How to remove WordPress malware for real: contain the infection, restore or clean carefully, rescan, rotate access, and close the hole so it does not come back.
Topics Malware & cleanup Beginner guides
Updated Published
Malware removal is not a magic “scan and forget” button. The goal is a clean site that stays clean: stop the damage, get trustworthy files online, and close whatever let them in.
Typical signs: redirects, spam you did not add, new admins, lockouts, browser or Search Console warnings. More detail: 7 signs of a hack and common malware traits.
Containment checklist
If you know when the infection started, restoring files + database from before that point is usually cleaner than hunting every backdoor by hand.
Then immediately:
A restore that still contains the malware, or leaves the same vulnerable plugin active, just rewinds the movie. Backup habits: backup plan.
You need file access (hosting panel, SFTP, or SSH). wp-admin may be unreliable.
wp-content/mu-plugins/) and drop-insInspect and compare:
wp-config.php (odd eval, remote includes, unexpected admins created in code).htaccess in root and uploads (redirects, auto_prepend)functions.php and unexpected PHP in uploadsWordPress core should match official copies. Core Scanner flags modified, missing, or unexpected core files. Unexpected PHP outside normal theme/plugin paths deserves suspicion.
Run a malware scanner, review findings, clean or whitelist carefully. False positives happen (especially with unusual but legitimate plugins). Do not mass-delete without understanding the path.
Watch the walkthrough above for how scanning looks in Security Ninja.
File cleanup is not enough if spam content, rogue options, or injected users remain in the database. Search for odd scripts in posts/widgets, unexpected siteurl/home changes, and unknown users.
Run malware and vulnerability scans again after cleanup. Check the site logged out and in a private window. Confirm mail is not still sending spam. Only then remove maintenance mode.
Malware that “keeps coming back” almost always means the entry point is still open.
Common causes:
Fix that, then harden:
Full recovery flow: what to do if your site is hacked.
Keep these on your mental map while cleaning:
wp-content/uploads/ PHP files (uploads should rarely need executable PHP)wp_options rows with base64 blobs or remote URLsIf reinfection happens within hours, assume a backdoor or the same vulnerable plugin is still present.
If Chrome or Search Console flagged the site:
Google’s hacked site guidance is useful after the install is actually clean.
DIY is fine for a simple restore. Hire help when:
We offer fixed-price malware cleanup and security review.
Security Ninja Pro combines malware scanning, cloud firewall, login hardening, and scheduled scans so cleanup is not your only strategy.
YouTube
Watch how to scan WordPress for malware with WP Security Ninja.
Found this useful? Share it.