faster:

rm /path/to/malware-file1.php
rm /path/to/malware-file2.php
rm /path/to/malware-file3.php

Double-check deletion

  1. Refresh FTP file list
  2. Verify each malware file is gone
  3. Search by file name to make sure no copies remain

Step 5: Clean Database for Injected Code

Attackers inject code into database. Deleting files isn't enough.

Check wp-options for malicious settings

  1. Open phpMyAdmin
  2. Go to wp_options table
  3. Look for suspicious option_name entries
  4. Search for option_name containing:
    • "redirect" (malicious redirect)
    • "injected" (injected code)
    • "shell" (shell code)
    • Random strings that don't look like WordPress options
  5. Delete any suspicious entries

Check wp_posts and wp_postmeta for injected code

  1. Go to wp_posts table
  2. Use "Search" feature
  3. Search post_content for:
    • <?php (code injection)
    • eval( (dangerous function)
    • base64_decode (encoded malware)
    • <iframe (malicious embed)
  4. If found, view the post
  5. Delete malicious code from content
  6. Or delete post entirely if heavily infected

Check wp_users for unauthorized accounts

  1. Go to wp_users table
  2. Look for accounts you don't recognize
  3. Attackers create new admin accounts for persistence
  4. If found, delete the user (click Delete in phpMyAdmin)
  5. Also delete their associated metadata in wp_usermeta

Check wp_usermeta for elevated privileges

  1. Go to wp_usermeta table
  2. Look for wp_capabilities entries
  3. Find any user who shouldn't be admin but has administrator role
  4. Edit their wp_capabilities and remove admin privileges

Run SQL cleanup commands

Use phpMyAdmin's SQL tab to run these:

-- Delete suspicious options
DELETE FROM wp_options WHERE option_name LIKE '%redirect%' OR option_name LIKE '%shell%';

-- Find posts with injected code
SELECT * FROM wp_posts WHERE post_content LIKE '%

Be careful with SQL. If unsure, ask for help before running delete commands.

Step 6: Check and Clean wp-config.php

Attackers often modify wp-config.php to add backdoors.

Download and review wp-config.php

  1. Connect via FTP
  2. Download wp-config.php
  3. Open in text editor
  4. Look for anything you don't recognize

Look for injected code

Malicious code in wp-config.php usually appears:

  • BEFORE <?php (outside the PHP tag)
  • AFTER the database configuration
  • Containing: eval(), base64_decode, system(), exec(), passthru()
  • Creating connections to external servers

Clean wp-config.php

  1. If you find injected code, delete the suspicious lines
  2. Keep only these sections:
    • Database configuration (DB_NAME, DB_USER, DB_PASSWORD, DB_HOST)
    • Database prefix ($table_prefix)
    • Authentication keys (AUTH_KEY, SECURE_AUTH_KEY, etc.)
    • ABSPATH definition
    • require_once statement at end
  3. Delete everything else that looks suspicious
  4. Save and upload cleaned file

If you're not sure what's legitimate, compare against a fresh WordPress wp-config.php or ask for help.

Step 7: Reset All Passwords

Attackers have access. Reset everything.

Change all user passwords

  1. Log into wp-admin (if you can)
  2. Go to Users
  3. Click each user
  4. Set a new password (strong: 16+ characters, mixed case, numbers, symbols)
  5. Click "Update User"
  6. Repeat for every user

If you can't access wp-admin

Reset via database:

  1. Generate new password hash (use password generator tool)
  2. Open phpMyAdmin
  3. Go to wp_users table
  4. Click "Edit" next to your user
  5. Find user_pass field
  6. Click the MD5 dropdown
  7. Set value to: MD5('newpassword123')
  8. Click "Go"
  9. User password is reset

Change FTP password

  1. Go to hosting control panel
  2. Find FTP section
  3. Reset FTP password
  4. This blocks attacker's FTP access

Change database password

  1. Go to hosting control panel
  2. Find MySQL/Database section
  3. Reset database password
  4. Update wp-config.php with new password
  5. Upload updated wp-config.php

Change hosting control panel password

  1. Go to your hosting provider's website
  2. Log out completely
  3. Click "Forgot Password" or similar
  4. Reset your hosting account password
  5. Create strong new password

Step 8: Remove Backdoors

Attackers leave backdoors for future access. Find and remove them all.

Common backdoor locations

  • wp-admin/admin.php or admin-ajax.php (modified core files)
  • wp-includes/functions.php (injected code)
  • wp-content/index.php (shell file)
  • Root index.php (modified to connect to attacker server)
  • .htaccess (rewrite rules to serve malware)
  • wp-content/plugins/[plugin-name]/loader.php (trojanized plugin)

Check index.php files

  1. Check index.php in WordPress root
  2. Check index.php in wp-admin/
  3. Check index.php in wp-content/
  4. Check index.php in wp-includes/
  5. These should be standard WordPress files
  6. If modified dates are recent, they might be backdoors
  7. Compare against fresh WordPress install if suspicious

Check .htaccess

  1. Download .htaccess from WordPress root
  2. Open in text editor
  3. Look for:
    • RewriteRule entries you don't recognize
    • Redirects to external sites
    • Obfuscated code
    • Base64 encoded strings
  4. If found, delete suspicious lines
  5. Or replace with clean .htaccess from fresh WordPress
  6. Save and upload

Check plugins for backdoors

  1. Go to wp-content/plugins/
  2. For each plugin folder, check main plugin file
  3. Look for eval(), base64_decode, system() calls
  4. Compare against plugin's repository version (WordPress.org)
  5. If different, plugin is compromised
  6. Deactivate and delete the plugin
  7. If legitimate plugin, reinstall from scratch

Check themes

  1. Go to wp-content/themes/
  2. Check functions.php in your active theme
  3. Look for suspicious code
  4. Compare against legitimate version (if available)
  5. If compromised, redownload and reinstall theme

Step 9: Run Full Security Scan Again

After cleaning, verify malware is completely gone.

Run security plugin scan

  1. Go to Wordfence > Scan
  2. Click "Start a New Scan"
  3. Let it complete fully (1-2 hours)
  4. Review scan results

If scan finds MORE malware

You missed something.

  1. Note every file it flags
  2. Repeat Steps 4-6 (delete files, clean database, remove backdoors)
  3. Run scan again
  4. Keep repeating until scan is completely clean

If scan finds NOTHING new

Malware appears to be removed. Continue to Step 10.

Step 10: Request Malware Review from Google

Tell Google you cleaned the site. Ask them to rescan.

Request review in Google Search Console

  1. Go to Google Search Console
  2. Go to Security Issues section
  3. Click "Request a Review"
  4. Google will rescan your site
  5. This usually takes 24-48 hours

While waiting for Google

  1. Verify site works correctly
  2. Test all pages load
  3. Test forms submit
  4. Check that no redirects are happening
  5. Verify no malware warnings in browser

After Google approves

  1. Google will remove malware warning from search results
  2. Your site will be listed normally again
  3. Traffic should recover within days

Step 11: Reinstall WordPress from Scratch (Optional but Recommended)

If infection was severe, completely reinstall WordPress to be absolutely sure.

When to reinstall from scratch

  • If you found 5+ malware files
  • If database was heavily infected
  • If you're not 100% confident all malware is removed
  • If attacker had admin access for weeks

How to reinstall

  1. Back up your content (posts, pages, images)
  2. Export content as .xml file (Tools > Export)
  3. Delete all WordPress files via FTP
  4. Delete database via phpMyAdmin (DROP entire database)
  5. Create new blank database
  6. Download fresh WordPress from wordpress.org
  7. Upload to server
  8. Run WordPress installation wizard
  9. Create new admin user
  10. Import previous content .xml file (Tools > Import)
  11. Reinstall themes and plugins from scratch

This ensures absolutely no malware remains but takes 2-3 hours.

Step 12: Harden Security to Prevent Reinfection

Once cleaned, secure your site so this never happens again.

Update everything immediately

  • WordPress core to latest version
  • All plugins to latest versions
  • Theme to latest version

Remove unused plugins and themes

  1. Delete all plugins you don't use
  2. Delete all themes except one active
  3. Unused software = unpatched vulnerabilities

Install security hardening

  1. Install Wordfence (free firewall + malware scanner)
  2. Or iThemes Security
  3. Or Sucuri
  4. Configure to:
    • Block brute force attacks
    • Run daily malware scans
    • Monitor file integrity
    • Alert on suspicious activity

Enable two-factor authentication

  1. Install "Google Authenticator" or "Authy" plugin
  2. Enable 2FA for all admin users
  3. This blocks account access even if password is compromised

Limit login attempts

  1. Install "Limit Login Attempts" plugin
  2. Configure to block after 5 failed logins
  3. This stops brute force attacks

Set up strong passwords

  1. All admin passwords: 16+ characters, mixed case, numbers, symbols
  2. FTP password: equally strong
  3. Database password: equally strong
  4. Hosting account password: equally strong
  5. Use password manager (1Password, Bitwarden, LastPass)

Regular backups

  1. Install UpdraftPlus or Duplicator
  2. Set up automatic daily backups
  3. Store backups off-site (cloud storage, external drive)
  4. Test restore process monthly

Set file permissions

  1. wp-content/: 755
  2. wp-content/uploads/: 755 (writable)
  3. wp-config.php: 644 (read-only)
  4. .htaccess: 644 (read-only)
  5. All PHP files: 644 (read-only)

Monitor activity

  1. Enable login notifications (Wordfence or similar)
  2. Alert on file changes
  3. Alert on plugin/theme updates
  4. Alert on new user registrations
  5. Alert on password changes

Real-World Malware Removal Story

Scenario: A small business WordPress site got infected through an outdated plugin. The plugin had a known vulnerability. Hackers automatically exploited thousands of sites with the same plugin version. They installed a backdoor and shell files. For 3 weeks, the site unknowingly pushed malware to every visitor.

What happened:

  1. Plugin vulnerability was exploited
  2. Attacker uploaded shell.php to wp-content/uploads/
  3. Attacker created backdoor admin account
  4. Attacker injected redirect code into index.php
  5. Site redirected visitors to malware distribution site
  6. Google detected malware, blacklisted site
  7. Hosting provider suspended account
  8. Client discovered the problem

What we did to remove it:

  1. Backed up infected site completely
  2. Ran Wordfence scan (found 7 malware files)
  3. Deleted shell.php and 6 backdoor scripts
  4. Cleaned database for unauthorized admin account
  5. Removed malware code from index.php
  6. Reset all passwords
  7. Updated vulnerable plugin to patched version
  8. Ran scan again (clean)
  9. Requested Google review
  10. Installed Wordfence security hardening
  11. Set up daily backups

Result: After 48 hours, Google approved the site. Traffic recovered within a week.

The lesson: Keep plugins updated. An outdated plugin cost a week of downtime and thousands in labor.

Malware Removal Checklist

WordPress site infected?

  • āœ“ Check Google Search Console for malware warnings
  • āœ“ Contact hosting to understand what they detected
  • āœ“ Take complete backup of infected site
  • āœ“ Run Wordfence scan to identify all malware
  • āœ“ Write down every malware file identified
  • āœ“ Delete all malware files via FTP/SSH
  • āœ“ Clean database for injected code
  • āœ“ Check and clean wp-config.php
  • āœ“ Delete unauthorized user accounts from database
  • āœ“ Reset all user passwords (strong, unique)
  • āœ“ Change FTP password
  • āœ“ Change database password
  • āœ“ Change hosting account password
  • āœ“ Check .htaccess for malicious rewrites
  • āœ“ Check plugins and themes for backdoors
  • āœ“ Check index.php files for modifications
  • āœ“ Run full security scan again
  • āœ“ If malware still found, repeat removal steps
  • āœ“ Request malware review from Google
  • āœ“ Update WordPress, plugins, themes immediately
  • āœ“ Install security hardening plugin (Wordfence, iThemes)
  • āœ“ Enable two-factor authentication
  • āœ“ Install backup plugin with automatic backups
  • āœ“ Monitor activity with security alerts

When to Contact Hosting Support

Contact them if:

  • You can't access phpMyAdmin to clean database
  • You can't access FTP or file manager
  • Hosting has suspended your account (they can unsuspend after cleaning)
  • You need help identifying malware files
  • You're not confident about database cleanup (don't want to break something)
  • Site still won't come online after .maintenance file deletion
  • You need to request automatic backup for restore

What to tell them:

"My WordPress site is infected with malware. I've identified malicious files but need help removing them or verifying they're completely gone. Can you review my site or help me access the necessary tools?"

Most hosting can assist in 2-4 hours.

The Real Talk

Getting hacked is one of the most violating experiences as a website owner. Someone broke into your site. They touched your files. They compromised your visitors' experience. You feel violated and exposed.

But here's what I want you to know: Malware removal is deterministic. It follows a process. If you follow the process methodically, you will get your site clean.

The worst part isn't the malware itself. It's the uncertainty. Not knowing if you got everything. Not knowing if the backdoor will let them back in tomorrow.

That's why you need to:

  1. Scan multiple times until completely clean
  2. Change all passwords thoroughly
  3. Remove all backdoors, not just obvious malware
  4. Harden security so it doesn't happen again

Do this right and your site will be cleaner and more secure than before the infection.

The best part? After you've been through a malware removal, you'll never neglect security updates again. You'll see "Update Available" and immediately click it instead of ignoring it for weeks.

Malware infection is terrible. But it's survivable. And it makes you a better, more security-conscious website owner.