If you need to remove malware from a WordPress website, the core process involves scanning your files and database for malicious code, deleting or replacing infected files, closing the entry point the attacker used, and hardening your site to prevent reinfection. Acting quickly matters: Google Search Central warns that hacked sites can be demoted or blocklisted within hours of infection being detected. This guide walks you through every step in plain language.

What Are the Warning Signs Your WordPress Site Has Malware?

Before diving into removal, confirm you're actually dealing with malware. Common indicators include:

  • Google's Safe Browsing warning appearing when visitors try to reach your site
  • Unexpected redirects sending visitors to spam or adult websites
  • New admin users you didn't create appearing in your WordPress dashboard
  • Your hosting provider suspending your account citing malicious files
  • Spam links injected into your pages or posts (often invisible to you but visible to search engines)
  • Your site defaced with different content or a hacker's message
  • Sluggish performance caused by cryptomining scripts running in the background

If you see any of these, treat it as confirmed until proven otherwise and begin the steps below immediately.

Step 1: Put Your Site Into Maintenance Mode and Back It Up

Do not skip the backup, even if the site is infected. You may need the infected version to compare files or recover legitimate content later.

  1. Log in to your hosting control panel (cPanel, Plesk, or your host's custom dashboard).
  2. Create a full backup: all files (via File Manager or FTP) and your database (via phpMyAdmin or your host's backup tool).
  3. Label it clearly — for example, backup-infected-2024-06-15 — so you never accidentally restore it as a clean copy.
  4. Enable a maintenance page so visitors are not exposed to malicious content while you work. Many hosts offer a one-click maintenance mode, or you can use a plugin like WP Maintenance Mode if you can still access your dashboard.

Step 2: Scan Your Site to Identify Infected Files

You need to find exactly what was changed and where. Use at least two methods:

Use a WordPress Security Plugin Scanner

If your dashboard is accessible, install and run one of these reputable scanners:

  • Wordfence Security — performs a deep file scan comparing your core files, themes, and plugins against the official WordPress repository checksums.
  • Sucuri SiteCheck — a free remote scanner at sitecheck.sucuri.net that checks your publicly visible pages for known malware signatures.
  • MalCare — uses server-side scanning and is particularly effective at detecting obfuscated (disguised) malware.

Run a full scan and export or screenshot the results before touching anything.

Use Your Hosting Provider's Malware Scanner

Many hosts (SiteGround, WP Engine, Kinsta, Bluehost, etc.) include server-level malware scanning tools built into their dashboards. Run these in parallel — they often catch different things than plugin-based scanners.

Check File Modification Dates via FTP or File Manager

Connect via FTP (using a client like FileZilla) or your host's File Manager. Sort files by last modified date. Any core WordPress files (in wp-admin/, wp-includes/, or the root directory) modified recently and unexpectedly are highly suspicious. Legitimate WordPress core files should only change when you run an official update.

Step 3: Clean or Replace Infected Core WordPress Files

Replace WordPress Core Files

The safest approach for core files is complete replacement, not manual editing:

  1. Download a fresh copy of the exact same WordPress version you are running from wordpress.org/download/releases/.
  2. Via FTP or File Manager, delete the wp-admin/ and wp-includes/ folders entirely.
  3. Upload the clean versions from the downloaded zip.
  4. For root-level files (index.php, wp-login.php, wp-settings.php, etc.), compare them against the clean download and replace any that differ.
  5. Do not replace wp-config.php or the wp-content/ folder at this stage — these contain your site-specific settings and content.

Inspect and Clean wp-config.php

Open wp-config.php in a text editor. Look for anything that does not belong, particularly:

  • eval() calls
  • base64_decode() strings (long strings of random characters)
  • gzinflate() or str_rot13() functions
  • Unfamiliar require or include statements pointing to unknown files

Remove any suspicious code carefully. If you are unsure whether a line is legitimate, compare it against a clean wp-config.php template from the WordPress documentation at developer.wordpress.org.

Step 4: Clean Your Themes and Plugins

Remove and Reinstall Plugins

  1. In your WordPress dashboard (or via FTP), delete every plugin folder inside wp-content/plugins/.
  2. Go to Plugins > Add New and reinstall only the plugins you actively need, downloading fresh copies from wordpress.org or their official vendors.
  3. Do not reinstall plugins that are outdated, abandoned, or that you obtained from unofficial sources — these are among the most common malware entry points.

Clean or Replace Your Theme

  1. If you are using a standard theme from the WordPress repository (Twenty Twenty-Four, etc.), delete it and reinstall a fresh copy.
  2. If you are using a premium or custom theme, you need to manually audit it:
    • Search all .php files for eval(, base64_decode(, gzinflate(, preg_replace with the /e modifier, and $_POST or $_GET followed by eval.
    • On Linux servers via SSH, you can run: grep -rl "eval(base64_decode" /path/to/wp-content/themes/
    • Remove or replace any file containing these patterns unless you can confirm they are legitimate (some plugins legitimately use base64 encoding, but it should be immediately obvious from context).
  3. Delete all inactive themes — attackers frequently hide backdoors in themes that appear unused.

Check wp-content/uploads/

The uploads folder should contain only media files (images, PDFs, videos). Scan it specifically for .php files, which should never be there under normal circumstances:

find /path/to/wp-content/uploads/ -name "*.php"

Delete every .php file found in this directory.

Step 5: Scan and Clean Your Database

Malware is sometimes injected directly into your WordPress database — commonly into posts, options, or user records.

  1. Open phpMyAdmin via your hosting control panel.
  2. Select your WordPress database.
  3. Use the Search function to look for known malicious strings across all tables:
    • <script (look for unfamiliar or obfuscated script tags)
    • eval(
    • base64_decode
    • hacked by
    • Known spam domains or redirects you identified earlier
  4. The wp_options table is a frequent target — check the siteurl and home values to ensure they still point to your own domain, and review the active_plugins value.
  5. The wp_users table should contain only users you recognise. Delete any admin-level users you did not create.

Always export a database backup before making any edits in phpMyAdmin.

If this step feels overwhelming, plugins like WP-DBManager or the cleaning tools built into Wordfence and MalCare can automate database scanning with a lower risk of accidental damage.

Step 6: Remove Backdoors

Attackers almost always install a backdoor — a hidden way back in — so that even after you clean the obvious infection, they can reinfect the site. OWASP identifies backdoor persistence as one of the primary reasons site cleanups fail.

Common backdoor locations:

  • A hidden file in wp-content/uploads/ (already addressed in Step 4)
  • A rogue plugin in wp-content/plugins/ — sometimes named to look legitimate (e.g., wp-cache-manager, akismet-fix)
  • Code added to functions.php in your active theme
  • A new admin user in the wp_users table (addressed in Step 5)
  • A file in the root directory named something innocuous like xmlrpc-new.php or wp-info.php

Cross-reference everything your scanner found against this list and remove all suspicious files.

Step 7: Change All Passwords and Secret Keys

Assume every credential associated with your site is compromised:

  1. WordPress admin passwords — change every admin-level user's password from Users > All Users.
  2. Database password — update it in your hosting control panel and then update the DB_PASSWORD line in wp-config.php to match.
  3. FTP/SFTP credentials — reset these in your hosting control panel.
  4. Hosting account password — reset this and enable two-factor authentication (2FA) on your hosting account.
  5. WordPress Secret Keys and Salts — go to https://api.wordpress.org/secret-key/1.1/salt/ to generate a fresh set, then replace the existing keys in your wp-config.php. This immediately invalidates all existing login sessions, logging out any attacker who may have an active session.

Step 8: Request a Google Safe Browsing Review

If Google had flagged your site with a malware warning (visible as a red interstitial warning page), you must request a review once your site is clean:

  1. Sign in to Google Search Console (search.google.com/search-console).
  2. Go to Security & Manual Actions > Security Issues.
  3. Review the listed issues and confirm each one has been resolved.
  4. Click Request Review and provide a clear description of what you found and what steps you took to clean the site.

Google typically responds within 1–3 days. CISA (the U.S. Cybersecurity and Infrastructure Security Agency) also recommends notifying your hosting provider so they can confirm the server environment is clean at the infrastructure level.

Step 9: Harden Your WordPress Site to Prevent Reinfection

Cleaning a site without fixing the underlying vulnerability is pointless — attackers often return within days. Implement these hardening measures before you consider the job finished:

Keep Everything Updated

  • Enable automatic background updates for WordPress core minor versions.
  • Update all plugins and themes to their latest versions immediately.
  • Remove any plugin or theme that is no longer actively maintained.

Install a Web Application Firewall (WAF)

A WAF intercepts malicious traffic before it reaches your site. Reputable options include Wordfence (plugin-level WAF) and Cloudflare (DNS-level WAF with a free tier). OWASP specifically recommends WAFs as a primary defence layer for web applications.

Limit Login Attempts

Brute-force attacks on wp-login.php are extremely common. Plugins like Limit Login Attempts Reloaded or the built-in login protection in Wordfence will lock out IPs after a defined number of failed attempts.

Disable XML-RPC If You Don't Need It

XML-RPC (xmlrpc.php) is a frequent attack vector. Unless you use it for mobile app access or specific integrations, disable it. You can do this by adding the following to your .htaccess file:

apache <Files xmlrpc.php> Order Deny,Allow Deny from all </Files>

Set Correct File Permissions

As a general rule (verify with your host):

  • Directories: 755
  • Files: 644
  • wp-config.php: 600 or 640

Overly permissive file permissions (e.g., 777) are a common enabler of attacks.

Enable Two-Factor Authentication

Use a plugin like WP 2FA or Google Authenticator to require a second factor for all admin logins.

Schedule Regular Automated Backups

Use a plugin like UpdraftPlus or your host's built-in backup system to schedule daily or weekly backups stored off-site (e.g., to Amazon S3, Google Drive, or Dropbox). A clean, recent backup is your fastest recovery option if this ever happens again.

When Should You Hire a Professional?

If any of the following apply, consider engaging a professional malware removal service:

  • You cannot access your WordPress dashboard or FTP at all
  • Your hosting account has been fully suspended
  • The infection keeps returning after multiple cleaning attempts (persistent backdoor)
  • You run an e-commerce site that may have had payment data exposed (this may also trigger PCI DSS notification obligations)
  • You are not confident working with files, databases, or the command line

Reputable services include Sucuri's manual malware removal service and Wordfence's Site Cleaners. Expect to pay in the range of $200–$500 USD for a professional clean, which typically includes a 30-day reinfection guarantee.

Frequently Asked Questions

How long does it take to remove malware from a WordPress site?

For a moderately infected site, expect 2–6 hours if you follow the steps above methodically. Severely compromised sites with multiple backdoors or database injections can take longer. Professional services typically turn around a clean site within 24–48 hours.

Can I just restore a backup instead of manually cleaning the site?

Yes, if you have a confirmed clean backup from before the infection occurred, restoring it is often the fastest path to recovery. However, you must still identify and close the vulnerability that allowed the attack — otherwise the attacker will simply reinfect the restored site using the same method. Also ensure the backup you restore pre-dates the infection, which is not always easy to determine.

Will removing malware bring my Google rankings back?

Once Google's Safe Browsing review is complete and your site is removed from the blocklist, your rankings typically recover over a period of days to a few weeks, provided the malware was not present for an extended period. Long-term infections that caused significant spam link injection or content changes may take longer to recover in search results.

How did my WordPress site get infected in the first place?

The most common entry points, according to OWASP and WordPress security research, are: outdated plugins or themes with known vulnerabilities, weak or reused admin passwords, nulled (pirated) themes or plugins containing pre-installed backdoors, compromised FTP credentials, and insecure shared hosting environments. Auditing which of these applied to your situation is essential before relaunching.

How can I tell if my WordPress site is clean after I've finished?

Run a final scan with Wordfence or MalCare, re-run the Sucuri SiteCheck remote scanner, verify Google Search Console shows no remaining security issues, and ask a trusted colleague to visit your site from a different network and device. Monitor your site daily for at least two weeks post-cleanup using an uptime and security monitoring tool, and check your admin users list and file modification dates periodically for any signs of return.