Incident response · 2026-07-10

WordPress Malware Removal: The Complete Cleanup Guide

Cleaning a hacked WordPress site is straightforward if you work methodically: replace what you can from clean sources, clean what you can't, remove backdoors, and reset the secrets that let the attacker in. This is the complete WordPress malware removal guide, step by step.

Map the damage first: run a free MageArgus scan for web-reachable indicators, then dig into files and the database.

By the numbers

Backdoors are the top reason cleaned sites get re-infected — Sucuri
Most infections enter via an outdated plugin or theme — WPScan / Patchstack

1. Back up and go offline

Snapshot the full site (files + database) for evidence, then put the site into maintenance mode. Note your WordPress, plugin and theme versions — you'll need clean copies.

2. Replace core, plugins and themes from clean sources

The fastest clean: reinstall WordPress core and every plugin/theme from official sources, overwriting the potentially-modified files. Delete anything you don't recognise or use. Never keep nulled plugins — they're a common backdoor source.

wp core verify-checksums          # flags modified core files
wp plugin verify-checksums --all  # flags modified plugin files

3. Hunt backdoors in uploads and wp-content

Attackers hide PHP where it shouldn't be:

find wp-content/uploads -name '*.php' -type f     # nothing should run here
grep -rIl 'eval(\|base64_decode\|gzinflate\|str_rot13\|assert(' wp-content/ 2>/dev/null

Review each hit — obfuscated one-liners and unfamiliar PHP in uploads are almost always malicious.

4. Clean the database

Check for injected scripts and spam in posts, options and widgets:

wp db query "SELECT option_name FROM wp_options WHERE option_value LIKE '%<script%' OR option_value LIKE '%eval(%';"

Look for rogue admin users too: wp user list --role=administrator.

5. Reset every secret

Regenerate the security keys/salts in wp-config.php (this logs everyone out).
Change all admin and database passwords, and any API keys.
Delete unknown admin accounts and unused users.

6. Patch, harden, and re-scan

Update everything to close the entry point, then apply the WordPress security checklist. Re-scan to confirm clean, and monitor for a few days. If you were on Google's blocklist, request a review once verified clean.

Frequently asked questions

Can a plugin remove the malware for me?

Scanner plugins can find and remove common infections, but a determined attacker's backdoors and database injections often need manual cleanup. Always pair automated removal with patching the entry point and resetting secrets, or it comes back.

How did my WordPress site get infected?

Usually an outdated plugin or theme with a known vulnerability, a weak/reused admin password, or a nulled plugin containing a backdoor. Identifying which is essential — otherwise you'll be cleaning the same site again next month.