How to Remove Malware From WordPress: A Step-by-Step Clean-Up Guide

Malware on a WordPress site rarely announces itself politely. You notice spam pages in Google. A visitor mentions a strange redirect. Your host sends a warning email and suspends the account. By then the infection has usually been there for weeks.

This guide walks through how to remove malware from WordPress properly. Not a surface tidy-up — the full process, including the part most people skip.

Before you touch anything: take a backup

Back up the files and the database first, even though they are infected. You are not saving the backup to restore it. You are saving it so you can look things up later.

Clean-ups sometimes break a page. Having the original means you can compare. Store it off the server, and never restore it blindly.

Step 1: Work out what kind of infection you have

Different symptoms point to different problems. Match yours before you start digging:

• Spam pages in search results — usually injected content plus a cloaking script. The pages are often invisible to you and visible to Google.
• Redirects to another site — typically a script in your theme files, .htaccess, or the wp_options table.
• Fake login or payment pages — a phishing kit uploaded to your hosting, usually in a folder you never created.
• Site slow or sending spam email — your server is being used as a resource. Look for mailer scripts and cron jobs.
• Admin users you don't recognise — someone has full access. Treat this as urgent.

Also check Google Search Console under Security Issues. It often names the exact URLs it found.

Step 2: Clean the files

The fastest reliable method is replacement, not editing. Download a fresh copy of WordPress at your exact version. Replace wp-admin and wp-includes entirely. These folders should never contain your own code.

Then do the same for every theme and plugin. Reinstall each one from the official source rather than trying to spot the modified line. If a plugin is nulled, pirated or abandoned, delete it. Do not reinstall it.

What remains needs manual review:

• wp-config.php — check the top and bottom for injected code
• .htaccess — look for redirect rules you did not write
• wp-content/uploads — this folder should hold media only. Any .php file here is malicious
• Files in the web root that do not belong to WordPress

Sort your file manager by date modified. Anything changed around the time symptoms started deserves a look.

Step 3: Clean the database

This is the step most guides skip, and it is why infections come back. Files get replaced, the database keeps the payload, and the site reinfects itself within days.

Check these places:

• wp_options — especially any autoloaded row containing <script>, eval( or base64_decode
• wp_posts — injected links and hidden divs inside post content
• wp_users — accounts you did not create
• wp_usermeta — a normal-looking user quietly promoted to administrator

Work on a copy if you can. Database edits are easy to get wrong and hard to undo.

Step 4: Find the backdoor

Here is the part that decides whether your clean-up holds. Attackers almost always leave a way back in. It is usually a small file, often only a few lines, sitting somewhere unremarkable.

If you remove malware from WordPress but leave the backdoor, you have not fixed the site. You have delayed it.

Backdoors hide in predictable places: the uploads folder, an inactive theme, a plugin folder with a plausible name, or a mu-plugins directory you never set up. Some are disguised as legitimate files with a single extra line at the bottom.

Inactive themes and plugins are a common blind spot. Deactivated code still sits on the server and can still be executed directly. Delete anything you are not using.

Step 5: Lock the site down

Now close the door. Change every password: WordPress administrators, hosting panel, FTP or SFTP, and the database user. Change them all, not just the one you suspect.

Then update WordPress core, all themes and all plugins. Remove any admin account that should not exist. Add two-factor authentication for administrators. Regenerate your WordPress security keys in wp-config.php so existing sessions are invalidated.

If your site takes payments or stores customer data, tell the people affected. That is a legal obligation in most places, not a courtesy.

Step 6: Confirm it is actually clean

Scan again with a tool that reads server-side files, not just the public page. Then check the site the way a stranger would. Search site:yourdomain.com in Google and look for pages you never published. Visit your homepage from a phone on mobile data — some malware only triggers for mobile users arriving from search.

If Google flagged you, request a review in Search Console once you are confident. Describe what you found and what you removed.

Why infections come back

Reinfection is common, and the reasons are consistent. The backdoor survived. The database was never checked. An outdated plugin was reinstalled at the same vulnerable version. Or nothing changed about how the site was maintained afterwards.

A clean-up fixes today. Maintenance fixes next month. Sites that get infected repeatedly are almost always sites nobody is watching.

When to bring in help

Doing this yourself is realistic if you are comfortable with file access and databases, and the infection is simple. Get help if the site is a live shop, if you have cleaned it once already and it returned, if your host has suspended the account, or if you are not certain you found everything.

Our WordPress security and error fixing service handles the whole process: files, database, backdoors, hardening, and the Google review if you are blacklisted. There is a clean-or-free guarantee, so the risk sits with us.

If you would rather not go through this again, our security monitoring service watches for file changes and malware continuously, so problems get caught early instead of being discovered by a customer.

Send us your web address and we will tell you what we can see, usually the same day.