How to Remove Malware From a WordPress Site

If your WordPress site is infected, the instinct is to start deleting things at random. Resist it. Malware removal that works is a calm, ordered process, and malware removal that fails is usually the panicked version that missed the way back in. This post is the sequence I follow to clean an infected WordPress site, why a single plugin scan rarely finishes the job, and the step most people skip that guarantees the infection comes back.

If you are not yet sure the site is compromised, I have written separately on the signs your WordPress site is hacked. If you already know it is, start here. For the wider recovery picture beyond the malware itself, from taking the site offline to closing the gap the attacker used, see how to recover a hacked WordPress site.

First, do not clean a live compromised site in place

The temptation is to start deleting suspicious files on the live server while the site is still up. Two reasons not to.

First, an attacker who still has access can reinfect faster than you can clean. You will be chasing files that reappear behind you. Second, a compromised site can be actively serving malware to visitors or being used to attack others, so leaving it up prolongs the damage and can get you blocklisted.

Take the site offline or into maintenance mode first. Then work on a copy, or work methodically with the understanding that until you have closed the entry point, cleaning is temporary.

Take a backup before you touch anything

This sounds strange when the site is infected, but do it anyway. Back up the current state, database and files, before you start cleaning.

You are not backing it up to restore it. You are backing it up because cleaning is destructive, mistakes happen, and a copy of the "known bad" state lets you compare, recover a file you deleted too eagerly, and investigate how the compromise happened after the emergency is over. Label it clearly as infected so nobody restores it by accident.

The removal process, in order

Malware removal is a sequence, not a single action. Work through it in order.

• Scan to understand the scope. A reputable scanner is where you start, not where you finish. Wordfence and Sucuri both scan core, plugin, and theme files against known-good versions and flag what has changed or been injected. This tells you what you are dealing with. It rarely catches everything, which is why it is step one, not the whole job.
• Replace core, themes, and plugins from clean sources. The reliable way to clean WordPress core is to delete it and reinstall it fresh from wordpress.org, keeping only your wp-config.php and your uploads. Do the same for plugins and themes: reinstall each from the official source rather than trying to surgically remove injected code. A fresh known-good copy is faster and more trustworthy than picking malware out of a file line by line.
• Check the usual hiding places. Malware favours a short list of spots: the wp-content/uploads folder, which should contain media and no PHP files at all, the wp-content/mu-plugins folder, which auto-loads anything dropped in it, the .htaccess or nginx config for injected redirects, and the database wp_options table for malicious injected entries. A scanner may miss these. Look yourself.
• Hunt for the backdoor. This is the file that lets the attacker back in after you have cleaned everything else, and it is the reason infections return. It is often a small, innocuous-looking PHP file with a plausible name, dropped somewhere unexpected. Any PHP file inside uploads is a backdoor until proven otherwise. So is any core file whose contents do not match the official version.
• Audit the users. Attackers create admin accounts to keep access. Review every user with an Administrator role and delete any you do not recognise. Check for accounts created around the time of the compromise.

Close the way in, or it all comes back

This is the step people skip, and skipping it is why "I cleaned it and it got reinfected" is such a common story.

Cleaning removes the malware. It does not remove the vulnerability that let the malware in. If you clean the site but leave an outdated plugin with a known exploit, a weak admin password, or a backdoor you missed, the site is reinfected within days, sometimes hours, and now you are doing the whole job again with less patience.

So before you bring the site back:

• Update WordPress core, every plugin, and every theme to their current versions. The entry point is very often a plugin with a public vulnerability.
• Reset every password, admin accounts, database, hosting, FTP or SSH. Assume they are all compromised.
• Regenerate your secret keys and salts in wp-config.php so any stolen session cookies are invalidated.
• Confirm you found and removed the backdoor. If you are not confident, the safest path is a full rebuild from a known-clean backup taken before the compromise, onto a fresh environment.

When to stop and call someone

Be honest with yourself about the point of diminishing returns. If the site keeps getting reinfected after you have cleaned it, if you cannot find the backdoor, or if the site handles customer data or payments, a professional malware removal service like Wordfence Care or Sucuri is money well spent. There is no shame in it. A specialist who does this daily will find the file you cannot, and the cost is small next to a site that stays infected.

The removal checklist

1. Take the site offline or into maintenance mode.
2. Back up the current infected state and label it clearly.
3. Scan with a reputable tool to understand the scope.
4. Reinstall core, plugins, and themes from official clean sources.
5. Manually check uploads, mu-plugins, .htaccess or nginx config, and wp_options.
6. Find and remove the backdoor. Treat any PHP file in uploads as hostile.
7. Delete every unrecognised admin account.
8. Update everything to current versions.
9. Reset all passwords and regenerate wp-config salts.
10. Only then bring the site back, and monitor it closely for 48 hours.

Where this fits

The Protect My WP handbook covers this from both ends. Chapter 10 covers the monitoring and file integrity checks that catch a compromise early, while the incident-response material walks through the full clean-and-recover sequence in more depth than a blog post allows. The best malware removal is the one you never have to do, and most of this book is about making that the outcome.

If you have cleaned a site once and never want to do it again, the book is where the prevention lives.

Get the book for £19.