WordPress Malware Removal Guide 2026

How to remove malware from WordPress: contain the damage, prefer a clean restore, then scan and remove what is left, rotate access, and close the hole so it does not return. Malware removal is not a magic “scan and forget” button. The goal is a clean site that stays clean.

Work in this order: contain → assess → clean or restore → harden. Skipping containment or leaving the entry point open is why infections “keep coming back.”

Not sure whether you are compromised yet? Start with check if your WordPress site is hacked or the longer signs guide.

Malware types and symptoms

Knowing the shape of the infection helps you look in the right places.

Type	What it does	Common cues
Backdoor / webshell	Keeps remote admin access after you “clean”	Unknown admins, odd PHP in uploads/themes, reinfection in hours
Injection	Malicious code dropped into themes, plugins, posts, or options	Spam links, hidden iframes, eval / base64 blobs in files or the DB
Redirect malware	Sends visitors (sometimes only mobile or logged-out) elsewhere	Search Console / browser warnings, conditional redirects
Spam / SEO spam	Injects pages, comments, or mail abuse	New content you did not write, host spam complaints
Crypto / resource abuse	Burns CPU for someone else’s gain	Sudden CPU spikes, timeouts, host resource warnings

Warning signs (several together matter more than one alone):

• Unexpected redirects, pop-ups, or foreign-language spam
• New administrator accounts or plugins you never installed
• Lockouts, weird login redirects, or password resets that fail
• Browser or Google Safe Browsing warnings
• Site suddenly slow, or hosting flags malware / outbound spam

More detail: 7 signs of a hack and common malware traits.

How malware usually gets in: outdated or abandoned plugins/themes, nulled plugins, weak or reused admin passwords, infected shared hosting neighbors, and social-engineering “updates.” Close that door after cleanup or you will do this again.

1. Contain immediately

1. Put the site in maintenance mode (or take it offline) if visitors are being harmed
2. Contact the host; ask about snapshots, mail abuse, and server-level malware
3. Work from a clean device if credentials may be stolen
4. Pause outbound mail if the host says you are sending spam
5. Do not keep publishing content through an infected install

You need file and database access. If wp-admin is dead, use the hosting panel, SFTP/SSH, or an authorized emergency recovery hook, then remove that code the moment you are in.

2. Assess before you delete everything

• Note when symptoms started (helps pick a clean backup)
• List unknown users, plugins, mu-plugins, and drop-ins
• Check recent file modification times on themes, uploads, and wp-config.php
• Save copies of suspicious files for your records before removing them
• Ask the host for access logs around the start window

Security Ninja Pro’s malware scanner and Core Scanner help here: flag suspicious files, and show modified, missing, or unexpected core files. Free builds still cover security tests, vulnerability checks, and core integrity. Judgment still matters. False positives happen; do not mass-delete without understanding the path.

Watch the walkthrough above for how scanning looks in Security Ninja.

3. Prefer a clean backup restore

If you know when the infection started, restoring files and database from before that point is usually cleaner than hunting every backdoor by hand.

Then immediately:

1. Update WordPress, plugins, and themes
2. Delete unused plugins and themes
3. Rotate all admin (and hosting) passwords
4. Enable 2FA
5. Scan again before celebrating

A restore that still contains the malware, or leaves the same vulnerable plugin active, just rewinds the movie. Backup habits: backup plan.

4. If you must clean without a clean backup

You need file access. wp-admin may be unreliable.

Users and plugins

• Remove unknown administrator accounts
• Delete shady plugins you do not recognize (especially ones you never installed)
• Check must-use plugins (wp-content/mu-plugins/) and drop-ins

High-value files

Inspect and compare:

• wp-config.php (odd eval, remote includes, unexpected admins created in code)
• .htaccess in root and uploads (redirects, auto_prepend)
• Theme functions.php and unexpected PHP in uploads
• Familiar-looking assets used as cover (odd favicon.ico, double extensions, PHP next to images)
• Cron / scheduled tasks that call remote URLs or unknown PHP

Core integrity

WordPress core should match official copies. Core Scanner flags modified, missing, or unexpected core files. Unexpected PHP outside normal theme/plugin paths deserves suspicion. When in doubt, replace core from a trusted WordPress package (never overwrite wp-config.php or wp-content blindly).

Malware scan, then judgment

Run a malware scanner, review findings, clean or whitelist carefully. False positives happen (especially with unusual but legitimate plugins).

Database leftovers

File cleanup is not enough if spam content, rogue options, or injected users remain. Search for odd scripts in posts/widgets, unexpected siteurl / home changes, unknown users, and option values with base64 blobs or remote URLs. Export a DB backup before you edit anything.

Rescan before you reopen

Run malware and vulnerability scans again after cleanup. Check the site logged out and in a private window. Confirm mail is not still sending spam. Only then remove maintenance mode.

Places malware loves to hide

• wp-content/uploads/ PHP files (uploads should rarely need executable PHP)
• Cached / optimized copies of infected templates
• Old theme directories you thought you deleted
• Database wp_options rows with base64 blobs or remote URLs
• Cron events calling unknown PHP files
• Odd “asset” names used as backdoors (see emergency recovery / detection notes)

If reinfection happens within hours, assume a backdoor or the same vulnerable plugin is still present.

5. Harden so it does not return

Malware that “keeps coming back” almost always means the entry point is still open.

Common causes:

• Vulnerable or abandoned plugin/theme
• Weak or reused admin password
• No 2FA on privileged accounts
• Nulled software
• Old WordPress core

Fix that, then harden:

• Login protection + 2FA
• Cloud Firewall (Pro: 600M+ known bad IPs, plus request filtering)
• Scheduled malware and vulnerability scans
• Security tests from Security Ninja
• Sensible file permissions (directories typically 755, files 644, wp-config.php tighter such as 600 when your host allows it)
• Off-site backups you have restore-tested

Full recovery flow: what to do if your site is hacked.

Google Safe Browsing and SEO

If Chrome or Search Console flagged the site:

1. Finish cleaning first
2. Request a review in Search Console
3. Expect rankings to take time to recover

Google’s hacked site guidance is useful after the install is actually clean. SEO recovery notes: recover after a hack.

When to hire help

DIY is fine for a simple restore. Hire help when:

• You are locked out of wp-admin and hosting access is unclear
• Malware returns after “cleanup”
• Customer data may be involved
• The store or lead site cannot stay down while you learn

We offer fixed-price malware cleanup and security review.

Prevention so you are not here again

• Keep plugins few and updated
• Unique passwords + 2FA for admins
• Firewall + scheduled scanning
• Off-site backups you have restore-tested

Security Ninja Pro combines malware scanning, cloud firewall, login hardening, and scheduled scans so cleanup is not your only strategy. Free covers tests, vulnerability checks, and core scanning to catch problems earlier.

Related reading

• Check if your WordPress site is hacked
• Signs your WordPress site is hacked
• What to do if your WordPress site is hacked
• Emergency admin recovery (temporary URL hook)
• Recover SEO after a hack
• Create a backup plan
• Malware scanner
• Cloud Firewall
• Pricing