You notice your WordPress site redirecting visitors to spam pages, injecting pharmaceutical ads into post content, or showing a Google Safe Browsing warning. Or your hosting provider suspended the account citing malware. Or a security scanner flagged dozens of infected files. WordPress malware removal requires a systematic approach — scanning every file and database entry, removing all malicious code, closing the vulnerability that allowed the compromise, and hardening the site to prevent reinfection. This guide covers the complete process from detection through recovery. For the bigger picture, our WordPress Errors Complete Guide pulls everything together.
WordPress Malware Removal — Confirming the Infection
Before removing anything, confirm that the site is actually compromised rather than experiencing a different problem that resembles malware symptoms. False positives — security scanner alerts on legitimate code, caching serving old content, or DNS hijacking that does not involve the WordPress files — waste time on malware removal when the actual problem is elsewhere.
Verify the infection using multiple independent methods: visit the site while logged out and using a browser with no extensions (malware sometimes targets logged-out visitors only or is invisible to the admin account). Check Google Safe Browsing status by searching site:yoursite.com in Google — warnings appear in the search results for infected sites. Use an external scanner (Sucuri SiteCheck at sitecheck.sucuri.net, or VirusTotal.com) to scan the site from outside the hosting environment — these scanners catch front-end malware injections that file-based scanners miss. Check the Google Search Console → Security issues section for any malware reports Google’s crawler detected. Confirming the infection through external tools before beginning WordPress malware removal ensures the effort is directed at a genuine compromise rather than a false alarm.
Identify the infection type before beginning WordPress malware removal: redirect malware (sends visitors to spam sites) is often in .htaccess files, wp-config.php, or JavaScript files. Content injection (pharma spam, casino links appearing in posts) typically lives in the database’s wp_posts table or wp_options table. Backdoor files (PHP files that allow continued remote access after cleanup) appear as unfamiliar PHP files in wp-content/uploads/ or as injected code in plugin and theme files. Each type requires different detection and removal approaches — understanding which type is present guides an efficient cleanup rather than a scattergun approach. According to Sucuri’s annual hacked website research, the majority of WordPress malware infections involve a combination of these types simultaneously — removing only the visible front-end symptoms without finding all backdoor files results in reinfection within days.
Scanning Files and Database for Malicious Code
A complete WordPress malware removal scan covers both the filesystem (all PHP, JavaScript, and .htaccess files) and the WordPress database (wp_posts, wp_options, wp_users, and wp_usermeta tables). Skipping either layer leaves malware that regenerates what was cleaned in the other layer.
Install Wordfence for WordPress malware removal file scanning: Wordfence → Scan → Start New Scan → the scanner checks all WordPress files against the known good versions in the WordPress.org repository, flags any files that differ from the official versions, and identifies known malware signatures in non-repository files (plugins, themes, and custom code). The scan results show each suspicious file with a diff view comparing the current content against the expected content — making it clear which additions are malicious. For confirmed malware files where the original is known (core files, plugin files from WordPress.org), use Wordfence’s “Repair” action to restore the clean version from the repository automatically.
Database scanning is the second pillar of WordPress malware removal requires checking for injected content in text fields. Use the Wordfence scan results’ database section, or run manual SQL queries in phpMyAdmin. Common malware patterns in the database: encoded PHP or JavaScript (look for long base64-encoded strings in wp_options values), hidden links in wp_posts content (search for pharmaceutical keywords, hidden anchor tags), and unauthorized administrator accounts in wp_users. To search the database for suspicious content: phpMyAdmin → SQL → SELECT option_name, option_value FROM wp_options WHERE option_value LIKE '%eval(%' OR option_value LIKE '%base64_decode%'; — eval() and base64_decode() in option values are strong indicators of database-resident malware. Our guide on diagnosing WordPress site down events covers the server error log access that often reveals when malware is actively executing PHP errors — the log timestamps matching suspicious activity times help confirm which malware variant was active before cleanup began.
Removing Malware and Restoring Clean Files
With malware identified, WordPress malware removal proceeds in a specific order that prevents partial cleanup from allowing reinfection: remove backdoors first (they allow remote re-injection), then clean the database, then restore infected core and plugin files, then change all credentials.
Remove backdoors first in any WordPress malware removal: PHP files in wp-content/uploads/ (the uploads folder should contain only media files, never PHP) is almost certainly a backdoor — delete it. PHP files in plugin or theme folders that do not match the plugin’s or theme’s known file list are backdoors — compare against the plugin version installed and delete unrecognised PHP files. Injected code added to legitimate files (functions.php, index.php, plugin files) typically appears as an eval(base64_decode()) block or obfuscated code at the beginning or end of the file — remove the injected code, leaving only the legitimate file content intact. For core WordPress files infected with injected code, use Wordfence’s Repair function to replace the entire file with the clean version from the WordPress.org repository.
After file cleanup, reinforce WordPress malware removal by reinstalling WordPress core: WordPress admin → Dashboard → Updates → Re-install WordPress X.X.X. This replaces all core files with clean copies regardless of whether the scanner identified them as infected — ensuring no infected core file is missed. Reinstall all plugins and themes from the WordPress.org repository or from the official plugin developer sources: deactivate each plugin → delete it → reinstall from the original source. Premium plugins should be reinstalled from fresh downloads from the developer’s site (not from the installed copy which may contain backdoors). After reinstalling everything from clean sources, the WordPress malware removal is complete at the file level — database cleaning and credential changes complete the full remediation. Our guide on setting up WordPress two factor authentication covers the 2FA implementation that prevents future credential-based compromises that are a common entry point for the malware that required removal.
Changing All Credentials After Malware Removal
After WordPress malware removal, every credential associated with the site must be changed — the compromise may have included credential harvesting, and old credentials enable immediate reinfection even after a complete cleanup.
Change all passwords systematically: WordPress admin password (Users → Your Profile → New Password → generate a strong password), all other WordPress user passwords (especially any accounts created by the attacker — check for unrecognised admin accounts in Users → All Users and delete them), FTP password (hosting control panel → FTP accounts), MySQL database password (hosting → MySQL databases → update the password and also update DB_PASSWORD in wp-config.php), cPanel or hosting control panel password, and any email addresses associated with the WordPress admin account. Generate new WordPress security keys: visit the secret key generator at wordpress.org/support/article/editing-wp-config-php → copy the new values → replace the existing DEFINE lines in wp-config.php. New security keys invalidate all active sessions, logging out any attacker who maintained access through a session cookie.
Check for and remove unauthorized users — a critical WordPress malware removal step during the compromise: Users → All Users → sort by Role → Administrator → any administrator accounts not created by the site owner are backdoor accounts the attacker uses to regain access after cleanup. Delete all unauthorized accounts before completing WordPress malware removal — these accounts survive file and database cleanup unless explicitly checked, providing the attacker with continued admin access despite the cleanup. For compromises where the attacker created many spam user accounts below the administrator level (common in brute force and spam registration attacks), bulk-delete non-administrator accounts that were created during the compromise period using the date filters in the Users list. Reviews from Sucuri’s security research team confirm that reinfection within 24–48 hours of malware removal is common when the initial entry point is not identified and closed — credential changes and security key rotation are essential final steps, not optional.
Closing the Entry Point and Preventing Reinfection
The most critical step in WordPress malware removal is identifying and closing the vulnerability the attacker used — without this, the same attack vector allows immediate reinfection of the cleaned site.
Common entry points that WordPress malware removal must address: outdated plugins with known vulnerabilities (update all plugins immediately after cleanup — check the plugin changelog for any security fixes released since the last update); nulled themes and plugins (commercial themes downloaded from unofficial sources that contain pre-installed backdoors — remove all nulled software and purchase legitimate licences); weak or reused admin passwords (enable two-factor authentication for all admin accounts); exposed wp-login.php (restrict access by IP or install a login security plugin with lockout features); file upload vulnerabilities in contact forms or custom upload features (disable file upload functionality or restrict to safe file types). Cross-reference the compromise timestamp (from server access logs) against the list of recent changes to identify which plugin update, file change, or user action immediately preceded the infection — the log timestamps often pinpoint the entry point precisely.
After completing WordPress malware removal, implement preventive measures: install Wordfence or Sucuri Security for ongoing file monitoring and firewall protection, configure the firewall to block known malicious IP ranges and attack patterns, set up automatic WordPress core and plugin updates (at minimum enabling security updates), schedule daily offsite backups so future compromises can be recovered from a clean backup, and run a monthly Wordfence scan to catch any new infections before they cause damage. Request malware review removal from Google (Google Search Console → Security Issues → Request Review) and Sucuri’s SiteCheck database once the cleanup is verified complete — this removes the Safe Browsing warning from browsers and search results that was damaging visitor trust and search rankings during the period the site was compromised. Our guide on preventing WordPress spam and security attacks covers the comment spam and automated attack prevention that reduces the attack surface post-cleanup.
Professional WordPress malware removal services from Sucuri, Wordfence, or WP White Security cost $200–$500 and include a site cleanup guarantee — if the site is reinfected within a set period (usually 30–90 days), the service repeats the cleanup at no additional charge. For sites where the business impact of infection is high (ecommerce revenue loss, professional reputation damage, customer data exposure), professional malware removal services provide faster turnaround and expert identification of sophisticated backdoors that automated scanners miss. The service also includes a post-cleanup hardening report documenting all vulnerabilities found and the specific security changes made — valuable documentation for compliance and for preventing future incidents. For site owners without technical expertise to perform the manual cleanup steps described above, professional services are the appropriate path for safe, complete WordPress malware removal that restores the site to a verified clean state.
Preventing future compromise after WordPress malware removal requires addressing the full attack surface: file permissions (wp-content/uploads should be 755 and not executable; all PHP files 644; wp-config.php 600 or 440), disabling PHP execution in wp-content/uploads/ via .htaccess (<Files *.php>deny from all</Files>), blocking direct access to wp-config.php (<Files wp-config.php>order allow,deny; deny from all</Files>), and disabling XML-RPC if not needed for Jetpack or mobile apps. These hardening measures create multiple layers that an attacker must bypass rather than a single entry point — making future attacks significantly harder even if vulnerabilities exist in installed plugins or themes.
Restoring from a pre-infection backup is an alternative to manual WordPress malware removal when the compromise is severe, the timeline of infection is clearly established, and a clean backup from before the infection exists. Restore the backup → change all credentials (the backup may contain old passwords the attacker still knows) → update all plugins and themes to current versions → apply security hardening. The advantage of backup restoration over manual cleanup is completeness — no risk of missing a hidden backdoor file. The disadvantage is losing any content created or updated between the backup date and the discovery of the infection. For sites with frequent content updates, this content loss may be unacceptable; for sites with infrequent updates where the content loss is minimal, backup restoration provides faster and more reliable WordPress malware removal than manual file-by-file cleanup. Always maintain daily offsite backups (UpdraftPlus to Google Drive or Dropbox) to ensure a pre-infection restore point is always available within 24 hours of any future compromise.
Informing affected users after a WordPress malware removal that involved customer or user data is a legal obligation in most jurisdictions — GDPR Article 33 requires notifying the supervisory authority within 72 hours of a breach involving personal data, and Article 34 requires notifying affected individuals when the breach poses a high risk to their rights and freedoms. For WordPress sites that store user personal data (WooCommerce customer records, membership site profiles, contact form submissions), consult legal counsel on notification obligations immediately after discovering the compromise. Draft the breach notification clearly — what data was potentially accessed, what has been done to address the breach, what users should do to protect themselves (change passwords on any other sites where the same password was used). Prompt, transparent notification limits both legal liability and reputational damage compared to delayed or undisclosed breach handling.
