Discovering your WordPress site has been compromised is stressful, especially if you have never dealt with malware before. Many beginners make the situation worse by rushing through cleanup or skipping critical steps. This guide walks you through the entire malware removal process from first principles, explains every term you will encounter, and shows you how to avoid the most common mistakes that leave sites vulnerable to reinfection.
Understanding What Malware Means in WordPress Context
Malware is short for "malicious software"—code intentionally designed to harm your site, steal data, or use your server resources without permission. In WordPress, malware typically appears as:
- Backdoors: Hidden entry points that let attackers regain access even after you change passwords
- Pharma hacks: Injected spam pages selling pharmaceuticals or counterfeit goods
- SEO spam: Links to other sites inserted into your content to manipulate search rankings
- Redirects: Code that sends your visitors to scam sites or malicious downloads
- Defacements: Visible changes to your homepage or posts
- Credit card skimmers: Scripts that steal payment information from checkout pages
Malware enters WordPress sites through outdated plugins, weak passwords, nulled themes (pirated premium themes), vulnerable server configurations, or compromised administrator accounts.
Common Mistake 1: Deleting Files Without Investigation
The first instinct many beginners have is to simply delete suspicious files. This creates three problems:
- You might delete legitimate WordPress core files that happen to look unfamiliar
- You lose forensic evidence that could reveal how the attacker got in
- You might miss related malware files elsewhere
How to Avoid This Mistake
Before deleting anything, take a complete backup of your site in its current infected state. Yes, you are backing up the malware too—this gives you a snapshot to analyze and lets you restore if you accidentally break something during cleanup.
Most hosting control panels like cPanel include backup tools. In cPanel, navigate to Files → Backup or Backup Wizard. Download a full account backup or at minimum:
- Your
public_htmldirectory (or wherever WordPress is installed) - Your WordPress database
Store this backup separately from your hosting account—on your local computer or a cloud storage service you control.
Common Mistake 2: Not Taking Your Site Offline During Cleanup
Leaving your site online while cleaning it means:
- Visitors might be exposed to malware, getting their devices infected
- Search engines might index spam content, damaging your SEO permanently
- The attacker might still have active access and re-infect files as you clean them
How to Avoid This Mistake
Put your site into maintenance mode before you begin. The simplest method is creating a .maintenance file in your WordPress root directory:
<?php
$upgrading = time();
?>
Upload this file via FTP or your hosting file manager. WordPress will display a "Briefly unavailable for scheduled maintenance" message to visitors while allowing you to access the admin area.
For more control, use your .htaccess file to show a custom maintenance page while restricting access by IP address. Add this at the top of .htaccess:
# Maintenance mode - replace 203.0.113.45 with your actual IP
RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^203\.0\.113\.45$
RewriteCond %{REQUEST_URI} !^/maintenance\.html$
RewriteRule ^(.*)$ /maintenance.html [R=307,L]
Create a simple maintenance.html file in your site root explaining the site is temporarily offline for maintenance.
Common Mistake 3: Skipping the "How Did They Get In" Question
Removing malware without finding the entry point guarantees reinfection. The attacker will use the same vulnerability again within hours or days.
How to Avoid This Mistake
Check your access logs and error logs. In cPanel, find these under Metrics → Raw Access and Metrics → Errors. Look for:
- Unusual POST requests to plugin files
- Multiple failed login attempts followed by a successful one
- Requests to files that should not be directly accessible
- Traffic from suspicious IP addresses during odd hours
Review your WordPress installation for known vulnerabilities:
- Check your WordPress version: log into Dashboard → Updates. Compare against the current version number on wordpress.org.
- List all plugins: go to Plugins → Installed Plugins and note the version of each. Search online for "[plugin name] vulnerability" to check for known security issues.
- Check your theme: Appearance → Themes shows your active theme. Nulled or outdated themes are common infection vectors.
Common entry points include:
- Outdated plugins with known exploits
- File upload forms that do not validate file types properly
- Weak administrator passwords (under 12 characters, dictionary words, no special characters)
- FTP or SSH accounts with weak credentials
- Incorrect file permissions that allow the web server to write to files it should only read
Common Mistake 4: Trusting One Scan Tool Completely
No single malware scanner catches everything. Different tools have different signature databases and detection methods.
How to Avoid This Mistake
Use multiple scanning approaches:
Server-Side Scanning:
Many hosting providers offer server-level malware scanners. In cPanel, check for Security → Imunify360 or Security → Malware Scanner depending on what your host has installed. These tools scan files on the server before they are served to visitors.
Plugin-Based Scanning:
Install a reputable security plugin from the WordPress repository:
- Wordfence Security (includes firewall and scanner)
- Sucuri Security (free scanner, paid cleanup service)
- iThemes Security (formerly Better WP Security)
Run a full scan with at least one of these. They check file integrity by comparing your WordPress core, themes, and popular plugins against known clean versions.
Manual File Comparison:
Download a fresh copy of WordPress from wordpress.org matching your version number. Extract it on your computer, then use an FTP client with a comparison feature (FileZilla, WinSCP) or the diff command if you have SSH access:
diff -r /path/to/clean/wordpress /path/to/your/wordpress
This shows files that differ from the original. Investigate any differences in core files—they should match exactly unless you made intentional customizations.
Common Mistake 5: Only Cleaning the File System
Malware often hides in your WordPress database, not just in PHP files. Attackers inject malicious JavaScript into posts, create rogue administrator accounts, or modify plugin settings to load external scripts.
How to Avoid This Mistake
Access your database using phpMyAdmin (found under Databases → phpMyAdmin in cPanel) or a command-line tool if you have SSH access.
Check for Rogue Users:
Open the wp_users table. Look for usernames you do not recognize, especially those with administrator privileges. Cross-reference with the wp_usermeta table where the meta_key is wp_capabilities—administrator accounts will have a meta_value containing "administrator".
Scan Post Content:
Run a query to search for common malware patterns in posts and pages:
SELECT ID, post_title, post_content
FROM wp_posts
WHERE post_content LIKE '%<script%'
OR post_content LIKE '%iframe%'
OR post_content LIKE '%eval(%'
OR post_content LIKE '%base64_decode%';
Note: wp_posts assumes you are using the default table prefix. If your prefix is different (check wp-config.php for $table_prefix), adjust the query accordingly.
Check Options Table:
The wp_options table stores site-wide settings. Malware sometimes modifies the siteurl, home, or adds auto-loading scripts. Review this table for unfamiliar entries, especially those with autoload set to yes.
Clean Widgets and Menus:
Malicious code can hide in text widgets or navigation menus. From your WordPress dashboard, check Appearance → Widgets and Appearance → Menus for suspicious scripts or links.
Step-by-Step Malware Removal Process
Now that you understand the common mistakes, here is the correct sequence:
Step 1: Document and Backup
Create a malware backup (as described above) and document everything you find: suspicious files, unfamiliar users, strange database entries. Take screenshots.
Step 2: Isolate the Site
Enable maintenance mode and consider changing your database password in cPanel under Databases → MySQL Databases to prevent active connections from continuing.
Step 3: Scan and Identify
Run multiple scanners and manually compare core files. Make a list of confirmed malicious files and database entries.
Step 4: Remove Known Malware
Delete identified malicious files. For files that are both legitimate and infected (like a compromised theme file), replace them with clean versions.
For core files, the safest approach is replacing your entire wp-admin and wp-includes directories with fresh copies from wordpress.org. These directories should never be modified.
Step 5: Clean the Database
Delete rogue users, remove injected content from posts, and restore modified option values. Make a database backup before making changes:
mysqldump -u username -p database_name > clean_backup.sql
Step 6: Update Everything
Update WordPress core, all plugins, and your theme to their latest versions. Delete any plugins or themes you are not actively using—inactive code is still a security risk.
Step 7: Change All Passwords
Update passwords for:
- All WordPress user accounts (especially administrators)
- Your database user (in cPanel and in
wp-config.php) - Your hosting control panel (cPanel/Plesk)
- FTP/SFTP accounts
- Any API keys stored in plugin settings
Use strong, unique passwords—at least 16 characters with a mix of letters, numbers, and symbols.
Step 8: Harden Security
Implement basic security hardening:
File Permissions:
Set correct permissions via SSH:
find /path/to/wordpress -type d -exec chmod 755 {} \;
find /path/to/wordpress -type f -exec chmod 644 {} \;
chmod 600 wp-config.php
This prevents the web server from writing to files unnecessarily.
Disable File Editing:
Add this to wp-config.php to disable the theme and plugin editor in the dashboard:
define('DISALLOW_FILE_EDIT', true);
Limit Login Attempts:
Install a plugin that blocks brute-force attacks by limiting login attempts from the same IP address.
Enable Two-Factor Authentication:
Use a plugin or your hosting provider's 2FA feature for the WordPress admin panel.
Step 9: Monitor for Reinfection
Schedule regular scans (weekly) for the next month. Watch for:
- Unexpected file changes
- New user accounts
- Unusual traffic patterns in your access logs
- Warnings from Google Search Console about malware
Step 10: Submit for Review
If Google or your web browser flagged your site as malicious, request a review:
- Google Search Console: Security & Manual Actions → Security Issues → Request Review
- Browser warnings: each browser vendor has a different process, typically through their webmaster tools
What If You Cannot Clean It Yourself
If the infection is deep, widespread, or you are not comfortable working with code and databases, consider:
- Your hosting provider's malware removal service (many offer this as a paid addon)
- Professional WordPress security services like Sucuri or Wordfence Premium cleanup
- Restoring from a clean backup if you have one from before the infection
Professional cleanup typically costs between reasonable and expensive depending on severity, but it includes guarantees and often improved security hardening.
Preventing Future Infections
The best malware removal is prevention:
- Keep WordPress, plugins, and themes updated automatically when possible
- Only install plugins and themes from reputable sources (never use nulled versions)
- Use strong, unique passwords and two-factor authentication
- Choose a hosting provider that offers server-level security (firewall, malware scanning)
- Make regular clean backups and store them off-server
- Limit the number of plugins you use—each one is a potential vulnerability
- Remove user accounts you no longer need
- Review your security logs periodically
Conclusion
Removing malware from WordPress requires patience and attention to detail. The most common mistakes—deleting files randomly, skipping the investigation phase, trusting a single scanner, ignoring the database, and forgetting to harden security afterward—turn a recoverable situation into a recurring nightmare. By taking your site offline, documenting everything, using multiple detection methods, cleaning both files and database, closing the entry point, and implementing proper security measures, you can fully recover your site and prevent future infections. Start with a backup, work methodically through each step, and do not rush. A thorough cleanup done once beats repeatedly fighting the same infection.