---
title: Malware
canonical: https://wpsecurityninja.com/dictionary/malware/
---
# Malware

Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.

[Full guide](https://wpsecurityninja.com/wordpress-malware-removal/)

## Why it matters for WordPress

Infected sites lose trust, trip Safe Browsing warnings, and can hurt visitors. Deleting the one ugly PHP file often fails because a backdoor, cron job, or database option puts it back. That “it returned overnight” pattern is common.

## How it shows up in practice

- Google Safe Browsing or host abuse notices
- Redirects, spam SEO pages, or crypto miners chewing CPU
- Mystery PHP under `uploads/`, or core and theme files that no longer match clean copies
- New Administrator users or scheduled tasks nobody created
- Symptoms that vanish for logged-in admins but hit logged-out visitors (cloaking)

## What to do

1. Take a forensic backup, then limit public harm (maintenance mode or host help).
2. Scan files and compare core against known-good hashes.
3. Remove malware and the entry path (weak passwords, vulnerable plugins, backdoors).
4. Rotate passwords, salts, and API keys after cleanup.
5. Re-scan and watch logs; if it returns, hunt persistence ([malware that kept coming back](https://wpsecurityninja.com/malware-kept-coming-back/)).

## In WP Security Ninja

The [malware scanner](https://wpsecurityninja.com/malware-scanner/) helps find suspicious code and cleanup targets. Pair it with the [core scanner](https://wpsecurityninja.com/core-scanner/) and [Events Logger](https://wpsecurityninja.com/events-logger/) so you catch reinjection and odd admin activity, not only the first bad file. Step-by-step cleanup: [WordPress malware removal](https://wpsecurityninja.com/wordpress-malware-removal/).