---
title: Malware
canonical: https://wpsecurityninja.com/dictionary/malware/
---
# Malware

Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.

Last updated: 2026-08-26

Also called: malicious software

## Related terms

- [Backdoor](https://wpsecurityninja.com/dictionary/backdoor/): A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- [Webshell](https://wpsecurityninja.com/dictionary/webshell/): A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.
- [File integrity monitoring](https://wpsecurityninja.com/dictionary/file-integrity-monitoring/): File integrity monitoring checks whether important files changed compared with a known-good baseline.
- [False negative](https://wpsecurityninja.com/dictionary/false-negative/): A false negative is a real security problem that a tool or process failed to detect.
- [File upload vulnerability](https://wpsecurityninja.com/dictionary/file-upload-vulnerability/): A file upload vulnerability lets an attacker place a dangerous file on the server, often leading to a webshell.
- [Scheduled scanning](https://wpsecurityninja.com/dictionary/scheduled-scanning/): Scheduled scanning runs security checks automatically on a repeating timetable and can alert you to new findings.
- [Nulled plugin](https://wpsecurityninja.com/dictionary/nulled-plugin/): A nulled plugin is an unauthorized, usually modified copy of a paid plugin that often includes malware or backdoors.

[Full guide](https://wpsecurityninja.com/wordpress-malware-removal/)

## Why it matters for WordPress

Infected sites lose trust, trip Safe Browsing warnings, and can hurt visitors. Deleting the one ugly PHP file often fails because a backdoor, cron job, or database option puts it back. That “it returned overnight” pattern is common.

## How it shows up in practice

- Google Safe Browsing or host abuse notices
- Redirects, spam SEO pages, or crypto miners chewing CPU
- Mystery PHP under `uploads/`, or core and theme files that no longer match clean copies
- New Administrator users or scheduled tasks nobody created
- Symptoms that vanish for logged-in admins but hit logged-out visitors (cloaking)

## What to do

1. Take a forensic backup, then limit public harm (maintenance mode or host help).
2. Scan files and compare core against known-good hashes.
3. Remove malware and the entry path (weak passwords, vulnerable plugins, backdoors).
4. Rotate passwords, salts, and API keys after cleanup.
5. Re-scan and watch logs; if it returns, hunt persistence ([malware that kept coming back](https://wpsecurityninja.com/malware-kept-coming-back/)).

## In WP Security Ninja

The [malware scanner](https://wpsecurityninja.com/malware-scanner/) helps find suspicious code and cleanup targets. Pair it with the [core scanner](https://wpsecurityninja.com/core-scanner/) and [Events Logger](https://wpsecurityninja.com/events-logger/) so you catch reinjection and odd admin activity, not only the first bad file. Step-by-step cleanup: [WordPress malware removal](https://wpsecurityninja.com/wordpress-malware-removal/).