Malware on a WordPress site can usually be removed by scanning with a reputable plugin, deleting or replacing infected files, cleaning the database, removing unknown admin users, and then hardening the site against re-infection. Done in the right order, most site owners can complete this without hiring a developer.

What does WordPress malware actually look like?

Malware rarely announces itself with flashing red text. More often you will notice one or more of these signs:

  • Google Search Console warns of "harmful content" or your site is flagged as deceptive in Chrome.
  • Visitors are redirected to an unrelated website.
  • Your hosting provider suspends the account.
  • Unknown admin users appear in your WordPress dashboard.
  • Pages contain links or text you did not write.
  • Your site becomes very slow for no obvious reason.

If any of these match your situation, start the steps below immediately.

Step 1 — Put the site into maintenance mode and make a backup

Before touching anything, take a full backup of what you have now — even the infected version. If something goes wrong during the clean-up, you need a restore point.

Use your hosting control panel's backup tool or a plugin such as UpdraftPlus to download a copy of all files and the database to your computer.

Next, put the site into maintenance mode so visitors are not exposed to malicious content while you work. A plugin such as WP Maintenance Mode does this in one click.

Step 2 — Change every password immediately

Do this before scanning, not after, because an attacker with valid credentials can undo your clean-up as fast as you perform it.

Change:

  • Your WordPress admin password
  • Your hosting control panel password
  • Your database password (update wp-config.php to match)
  • The password for any FTP or SFTP accounts
  • Your email account password, since password resets go there

Use a password manager to generate long, random strings. Reusing any existing password defeats the purpose.

Step 3 — Scan the site with a dedicated security plugin

Install one of these trusted scanning plugins if you do not already have one:

Plugin Free scan? Malware removal Notes
Wordfence Security Yes Free (manual); automated on paid plan Very detailed file-level reports
Sucuri Security Yes (basic) Paid clean-up service Good for ongoing firewall protection
MalCare Yes One-click removal on paid plan Scans on their own servers; low site load

For most site owners who want a free starting point, Wordfence is the most practical choice. After installing, run a full scan from Wordfence → Scan. The results list will show you every file that has been modified or is known to be malicious.

Step 4 — Remove or replace infected files

Wordfence and similar plugins will flag files in two categories:

Known malware injections — The plugin will offer a "Repair" button for core WordPress files. This replaces the file with a clean copy from the official WordPress repository. Use this option freely for anything inside the wp-admin or wp-includes folders.

Modified theme or plugin files — Do not blindly repair these, because "modified" can mean you deliberately edited them. Check each one. If the change looks like an injected <script> tag or an encoded string of random characters (often starting with eval(base64_decode), delete or restore that file from a clean backup or the plugin's original source.

Tip: Malware is frequently hidden inside the uploads folder as PHP files. There should be no .php files in wp-content/uploads. Delete any you find.

Step 5 — Clean the database

Malware can also live in your WordPress database — typically injected into post content, widget settings, or the options table.

  • In Wordfence, the scan results will flag suspicious database entries.
  • For a manual check, log into phpMyAdmin (via your hosting control panel) and search the wp_posts and wp_options tables for strings like <script, eval(, or base64_decode(.
  • Use the Search tab in phpMyAdmin and search across all tables for known spam domains or the redirect URL visitors are being sent to.

Delete or correct any rows containing injected code. If you are unsure whether a value is legitimate, search for it on a site like the WordPress support forum before deleting.

Step 6 — Remove unknown admin users and audit user roles

Go to Users → All Users in your WordPress dashboard. Delete any accounts you do not recognise, especially those with the Administrator role. Attackers routinely create a hidden admin account so they can re-enter even after you clean the files.

Also check that existing trusted users have only the role they need. An editor does not need administrator access.

Step 7 — Update everything

Outdated plugins, themes, and WordPress core are the most common entry points for malware. Once the site is clean:

  1. Update WordPress core to the latest version.
  2. Update every active plugin.
  3. Update your active theme.
  4. Delete any plugins or themes that are deactivated and not needed — inactive code can still be exploited.

Step 8 — Request a Google review if you were blacklisted

If Google flagged your site as dangerous, your traffic will not recover until you request a review. Go to Google Search Console → Security Issues, confirm you have fixed the problems, and click Request Review. Google typically responds within a few days.

If your hosting provider suspended the account, contact their support team with the same confirmation and ask them to restore access.

How do you stop malware coming back?

Cleaning an infected site is only half the job. These measures significantly reduce the chance of re-infection:

  • Install a web application firewall (WAF). Wordfence (free) or Sucuri's firewall (paid) blocks most known attack patterns before they reach your files.
  • Enable two-factor authentication on all administrator accounts. Wordfence includes this for free.
  • Limit login attempts. Brute-force attacks on /wp-login.php are the most common attack vector after plugin vulnerabilities.
  • Schedule automatic updates for WordPress core and plugins where possible.
  • Take weekly automated backups stored off-server — not just on your hosting account.
  • Audit your plugins regularly. Remove anything unused, outdated, or from an unknown developer.

FAQ

Can I remove WordPress malware without a plugin?

Yes, but it requires comfort with FTP access and phpMyAdmin. You would manually compare your files against a clean WordPress installation, delete injected code, and search the database yourself. A plugin makes the process faster and more thorough for most site owners.

My hosting provider cleaned the malware — is that enough?

Hosting providers often remove the most obvious infected files, but they rarely address backdoors, rogue admin accounts, or database injections. Treat a hosting clean-up as a starting point and complete the full steps above to be sure.

How long does a full malware removal take?

For a typical small WordPress site, the scanning and cleaning process takes between one and three hours. Larger sites with many plugins or custom code can take longer, particularly the database review step.

Should I restore from a backup instead of cleaning the site?

Only if your backup predates the infection and you know exactly when the site was compromised. Restoring an infected backup simply puts you back where you started. If in doubt, clean the current site rather than restoring to a backup of unknown cleanliness.