WordPress Malware Removal: Clean a Hacked Site

If you need WordPress malware removal, the first hour matters most. A hacked site leaks customer data, tanks your search rankings, and can get your domain blacklisted by Google. This guide walks you through spotting an infection, cleaning it step by step, and making sure it never comes back.

Signs Your WordPress Site Is Hacked

Malware rarely announces itself. Watch for these red flags:

• Google or your browser shows a "This site may be hacked" or "Deceptive site ahead" warning
• Visitors are redirected to spam, pharmacy, or gambling pages (often only on mobile or from search results)
• New admin users you never created
• Unfamiliar files in wp-content/uploads or modified core files
• A sudden traffic drop, strange Japanese or pharma keywords in search results, or a spike in server load
• Your host suspends the account or emails an abuse notice

If you see any of these, act immediately rather than waiting.

Step 1: Contain the Damage

Before cleaning, stop the bleeding:

1. Put the site in maintenance mode or restrict access so visitors are not exposed.
2. Take a full backup of files and database, even though it is infected. You need evidence and a fallback.
3. Change every password: hosting, FTP/SFTP, database, WordPress admins, and email accounts tied to the site.
4. Tell your host. A good provider can often identify the infection point from server logs.

Step 2: Scan and Identify the Infection

Run a malware scanner to find what changed. Free tools like Wordfence or Sucuri SiteCheck flag known signatures, but they miss well-hidden backdoors. Also check manually:

• Compare core files against a clean copy using wp core verify-checksums via WP-CLI.
• Review plugin and theme files for recently modified timestamps.
• Search for suspicious code such as base64_decode, eval(, gzinflate, and str_rot13 in PHP files.
• Inspect the database: look for injected <script> tags in wp_posts and rogue entries in wp_options (especially siteurl, home, and active_plugins).
• Check .htaccess and wp-config.php for unexpected redirects or includes.

Step 3: Clean the Site

Replace core files

Download a fresh copy of WordPress that matches your version and overwrite wp-admin and wp-includes. Leave wp-content and wp-config.php for careful manual review.

Reinstall plugins and themes

Delete every plugin and theme, then reinstall from official sources. Remove anything abandoned or nulled (pirated), because cracked premium plugins are a leading infection source.

Remove backdoors

Attackers hide backdoors in uploads, mu-plugins, fake plugin folders, and even innocent-looking image files with PHP inside. Delete PHP files inside uploads unless you know they belong there. Missing a single backdoor means reinfection within days.

Clean the database

Remove malicious users, injected scripts, and spam posts. If you are unsure, restore from a backup taken before the infection date, then apply updates.

Reset security keys

Regenerate the salts in wp-config.php to force all sessions to log out, which kicks out any attacker still logged in.

Step 4: Get Off Blacklists and Restore SEO

After cleaning, verify the site is clear:

1. Request a review in Google Search Console under Security Issues.
2. Re-test with Sucuri SiteCheck and Google Safe Browsing.
3. Submit a fresh XML sitemap and delete any spam URLs using the Removals tool.
4. Monitor rankings for a few weeks, since recovery is not always instant.

Step 5: Prevent It From Happening Again

Cleaning is only half the job. Close the door that let the attacker in.

• Update everything: core, plugins, and themes. Most infections exploit known vulnerabilities in outdated plugins.
• Use strong passwords and two-factor authentication for every admin account.
• Limit login attempts and consider a web application firewall.
• Disable file editing by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php.
• Delete unused plugins and themes instead of just deactivating them.
• Keep automatic, offsite backups. Our WordPress backup strategy guide covers how to set that up properly.
• Test updates first on a safe copy; see how to use a WordPress staging site.

For more hardening tips, read our guide on how to improve WordPress security.

Should You Clean It Yourself or Get Help?

DIY cleanup works for simple infections on small sites. But if you run a WooCommerce store, handle customer payments, or keep finding the malware coming back, a mistake can be expensive. Professional cleanup includes root-cause analysis, so you know how the attacker got in.

Hosting also makes a big difference. Managed WordPress hosting typically adds server-level firewalls, malware scanning, isolated accounts, and daily backups, which means many attacks are blocked before they reach your site and recovery is a one-click restore instead of a weekend of detective work.

Quick WordPress Malware Removal Checklist

• Backup the infected site and enable maintenance mode
• Change all passwords and regenerate salts
• Scan files and database for malware
• Replace core files, reinstall plugins and themes
• Remove backdoors and rogue admin users
• Request Google review and re-test blacklists
• Update everything, enable 2FA, and add a firewall
• Set up automated offsite backups

Common Causes of WordPress Infections

Knowing how sites get hacked helps you prioritize fixes:

• Outdated or vulnerable plugins and themes. This is the number one entry point, and attackers scan the web for known flaws within hours of disclosure.
• Weak or reused passwords. Brute-force and credential-stuffing bots try thousands of logins per minute against wp-login.php.
• Nulled themes and plugins. Pirated premium software often ships with built-in backdoors.
• Insecure hosting. On poorly isolated shared servers, one compromised neighbor can infect every site on the account.
• Compromised devices. Malware on a developer's or editor's computer can steal saved FTP and admin credentials.

Fixing the cause, not only the symptoms, is what separates a lasting cleanup from a repeat incident. Check your server access logs around the first infection date for suspicious POST requests, unknown IP addresses, and requests to odd PHP files.

Final Thoughts

WordPress malware removal is stressful, but a calm, methodical process gets you through it: contain, scan, clean, verify, and harden. The real win is prevention. Keep software updated, back up often, and host your site on a platform built to defend it.

Want a team to handle security and recovery for you? Explore Phluit's managed WordPress hosting and keep your site fast, safe, and online.