Discovering malware on your WordPress site is one of the most stressful things that can happen to a site owner. One morning your site is fine. The next, it is redirecting visitors to a gambling page, Google is showing a “this site may be hacked” warning, or your host has suspended your account.
Take a breath. Malware removal is stressful, but it is a structured, achievable process when you follow the right steps in the right order. The danger is not just the malware itself; it is rushing, skipping steps, and leaving a backdoor open that lets the infection come right back.
In this guide, we will walk through the complete process: confirming the infection, properly cleaning it, and, most importantly, hardening your site so it does not happen again.
Quick Answer: If Your Site Is Hacked Right Now
If you are in the middle of an active infection and need the short version:
- Put your site in maintenance mode to protect visitors
- Change every password (WordPress, hosting, FTP, database)
- Take a full backup of the compromised site before cleaning anything
- Restore a clean pre-infection backup if you have one (this collapses the whole process into one step)
- If not, scan to find infected files, then clean both your files and your database
- Replace WordPress core, reinstall plugins and themes from official sources
- Remove backdoors and unknown admin users
- Reset all credentials and security keys
- Harden the site (updates, 2FA, firewall) so it cannot happen again
- Request a review in Google Search Console to clear any warning
The rest of this guide explains each step in detail. The golden rule: do not stop once the visible symptom disappears, because that is exactly how sites get reinfected.
First, Understand This: Cleaning Is Only Half the Job
Before any steps, internalize the single most important principle of malware removal.
Removing the visible symptom is not the same as removing the infection. Modern WordPress malware installs backdoors, hidden admin users, and code injected across many files. If you delete the one file causing redirects but miss the backdoor, the malware reinstalls itself within hours or days. This is why people “clean” their site three times and stay frustrated.
The goal is not to make the symptom disappear. The goal is to remove every way back in. That means cleaning both your files and your database, closing the vulnerability that let the attacker in, and rotating every credential. Do not rush the boring steps, because the boring steps are what actually keep the malware out.
Step 1: Confirm Your Site Is Actually Infected
Not every problem is malware. Before you start deleting anything, confirm you are actually dealing with an infection. The most reliable symptoms:
- Unexpected redirects. Visitors land on your pages but get bounced to spam, pharma, or gambling sites. Often the redirect only fires for visitors arriving from Google, not for direct visits, so owners miss it for days.
- Google warnings. “Deceptive site ahead” or “This site may be hacked” appearing in search results or when loading your site.
- Host suspension. Your hosting provider suspends your account or emails you about malicious activity.
- Unknown admin users. New administrator accounts you did not create.
- Modified core files. Files in wp-admin or wp-includes that have been changed. You can verify this by comparing your WordPress files against the official WordPress.org checksums, which reveal any file that differs from the original.
- Sudden traffic or performance changes. Unexplained spikes, crashes, or a sudden ranking drop.
- Spam content. Pages or posts you did not create, often for pharmaceuticals, gambling, or counterfeit goods.
If you are not sure, run a scan. Webueno’s Malware Scanner checks your site and tells you clearly whether something is wrong, without any technical setup.
Step 2: Assess Your Access and Stop the Bleeding
Before cleaning, figure out what you can still access, because it determines your approach.
Confirm whether you still have access to your WordPress admin dashboard, your hosting control panel, and FTP/SFTP or SSH. If wp-admin is locked but the hosting panel works, manual cleanup is still possible. If everything is locked, contact your host immediately to regain access.
Then contain the damage. Put your site into maintenance mode if you can, which stops visitors from being exposed to the malware and protects them while you work. This also prevents further harm to your reputation and stops Google from crawling infected pages during cleanup.
The easiest way, if you still have dashboard access, is to install a maintenance mode plugin. If you do not, you can trigger WordPress’s built-in maintenance mode manually: create a file named .maintenance in your site’s root directory containing <?php $upgrading = time(); and your site will display a maintenance message to visitors.
Step 3: Back Up Everything Before You Touch Anything
This feels counterintuitive: why back up an infected site? Because if you make a mistake during cleanup and break something, you need a way to restore and try again.
Take a complete backup of your current site, all files and the full database, even though it is infected. Download it to your local computer and label it clearly as the infected version so you never accidentally restore it later. This is your safety net during the cleanup itself, not a clean restore point.
Never skip this step. Cleanup involves deleting and modifying files, and mistakes happen. A backup means a mistake is recoverable instead of catastrophic.
Step 4: Check for a Clean Backup (The Shortcut)
Here is the good news that can save you hours. If you have a clean backup from before the infection, the entire cleanup can collapse into a single restore.
Check your backups for a restore point dated before the infection started. If you have one, and you are confident it predates the breach, restoring it is far faster and more reliable than manual cleanup. The catch: you must be certain the backup is clean. A backup from yesterday is useless if the infection started last week; restoring it just reinstalls the malware and wastes your time.
If you do not have a clean backup, or cannot be sure when the infection started, proceed to manual cleanup below. And let this be the lesson that makes you set up daily backups afterward, because a clean daily backup turns a multi-day disaster into a five-minute restore.
Step 5: Scan to Identify Infected Files
Now find the malware. Use a dedicated scanner to identify which files are infected rather than guessing.
Two types of scanning help here:
Security plugin scan. If you still have dashboard access, a security plugin like Wordfence or Sucuri can scan your installation and flag infected files. Use only one scanner at a time to avoid overloading your server.
Server-level scan. Server-side scanners like ClamAV or tools built into hosting panels (such as cPanel’s Virus Scanner) inspect files across your entire hosting account, including areas outside WordPress that plugin scanners miss. Backdoors often hide outside the WordPress folders, so this matters.
Document the scan results before deleting anything, so you know exactly which files were flagged and can investigate the surrounding code. Remember that automated scanners do not catch everything, especially custom or heavily obfuscated malware, so treat the scan as a starting map, not the complete picture.
Step 6: Clean the Infected Files
With your map in hand, start cleaning. Work methodically.
Replace WordPress core files. Download a fresh copy of WordPress from WordPress.org (the same version you were running), and replace the wp-admin and wp-includes folders entirely via FTP/SFTP. These folders should never contain your custom content, so replacing them wholesale removes any injected core malware safely.
Reinstall plugins and themes from clean sources. Rather than trying to surgically clean each plugin, delete them and reinstall fresh copies from WordPress.org or the original vendor. Delete any plugin or theme you do not actively use. Never reinstall nulled (pirated) plugins, as they are a leading malware source.
Inspect the usual hiding spots manually. Malware loves specific files. Check these for injected or unfamiliar code: .htaccess, wp-config.php, index.php, and the theme’s functions.php. Look especially for obfuscated code like eval(base64_decode(…)), which is a classic malware signature hidden inside otherwise normal-looking files.
Check the uploads folder. The wp-content/uploads directory should contain only media files. Any PHP file in there is a red flag, since uploads should never execute code.
Work carefully and reference your infected backup if you need to compare or recover legitimate content.
Step 7: Clean the Database
This is the step people skip, and it is why they get reinfected. Malware hides in the database, not just the files.
Using phpMyAdmin or a database tool, inspect your database for injected content. Common hiding spots are the wp_options and wp_posts tables, where attackers inject hidden JavaScript redirects, spam links, or malicious scripts. Look for suspicious code, unfamiliar URLs, and injected <script> tags.
Also check wp_users for admin accounts you did not create, and review the database for rogue scheduled tasks (cron jobs) the malware may have set up to reinfect the site automatically.
Cleaning the database is more technical than cleaning files, and mistakes here can break your site, which is another reason your infected backup matters. If you are not comfortable editing the database directly, this is the point where professional help is worth it.
Step 8: Remove Backdoors and Rogue Users
Backdoors are how malware comes back. Even after cleaning files and the database, hunt for the ways in.
Delete any admin users you do not recognize. Attackers often hide these accounts so they do not appear in the normal user list, so check the database directly, not just the dashboard. Remove any suspicious scheduled tasks. And review your file system for stray PHP files in unexpected locations, which are often backdoors left specifically to re-establish access.
This is the step that determines whether your cleanup actually holds. The backdoor is usually in the half you forgot to check.
Step 9: Reset Every Credential
Once the site is clean, assume every password was compromised and rotate all of them:
- All WordPress admin passwords
- Your hosting account password
- Database password (update wp-config.php to match)
- FTP/SFTP and SSH credentials
- Any connected service or API keys
Also update your WordPress security keys (the AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, and their _SALT counterparts in wp-config.php), which forces all logged-in sessions to log out, including any the attacker may still have open. You can generate a fresh set instantly using WordPress’s official salt generator and paste them in to replace the old ones.
Step 10: Harden Your Site So It Does Not Happen Again
Cleaning without hardening is temporary. The same vulnerability that let malware in will let it back in, often within days. Apply these immediately:
- Update everything. WordPress core, all plugins, all themes. Outdated software with known vulnerabilities is the number one entry point for WordPress malware. If a database update is required, WordPress or the affected plugin will prompt you to run it. If you do not trust a particular installation or the dashboard is not functioning correctly, you can manually upload fresh copies of WordPress core, plugins, or themes via FTP/SFTP before updating.
- Enable two-factor authentication on all admin accounts.
- Limit login attempts to block brute force attacks on your login page.
- Set correct file permissions (typically 755 for directories, 644 for files, and a locked-down wp-config.php).
- Install a security plugin or firewall to monitor and block future attacks.
- Delete unused plugins, themes, and admin accounts to reduce your attack surface.
- Set up ongoing malware scanning so any future issue is caught early, not months later.
For the full preventive picture, our guide on why WordPress sites get hacked breaks down every common entry point and how to close it.
Step 11: Ask Google to Review Your Site
If Google flagged your site or your host blacklisted it, cleaning is not the final step; getting re-approved is.
In Google Search Console, go to the Security Issues report, confirm you have resolved the problems, and request a review. Google will re-crawl your site and, once satisfied it is clean, remove the warning. This can take a few days. Until it clears, the warning keeps scaring away visitors even though your site is already clean, so do not skip it.
Why Custom Malware Is So Hard to Remove Yourself
One honest warning. Everything above works for typical, scanner-detectable infections. But a significant category of WordPress malware is custom-written specifically to evade detection.
Standard security plugins match files against known malware signatures. Custom malware has no signature to match, so scanners miss it entirely. It embeds itself deep in legitimate files, hides across the database, and leaves multiple backdoors so that removing one changes nothing. In these cases, even a careful manual cleanup can miss something, and the site gets reinfected within hours.
This is why, for a serious or repeat infection, the safest resolution is often to clean the site, move it to a fresh server, and replace all old components rather than trusting that a cleaned-but-same-environment site is truly clear. Getting this right requires experience most site owners do not have, and getting it wrong means doing the whole stressful process again.
Common Mistakes That Cause Reinfection
Most failed cleanups come down to the same handful of errors. Avoid these, and your cleanup is far more likely to hold.
Cleaning files but not the database. The single most common mistake. Malware lives in both. Skip the database and the infection survives.
Deleting one infected file and stopping. Malware rarely lives in one place. Removing the file causing the visible symptom while leaving the backdoors means it returns within hours.
Restoring an infected backup. If your “clean” backup was actually taken after the infection started, you just reinstalled the malware. Always verify the backup predates the breach.
Forgetting to close the entry point. If you clean everything but leave the outdated plugin or weak password that let the attacker in, they simply walk back through the same door.
Not resetting credentials. The attacker may still have your passwords. Cleaning the site without rotating every credential leaves them a way straight back in.
Running multiple security scanners at once. This overloads your server and can produce conflicting results. Use one scanner at a time.
Rushing. Malware removal rewards patience. The boring, methodical steps are the ones that actually keep the infection out.
How Much Does WordPress Malware Removal Cost?
Costs vary widely depending on how you handle it.
DIY is free in money but expensive in time and risk. A straightforward infection might take a few hours; a serious one can consume days, and a mistake can take the site offline or lead to reinfection, which costs more in lost traffic and revenue.
Professional cleanup typically ranges from around $50 to several hundred dollars per site depending on severity, with specialized emergency services costing more. Compare that to the average cost of a WordPress hack (remediation, downtime, lost revenue, and SEO recovery), which routinely runs into the thousands, and professional cleanup is usually the cheaper option when the infection is serious.
The most cost-effective approach of all is prevention: a maintained site on secure hosting with monitoring rarely gets infected in the first place, which is far cheaper than any cleanup.
When to Get Professional Help
Manual malware removal is doable if you are technically confident, have time, and the infection is straightforward. But it is genuinely risky. Miss one line of obfuscated code and the site reinfects. Make a mistake replacing core files, and the site goes down entirely, costing more in lost revenue than the cleanup would have.
Professional help makes sense when the infection is severe or keeps coming back, when your site is business-critical and downtime is expensive, when Google has blacklisted you, or when you are simply not confident editing core files and databases directly.
Webueno’s Malware Cleanup service handles the entire process: complete removal of malicious code and backdoors, database cleanup, closing the vulnerability that caused the breach, and guidance through Google’s review process. We also verify the site is genuinely clean before finishing, rather than just making the symptom disappear. Because we provide managed WordPress hosting with isolated servers and a built-in malware scanner, we can also move your cleaned site to a secure environment and monitor it so the problem does not return.
Recovering With Confidence
A hacked WordPress site feels like a catastrophe, but it is a recoverable one. The key is to work in order and not rush: confirm the infection, contain it, back up, clean both files and database, remove every backdoor, reset all credentials, and harden the site so it cannot happen again.
The single biggest mistake is stopping once the visible symptom disappears. Real recovery means removing every way back in, which is exactly the part that DIY cleanups tend to miss.
If you are dealing with an infection right now and want it handled properly, or you are tired of cleaning the same site twice, Webueno’s Malware Cleanup service removes the infection completely and helps make sure it stays gone.
Get your WordPress site cleaned and secured
Frequently Asked Questions
How do I know if my WordPress site has malware?
Common signs include unexpected redirects to spam or gambling sites (often only for visitors from Google), Google “this site may be hacked” warnings, your host suspending your account, unknown admin users, modified core files, and spam pages you did not create. If you are unsure, run a malware scan to confirm.
Can I remove WordPress malware myself?
Yes, if you are technically comfortable. The process involves confirming the infection, backing up, scanning, cleaning both files and the database, removing backdoors, resetting credentials, and hardening. The risk is that missing a single backdoor or line of obfuscated code leads to reinfection, which is why severe or repeat infections are often best handled professionally.
Why does my WordPress site keep getting reinfected?
Reinfection almost always means the cleanup missed something: a backdoor, a hidden admin user, injected database code, or the original vulnerability was never closed. Malware hides in multiple places, so cleaning only the visible symptom leaves the way back in open. Custom malware that scanners cannot detect is another common cause.
Do I need to clean the database or just the files?
Both. This is one of the most common and costly mistakes. Malware frequently injects code into the database (in tables like wp_options and wp_posts) and creates hidden admin users there. Cleaning only the files leaves the database infection in place, and the site stays compromised or gets reinfected.
Will a security plugin remove all malware automatically?
Not always. Security plugins are excellent for detection and can clean many known infections, but they match against known malware signatures. Custom or heavily obfuscated malware has no signature to match and can evade them entirely. Plugins are a valuable tool, not a guaranteed complete cleanup for every infection.
How long does WordPress malware removal take?
With a clean backup, a restore can take minutes. A manual cleanup of a straightforward infection might take a few hours. Severe infections with multiple backdoors, custom malware, or database injections can take much longer and carry a real risk of reinfection if rushed, which is when professional cleanup is worth it.
What should I do first if my site is hacked?
Do not start deleting files randomly. First confirm the infection and check what access you still have. Put the site in maintenance mode to protect visitors, then take a full backup of the compromised site before touching anything, so you can recover if a cleanup step goes wrong. Then work through cleaning in order.
How do I remove the Google “this site may be hacked” warning?
After fully cleaning your site, go to Google Search Console, open the Security Issues report, confirm the issues are resolved, and request a review. Google re-crawls your site and removes the warning once it confirms the site is clean, which usually takes a few days.
