How to Remove Malware from a WordPress Website (Step-by-Step)

Discovering that your website has been compromised is one of the most frustrating experiences a site owner can face. Fortunately, if you need to remove WordPress malware and regain control of your online presence, you do not have to panic or immediately pay thousands of dollars for emergency remediation. With a structured approach, you can systematically detect infected files, isolate malicious code, clean your database, and secure your site against future vulnerabilities.

In this comprehensive guide, we will walk you through both automated plugin methods and advanced manual cleanup techniques to remove WordPress malware safely without losing your site data or breaking functionality.

Common Symptoms of a Hacked WordPress Site

Before diving into the cleanup process, it is critical to confirm that your site is actually infected. Cybercriminals use sophisticated backdoor scripts, redirect hacks, and SEO spam that can sometimes hide deep within your filesystem. However, several warning signs indicate an active infection:

• Unauthorized Redirects: Visitors or mobile users are automatically redirected to suspicious gambling, phishing, or adult websites.
• Google Search Warnings: Search engine results display “This site may be hacked” or browser red-screen warnings from Google Safe Browsing.
• Disabled Admin Access: You are locked out of your WordPress dashboard, or unknown administrative accounts have been created.
• Spike in CPU/Server Usage: Your web hosting account experiences sudden resource spikes caused by unauthorized background mining scripts or outbound spam email relays.
• Modified Core Files: Core files like index.php, wp-config.php, or .htaccess contain obfuscated PHP code functions such as base64_decode, eval(), or gzinflate().

Step 1: Emergency Preparation & Site Isolation

Executing a cleanup on a live, public-facing website can spread the infection further or cause unexpected site crashes. Therefore, before taking any remediation actions, perform these essential safety measures:

1. Put Your Site in Maintenance Mode

Prevent visitors and malicious bots from executing backdoor scripts during the cleanup process by displaying a temporary maintenance page.

2. Export a Full Site Backup

Even though the current site files contain malware, having an unedited archive of your files and database is crucial. If a script deletion accidentally breaks your site, you can restore this snapshot to try a alternate recovery path. You can create a backup using your host’s cPanel, WP-CLI command line tools, or a reliable backup plugin.

3. Quarantine the Environment

If you host multiple websites on a single shared hosting account, an infection in one folder can cross-contaminate all other domains. Change your hosting control panel passwords, FTP credentials, and SSH keys immediately.

Step 2: Scanning and Identifying Malware

Accurate detection saves hours of trial and error. You must scan both your files and your MySQL/MariaDB database to identify every malicious payload.

Step 3: Automated Malware Cleanup Using Security Plugins

For most site owners, using a dedicated security plugin is the fastest and safest method to remove WordPress malware. Top plugins compare your current core files against official WordPress repository checksums to pinpoint unauthorized modifications.

Recommended Security Tools

• Wordfence Security: Offers deep file scanning, automatic core file repairs, and brute-force protection.
• Sucuri Security: Provides file integrity monitoring, server-side scanning, and post-hack recovery tools.
• MalCare: Uses a powerful off-site server scanner to clean infected files with a single click without overloading your hosting server.

Steps for Plugin Cleanup:

1. Install and activate your chosen security plugin (e.g., Wordfence).
2. Navigate to the plugin’s scan settings and enable high-sensitivity or deep-file scanning.
3. Run a full site scan and review the flagged file list carefully.
4. Use the plugin’s automatic “Repair” or “Delete” function to replace modified core files with original WordPress versions.
5. Clear all site and server-level caching once the scan finishes successfully.

Step 4: Manual WordPress Malware Cleanup

If a malware script has disabled your admin dashboard or altered system permissions, automated plugins may fail to run. In this scenario, you must perform a manual cleanup using FTP or SSH command line access.

1. Replace WordPress Core Files

Replacing core files ensures that all core files are clean while keeping your content intact:

1. Download a fresh ZIP archive of your exact WordPress version from [External Link: Official WordPress.org Download Page].
2. Extract the ZIP file on your computer.
3. Delete the wp-content directory from the freshly downloaded package (so you do not overwrite your custom uploads or themes).
4. Connect to your web server via SFTP or cPanel File Manager.
5. Upload and overwrite the existing wp-admin and wp-includes folders with the clean versions.
6. Upload fresh copies of root files such as index.php, wp-login.php, and wp-settings.php.

2. Clean the wp-config.php File

Open wp-config.php in a text editor. Look at the very top and very bottom of the file. Malicious code is often hidden after hundreds of blank lines or prepended right after the opening <?php tag. Compare your file against the official wp-config-sample.php structure, removing any suspicious functions like eval(base64_decode(...)).

3. Rebuild the .htaccess File

Hackers frequently inject rewrite rules into .htaccess to redirect search engine traffic. Delete your existing .htaccess file and create a new one with default WordPress rules:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

4. Inspect and Clean the Uploads Directory

The /wp-content/uploads/ folder should contain image and document files only. It should never contain active PHP scripts. Search for and delete any .php, .php5, or .phtml files inside this directory.

5. Clean Themes and Plugins

Do not attempt to manually edit infected plugin or theme code line by line. Instead:

• Delete all current plugin folders inside /wp-content/plugins/ and reinstall fresh copies directly from official sources.
• Re-download your parent theme from its original developer and replace all theme files in /wp-content/themes/.
• Check your theme’s functions.php file for backdoor functions or unauthorized admin user creation hooks.

6. Clean the Database

Log into phpMyAdmin or use WP-CLI to scan your database for malicious entries:

• Review the wp_users table and remove any unrecognized administrator accounts.
• Search the wp_options table for malicious code inside the siteurl, home, or auto-loaded option entries.
• Search for common SQL injection strings like <script> or eval() across wp_posts content.

Step 5: Post-Cleanup Recovery & Blacklist Removal

Once you successfully remove WordPress malware, completing immediate post-recovery procedures prevents instant re-infection:

Crucial Step: Cleaning your files is only half the battle. If you do not invalidate compromised session tokens and reset all credentials, attackers can use existing backdoors or stolen passwords to regain access instantly.

1. Reset All Passwords: Force a password reset for all admin users, FTP/SFTP accounts, SSH keys, database credentials, and web hosting account passwords.
2. Regenerate Security Salts: Visit the official WordPress Salt Generator to grab fresh secret keys, then paste them into your wp-config.php file. This instantly logs out all active user sessions across all browsers.
3. Submit for Blacklist Removal: If your site was flagged by Google Safe Browsing, log into Google Search Console, navigate to Security & Manual Actions > Security Issues, and click Request Review. Explain that the site has been completely sanitized.

Step 6: How to Prevent Future Malware Infections

Preventing re-infection requires ongoing vigilance and proper security hardening:

• Keep Everything Updated: Regularly update WordPress core, themes, and plugins. Outdated software accounts for the vast majority of WordPress security vulnerabilities.
• Enforce Two-Factor Authentication (2FA): Require 2FA for all administrative user accounts using plugins like Wordfence or Two Factor.
• Install a Web Application Firewall (WAF): Deploy a cloud-based firewall such as Cloudflare or Sucuri to block malicious bot traffic and SQL injection attempts before they hit your server.
• Disable File Editing: Add define('DISALLOW_FILE_EDIT', true); to your wp-config.php file to prevent attackers from modifying theme and plugin files directly from the WordPress dashboard.
• Set Correct File Permissions: Ensure folders are set to 755 and files are set to 644. Keep wp-config.php secured at 600 or 640.

By following this step-by-step framework, you can systematically remove WordPress malware, eliminate backdoor scripts, restore search engine trust, and shield your site against future security threats.