---
title: WordPress malware removal
canonical: https://wpsecurityninja.com/wordpress-malware-removal/
---
How to remove malware from WordPress: contain the damage, prefer a clean restore, then scan and remove what is left, rotate access, and close the hole so it does not return. Malware removal is not a magic “scan and forget” button. The goal is a clean site that stays clean.

Work in this order: **contain → assess → clean or restore → harden**. Skipping containment or leaving the entry point open is why infections “keep coming back.”

Not sure yet? Run the [security tests](https://wpsecurityninja.com/security-tests/), [vulnerability scanner](https://wpsecurityninja.com/vulnerabilities/), and [Core Scanner](https://wpsecurityninja.com/core-scanner/) from wp-admin. Add the [malware scanner](https://wpsecurityninja.com/malware-scanner/) if files look wrong or visitors already see redirects. The longer signs walkthrough is [how to tell if your WordPress site has been hacked](https://wpsecurityninja.com/signs-wordpress-site-is-hacked/).

![WordPress malware removal](https://wpsecurityninja.com/media/2026/09/featured/wordpress-malware-removal-hero-1200x630.png)

## Malware types and symptoms

Knowing the shape of the infection helps you look in the right places.

| Type | What it does | Common cues |
| --- | --- | --- |
| [Backdoor](https://wpsecurityninja.com/dictionary/backdoor/) / [webshell](https://wpsecurityninja.com/dictionary/webshell/) | Keeps remote admin access after you “clean” | Unknown admins, odd PHP in uploads/themes, reinfection in hours |
| Injection | Malicious code dropped into themes, plugins, posts, or options | Spam links, hidden iframes, `eval` / base64 blobs in files or the DB |
| Redirect malware | Sends visitors (sometimes only mobile or logged-out) elsewhere | Search Console / browser warnings, conditional redirects |
| Spam / SEO spam | Injects pages, comments, or mail abuse | New content you did not write, host spam complaints |
| Crypto / resource abuse | Burns CPU for someone else’s gain | Sudden CPU spikes, timeouts, host resource warnings |

**Warning signs** (several together matter more than one alone):

- Unexpected redirects, pop-ups, or foreign-language spam
- New administrator accounts or plugins you never installed
- Lockouts, weird login redirects, or password resets that fail
- Browser or Google Safe Browsing warnings
- Site suddenly slow, or hosting flags malware / outbound spam

More detail: [7 signs of a hack](https://wpsecurityninja.com/signs-wordpress-site-is-hacked/) and [common malware traits](https://wpsecurityninja.com/your-website-hacked/).

**How malware usually gets in:** outdated or abandoned plugins/themes, [nulled plugins](https://wpsecurityninja.com/dictionary/nulled-plugin/), weak or reused admin passwords, infected shared hosting neighbors, and social-engineering “updates.” Close that door after cleanup or you will do this again.

## 1. Contain immediately

1. Put the site in maintenance mode (or take it offline) if visitors are being harmed
2. Contact the host; ask about snapshots, mail abuse, and server-level malware
3. Work from a clean device if credentials may be stolen
4. Pause outbound mail if the host says you are sending spam
5. Do not keep publishing content through an infected install

You need file and database access. If wp-admin is dead, use the hosting panel, SFTP/SSH, or an authorized [emergency recovery hook](https://wpsecurityninja.com/create-wordpress-backdoor/), then remove that code the moment you are in.

## 2. Assess before you delete everything

- Note when symptoms started (helps pick a clean backup)
- List unknown users, plugins, mu-plugins, and drop-ins
- Check recent file modification times on themes, uploads, and `wp-config.php`
- Save copies of suspicious files for your records before removing them
- Ask the host for access logs around the start window

Security Ninja Pro’s [malware scanner](https://wpsecurityninja.com/malware-scanner/) and [Core Scanner](https://wpsecurityninja.com/core-scanner/) help here: flag suspicious files, and show modified, missing, or unexpected core files. Free builds still cover security tests, vulnerability checks, and core integrity. Judgment still matters. False positives happen; do not mass-delete without understanding the path.

Watch the walkthrough above for how scanning looks in Security Ninja.

## 3. Prefer a clean backup restore

If you know when the infection started, restoring **files and database** from before that point is usually cleaner than hunting every backdoor by hand.

Then immediately:

1. Update WordPress, plugins, and themes
2. Delete unused plugins and themes
3. Rotate all admin (and hosting) passwords
4. Enable [2FA](https://wpsecurityninja.com/two-factor-authentication-2fa/)
5. Scan again before celebrating

A restore that still contains the malware, or leaves the same vulnerable plugin active, just rewinds the movie. Backup habits: [backup plan](https://wpsecurityninja.com/create-backup-plan-if-site-gets-attacked/).

## 4. If you must clean without a clean backup

You need file access. wp-admin may be unreliable.

### Users and plugins

- Remove unknown administrator accounts
- Delete shady plugins you do not recognize (especially ones you never installed)
- Check must-use plugins (`wp-content/mu-plugins/`) and drop-ins

### High-value files

Inspect and compare:

- `wp-config.php` (odd `eval`, remote includes, unexpected admins created in code)
- `.htaccess` in root and uploads (redirects, auto_prepend)
- Theme `functions.php` and unexpected PHP in uploads
- Familiar-looking assets used as cover (odd `favicon.ico`, double extensions, PHP next to images)
- Cron / scheduled tasks that call remote URLs or unknown PHP

### Core integrity

WordPress core should match official copies. [Core Scanner](https://wpsecurityninja.com/core-scanner/) flags modified, missing, or unexpected core files. Unexpected PHP outside normal theme/plugin paths deserves suspicion. When in doubt, replace core from a trusted WordPress package (never overwrite `wp-config.php` or `wp-content` blindly).

### Malware scan, then judgment

Run a [malware scanner](https://wpsecurityninja.com/malware-scanner/), review findings, clean or whitelist carefully. False positives happen (especially with unusual but legitimate plugins).

### Database leftovers

File cleanup is not enough if spam content, rogue options, or injected users remain. Search for odd scripts in posts/widgets, unexpected `siteurl` / `home` changes, unknown users, and option values with base64 blobs or remote URLs. Export a DB backup before you edit anything.

### Rescan before you reopen

Run malware and vulnerability scans again after cleanup. Check the site logged out and in a private window. Confirm mail is not still sending spam. Only then remove maintenance mode.

## Places malware loves to hide

- `wp-content/uploads/` PHP files (uploads should rarely need executable PHP)
- Cached / optimized copies of infected templates
- Old theme directories you thought you deleted
- Database `wp_options` rows with base64 blobs or remote URLs
- Cron events calling unknown PHP files
- Odd “asset” names used as [backdoors](https://wpsecurityninja.com/dictionary/backdoor/) (see [emergency recovery / detection notes](https://wpsecurityninja.com/create-wordpress-backdoor/))

If reinfection happens within hours, assume a backdoor or the same vulnerable plugin is still present.

## 5. Harden so it does not return

Malware that “keeps coming back” almost always means the entry point is still open.

Common causes:

- Vulnerable or abandoned plugin/theme
- Weak or reused admin password
- No 2FA on privileged accounts
- Nulled software
- Old WordPress core

Fix that, then harden:

- [Login protection](https://wpsecurityninja.com/login-protection/) + 2FA
- [Cloud Firewall](https://wpsecurityninja.com/cloud-firewall/) (Pro: 600M+ known bad IPs, plus request filtering)
- Scheduled malware and vulnerability scans
- Security tests from [Security Ninja](https://wpsecurityninja.com/security-tests/)
- Sensible file permissions (directories typically `755`, files `644`, `wp-config.php` tighter such as `600` when your host allows it)
- Off-site backups you have restore-tested

Full recovery flow: [what to do if your site is hacked](https://wpsecurityninja.com/what-should-you-do-if-your-wordpress-site-is-hacked/).

## Google Safe Browsing and SEO

If Chrome or Search Console flagged the site:

1. Finish cleaning first
2. Request a review in Search Console
3. Expect rankings to take time to recover

Google’s [hacked site guidance](https://web.dev/articles/hacked) is useful after the install is actually clean. SEO recovery notes: [recover after a hack](https://wpsecurityninja.com/recover-wordpress-websites-seo-after-hacker-attack/).

## When to hire help

DIY is fine for a simple restore. Hire help when:

- You are locked out of wp-admin and hosting access is unclear
- Malware returns after “cleanup”
- Customer data may be involved
- The store or lead site cannot stay down while you learn

We offer fixed-price [malware cleanup and security review](https://wpsecurityninja.com/consultation/).

## Prevention so you are not here again

- Keep plugins few and updated
- Unique passwords + [2FA](https://wpsecurityninja.com/two-factor-authentication-2fa/) for admins, plus [login protection](https://wpsecurityninja.com/login-protection/)
- [Cloud Firewall](https://wpsecurityninja.com/cloud-firewall/) and [scheduled scans](https://wpsecurityninja.com/scheduled-scanner/)
- Off-site backups you have restore-tested

[Security Ninja Pro](https://wpsecurityninja.com/pricing/) combines malware scanning, cloud firewall, login hardening, and scheduled scans so cleanup is not your only strategy. Free covers tests, vulnerability checks, and core scanning to catch problems earlier.

## Related reading

- [Malware scanner](https://wpsecurityninja.com/malware-scanner/)
- [Core Scanner](https://wpsecurityninja.com/core-scanner/)
- [Security tests](https://wpsecurityninja.com/security-tests/)
- [Vulnerability scanner](https://wpsecurityninja.com/vulnerabilities/)
- [Events log](https://wpsecurityninja.com/events-logger/)
- [Cloud Firewall](https://wpsecurityninja.com/cloud-firewall/)
- [Login protection](https://wpsecurityninja.com/login-protection/)
- [Signs your WordPress site is hacked](https://wpsecurityninja.com/signs-wordpress-site-is-hacked/)
- [What to do if your WordPress site is hacked](https://wpsecurityninja.com/what-should-you-do-if-your-wordpress-site-is-hacked/)
- [Recover SEO after a hack](https://wpsecurityninja.com/recover-wordpress-websites-seo-after-hacker-attack/)
- [Create a backup plan](https://wpsecurityninja.com/create-backup-plan-if-site-gets-attacked/)
- [Pricing](https://wpsecurityninja.com/pricing/)