Clean your WordPress site after a malware compromise

Malware on WordPress is not rare. Outdated plugins, weak admin passwords, and leftover server tools are common entry points. The longer an infection sits, the more likely you get spam SEO, stolen data, browser warnings, or a quiet backdoor that survives a half cleanup.

This is a practical cleanup path. The full playbook lives in the WordPress malware removal guide.

Confirm and contain

Typical signs: unexpected redirects or pop-ups, unknown admin users, odd PHP in wp-content/uploads, sudden slowness, or “This site may be hacked” style warnings. More detail: 7 signs of a hack.

Containment checklist

1. Put the site in maintenance mode (or take it offline) if visitors are being harmed
2. Contact the host about snapshots, mail abuse, and server-level malware
3. Work from a clean device if credentials may be stolen
4. Stop publishing through an infected install

Tell clients or stakeholders what happened and what you are doing. Vague silence creates worse rumors than a short, honest notice.

Prefer a clean backup restore

If you know roughly when the infection started, restoring files and the database from before that point is usually cleaner than hunting every webshell by hand.

Then immediately:

1. Update WordPress, plugins, and themes
2. Delete unused plugins and themes
3. Rotate admin, hosting, SFTP/SSH, and database passwords
4. Enable 2FA
5. Scan again before you call it done

A restore that still contains the malware, or leaves the same vulnerable plugin active, just rewinds the movie. Backup habits: WordPress backup tips and backup vs security plugins.

Even if the only backup is infected, keep a copy offline as a forensic reference before you delete files.

Scan so you know what you are removing

Security plugin scan

Run a malware scanner and review findings with judgment. Core Scanner flags modified, missing, or unexpected core files. False positives happen, especially with unusual but legitimate plugins. Do not mass-delete without understanding the path.

Other reputable scanners exist. Pick tools you trust, then verify the same paths more than once.

External URL checks

Public scanners (for example Sucuri SiteCheck) catch blacklisting and some front-facing injections. They miss hidden PHP that never serves to anonymous visitors. Use them as a second opinion, not the whole audit.

Manual inspection

With SFTP or the host file manager, compare high-value paths:

• wp-config.php (odd eval, remote includes, unexpected admin creation)
• .htaccess in root and uploads (redirects, auto_prepend_file)
• Active theme functions.php and unexpected PHP in uploads
• wp-content/mu-plugins/ and drop-ins
• Recently modified files around the suspected infection date

Remove malware carefully

Manual cleanup

Delete clearly malicious files. For critical files such as wp-config.php, remove only the injected lines. Replace WordPress core from a fresh wordpress.org download, keeping wp-content and your real wp-config.php (after you have cleaned it). Reinstall themes and plugins from trusted sources when their files look wrong.

When plugins help vs when you hire help

Some products can quarantine or guide cleanup. Security Ninja helps you find bad files and integrity problems; treat automated “fix everything” claims from any vendor with care. If the infection is deep, payment data may be involved, or you are out of time, hire a specialist cleanup service.

After any cleanup, scan again. Attackers often leave a second webshell.

Harden so it does not come back

1. Update everything and remove unused themes/plugins
2. Unique passwords for every privileged account; no shared “company admin”
3. 2FA on administrators
4. Login limits and fewer admins (login security)
5. Offsite backups with a tested restore (backup tips)
6. Firewall at the edge or in-plugin (firewall plugins guide, Cloud Firewall)

Disable theme/plugin file editing in the dashboard by adding this to wp-config.php (above the wp-settings.php require):

define( 'DISALLOW_FILE_EDIT', true );

Broader hardening: WordPress security hardening guide.

Related reading

• WordPress malware removal guide (pillar)
• What to do if your site is hacked
• Best ways to protect WordPress from malware
• WordPress security checklist

Cleanup is step one. Closing the hole and proving a clean rescan is what keeps the site yours.