---
title: Malware cleanup checklist
canonical: https://wpsecurityninja.com/docs/malware-scanner/comprehensive-malware-cleanup-checklist/
---
1. **Back up the current site**  
   Before you change anything, make a full backup of files and the database. Store it off the infected server so the backup is not rewritten by malware.

2. **Put the site in maintenance mode**  
   Keep visitors off the site while you clean. A short maintenance message is enough. Estimated downtime helps set expectations.

3. **Find how the attack got in**  
   Review server logs, login history, and Security Ninja findings. Look for weak passwords, outdated plugins or themes, nulled software, or unexpected admin users. You need the entry point so it does not reopen.

4. **Remove malware from identified files**  
   Use Malware Scanner (and other trusted tools if needed) to list infected files. Delete or replace only what you have confirmed. Quarantine copies if you want a record before removal.

5. **Replace compromised WordPress core files**  
   Restore core files to clean copies for your WordPress version. Core Scanner can help [compare and restore](https://wpsecurityninja.com/docs/core-scanner/scan-wordpress/) against wordpress.org checksums.

6. **Inspect the database**  
   Search for injected `<script>` tags, odd admin users, and spam content. Remove malicious rows carefully. Keep a database backup first.

7. **Update WordPress, themes, and plugins**  
   Apply available updates after the site is stable. Remove software you no longer need, especially closed or abandoned plugins.

8. **Harden access**  
   Reset passwords for all admins and hosting accounts. Review file permissions. Turn on 2FA where you can. Consider a firewall (including Security Ninja Cloud Firewall if you use Pro).

9. **Scan again for backdoors**  
   Run Malware Scanner and Core Scanner again after cleanup. Attackers often leave a second door. Repeat until findings are gone or explained.

10. **Watch for new activity**  
    Use Event Logger and scheduled scans so you notice new file changes or logins early.

11. **Brief anyone with admin access**  
    Share simple rules: no shared passwords, no nulled plugins, report odd emails that ask for login.

12. **Schedule regular checks**  
    Keep vulnerability scanning and scheduled scans enabled. Update software on a routine, not only after an incident.

13. **Get help if needed**  
    If cleanup is beyond what you can finish safely, [WP Security Ninja offers scoped malware cleanup and a fixed-price security review](https://wpsecurityninja.com/consultation/).

For a longer walkthrough, see [WordPress malware removal](https://wpsecurityninja.com/wordpress-malware-removal/).