Malware
Definition
Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
Also called: malicious software
Why it matters for WordPress
Infected sites lose trust, trip Safe Browsing warnings, and can hurt visitors. Deleting the one ugly PHP file often fails because a backdoor, cron job, or database option puts it back. That “it returned overnight” pattern is common.
How it shows up in practice
- Google Safe Browsing or host abuse notices
- Redirects, spam SEO pages, or crypto miners chewing CPU
- Mystery PHP under
uploads/, or core and theme files that no longer match clean copies - New Administrator users or scheduled tasks nobody created
- Symptoms that vanish for logged-in admins but hit logged-out visitors (cloaking)
What to do
- Take a forensic backup, then limit public harm (maintenance mode or host help).
- Scan files and compare core against known-good hashes.
- Remove malware and the entry path (weak passwords, vulnerable plugins, backdoors).
- Rotate passwords, salts, and API keys after cleanup.
- Re-scan and watch logs; if it returns, hunt persistence (malware that kept coming back).
In WP Security Ninja
The malware scanner helps find suspicious code and cleanup targets. Pair it with the core scanner and Events Logger so you catch reinjection and odd admin activity, not only the first bad file. Step-by-step cleanup: WordPress malware removal.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Backdoor A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- Webshell A webshell is a small script uploaded to the server that lets an attacker run commands through the browser.
- File integrity monitoring File integrity monitoring checks whether important files changed compared with a known-good baseline.
- False negative A false negative is a real security problem that a tool or process failed to detect.
- File upload vulnerability A file upload vulnerability lets an attacker place a dangerous file on the server, often leading to a webshell.
- Scheduled scanning Scheduled scanning runs security checks automatically on a repeating timetable and can alert you to new findings.
- Nulled plugin A nulled plugin is an unauthorized, usually modified copy of a paid plugin that often includes malware or backdoors.
