You found malware on your WordPress site. You want it gone – fast. That rush is exactly where most beginners trip up.
I've seen the aftermath of panicked cleanup attempts in dozens of support tickets. A broken site, deleted user data, or the malware coming back stronger. Slow down. Avoid these nine mistakes and you'll actually fix the problem.
Mistake #1: Not Taking a Full Backup First
You're staring at a hacked site. Every second the malware stays feels like a disaster. So you dive straight in – deleting files, changing passwords, running plugins. Then something breaks. Now you have a broken, still-infected site and no way to revert.
Correct approach: Before you touch anything, create a full backup – files and database. Use your hosting control panel's backup feature, or a plugin like UpdraftPlus, or manually dump the database with mysqldump:
mysqldump -u username -p database_name > backup.sql
Then zip your entire WordPress directory:
zip -r wordpress_backup.zip /path/to/wordpress
Keep this backup somewhere safe – off-server. You might need to reference original files later.
Mistake #2: Using Insecure Methods to Download the Site
A common reflex: FTP the whole infected site to your local machine for analysis. Over plain FTP. That's bad – the malware could reinfect your computer or steal credentials via packet sniffing.
Correct approach: Use SFTP or SSH with key-based authentication. If you have shell access, rsync over SSH is your friend:
rsync -avz -e ssh [email protected]:/path/to/wordpress ./local-cleanup-folder
Never download the database in plain text over an unencrypted connection.
Mistake #3: Relying Only on Security Plugins
A WordPress security plugin is not a malware removal tool. Many scanning plugins detect known signatures, but they often miss custom or obfuscated code. They also can't handle file-level infections in themes or core files.
Correct approach: Use a plugin for initial scanning, but verify manually. Check modified files with diff against fresh WordPress core downloads:
diff -rq /var/www/html/wp-includes/ /tmp/fresh-wp/wp-includes/
If you find extra code in core files, delete those files and replace with originals from a trusted source. Do not just 'quarantine' them.
Mistake #4: Deleting Everything and Reinstalling Without Analysis
Wiping the entire site and starting over with a fresh WordPress install sounds clean. But if you don't know how the malware got in, it'll be back. That's the number one reason I see recurring hacks.
Correct approach: After you restore to a clean state, investigate the entry point. Common vectors: outdated plugins, nulled themes, weak admin passwords, or compromised hosting accounts. Check your access logs for suspicious IPs or unusual POST requests:
grep "POST" /var/log/apache2/access.log | awk '{print $1}' | sort | uniq -c | sort -nr | head -20
Then fix the vulnerability – update everything, remove unused plugins, enforce strong passwords.
Mistake #5: Changing Admin Passwords Without Checking for Backdoors
You reset the admin password and think you're safe. But many WordPress backdoors are hidden in plugins, themes, or the database as 'phantom admins' – user accounts with admin privileges that aren't visible in the Users screen.
Correct approach: Dump the wp_users and wp_usermeta tables and look for suspicious entries:
SELECT * FROM wp_users WHERE user_login NOT IN ('admin','youruser');
SELECT * FROM wp_usermeta WHERE meta_key = 'wp_capabilities';
Delete any unknown admin users. Also check for files named like system.php, wp-ajax.php in unexpected locations – common backdoor names.
Mistake #6: Ignoring Database-Level Malware
You clean up files, change passwords, breathe a sigh of relief. Meanwhile, the malware is hiding in your database as base64-encoded payloads in wp_posts, wp_options, or custom tables.
Correct approach: Scan your database for suspicious content. You can use a plugin like Wordfence with database scanning enabled, or manually search for common malicious strings:
SELECT * FROM wp_posts WHERE post_content LIKE '%eval(%' OR post_content LIKE '%base64_decode(%';
SELECT * FROM wp_options WHERE option_value LIKE '%eval(%' OR option_value LIKE '%base64_decode(%';
Clean those rows or truncate if safe. Always export a SQL dump before modifying.
Mistake #7: Skipping User Account and Plugin Audit
Malware often creates additional admin users or installs malicious plugins silently. Beginners focus on core files and forget to check who has access.
Correct approach: List all users and their roles:
SELECT user_login, meta_value FROM wp_users JOIN wp_usermeta ON wp_users.ID = wp_usermeta.user_id WHERE meta_key = 'wp_capabilities';
Remove any user you didn't create. Then go through every installed plugin – deactivate and delete any that are not essential or look suspicious. Pay attention to plugins with no authors or strange version numbers.
Mistake #8: Not Cleaning the .htaccess File
A single infected .htaccess file can redirect all traffic to malicious sites. Beginners often forget to check it because it's hidden.
Correct approach: View the .htaccess in your WordPress root and any subdirectories. Look for RewriteRule lines that point to external domains or include encoded text. Replace with a clean WordPress default:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
Also check for similar files like nginx.conf if you use Nginx.
Mistake #9: Not Changing Keys and Salts After Cleanup
WordPress uses authentication keys and salts to secure cookies and sessions. If the malware stole your old keys, it can still forge valid cookies even after you change passwords.
Correct approach: Generate new keys from the official WordPress API and update your wp-config.php:
define('AUTH_KEY', '...');
define('SECURE_AUTH_KEY', '...');
define('LOGGED_IN_KEY', '...');
define('NONCE_KEY', '...');
define('AUTH_SALT', '...');
define('SECURE_AUTH_SALT', '...');
define('LOGGED_IN_SALT', '...');
define('NONCE_SALT', '...');
You can fetch a fresh set at https://api.wordpress.org/secret-key/1.1/salt/. Replace the lines in wp-config.php – this will invalidate all existing sessions, forcing everyone to log in again.
FAQ
Q: How do I know if my site is still infected after cleanup? A: Run a file integrity check (comparing against core hashes), scan the database, and watch traffic logs for unusual outbound connections. Use a service like Sucuri's SiteCheck for an external opinion.
Q: Should I pay for a professional cleanup service? A: If the malware is deeply embedded or you're not confident, yes. The cost of repeated cleanups or a blacklisted domain often exceeds the service fee.
Q: Can I prevent malware entirely? A: No, but you can reduce risk: keep everything updated, use a firewall plugin, disable file editing in wp-config.php, and enforce strong passwords.
What to do first when you suspect malware
Stop. Take a breath. Then: 1. Isolate the site – put it in maintenance mode or block public access with a firewall rule. 2. Take a full backup – files and database. 3. Scan with multiple tools (Wordfence, Sucuri, or CLI with clamav). 4. Analyze the infection vector from logs. 5. Clean files, database, and .htaccess systematically. 6. Change all passwords and keys. 7. Update everything and remove unused plugins/themes. 8. Monitor.
Don't skip steps. The time you save by rushing is time you'll lose later when the malware reappears.