WordPress Malware Removal: How to Scan, Clean & Protect Your Site (2026)

Whether you're dealing with an active infection right now or trying to protect a healthy site before something goes wrong, this is the guide you need.

DefinitionWhat Is WordPress Malware?

WordPress malware is any malicious code or file that has been installed on your WordPress site without your knowledge or consent. It can take many forms — from a single line of JavaScript injected into a theme file to hundreds of hidden PHP backdoor scripts spread across your server.

Malware on a WordPress site is typically designed to:

• Steal data — harvesting customer information, payment details, or login credentials
• Redirect visitors — sending your traffic to spam, gambling, adult, or phishing sites
• Send spam — using your server's email system to send thousands of spam messages
• Mine cryptocurrency — using your visitors' computing power to mine Bitcoin or similar
• Inject SEO spam — creating thousands of hidden pages to boost other sites' rankings at the expense of yours
• Serve as a botnet node — using your server to attack other websites
• Install ransomware — encrypting your files and demanding payment for the key

The most important thing to understand: WordPress malware is almost never obvious. That's by design. A hacker who makes their malware invisible can exploit your site for months before you notice — or before Google does and penalizes you for it.

Infection VectorsHow Does Malware Get Into WordPress Sites?

Understanding how malware gets in is the first step to keeping it out. The most common infection vectors are:

Vulnerable Plugins and Themes

This accounts for the vast majority of WordPress malware infections. Plugins and themes are written by thousands of different developers with varying levels of security expertise. When a vulnerability is discovered in a popular plugin, attackers scan the entire internet for sites running that version and exploit them automatically within hours of the vulnerability becoming public.

Nulled (Pirated) Plugins and Themes

Free downloads of premium plugins and themes from unofficial sources almost always contain hidden malware. The "free" premium theme you downloaded from a piracy site comes pre-loaded with a backdoor that gives the distributor permanent access to your server.

Brute Force Attacks on wp-login.php

Automated bots run thousands of username/password combinations against your login page every day. Weak passwords like "password123" or "admin" are cracked within seconds. Once inside, the attacker uploads malware directly.

Compromised Hosting Environment

On shared hosting, poor server isolation can allow malware from one compromised site to spread to others on the same server — even if your own site is perfectly maintained.

Stolen FTP or Hosting Credentials

Malware on your local computer, phishing attacks, or data breaches at other services can expose your FTP credentials, giving attackers direct file-system access to upload malware.

Malicious File Uploads

Plugins that allow file uploads (contact forms, image uploaders, etc.) can be exploited if they don't properly validate file types — allowing attackers to upload PHP files disguised as images.

DetectSigns Your WordPress Site Has Malware

WordPress malware is designed to be invisible, but there are telltale signs:

Visible to visitors:

• Redirects to spam, gambling, adult, or phishing sites
• Pop-ups appearing on your site that you didn't add
• Strange content in a foreign language appearing in your pages
• Browser warnings saying "This site may harm your computer"
• Your site defaced with political or hacker messages

Visible in search:

• Google Search Console flagging "Security Issues"
• Search results showing your pages with spam titles or descriptions
• Hundreds of URLs in your Search Console that you never created
• "This site may be hacked" warning under your domain in Google results

Visible to you (backend):

• New WordPress admin users you didn't create
• Plugins or themes you didn't install appearing in your dashboard
• Your site sending emails you never authorized
• Unusual spikes in server resource usage
• Modified dates on core WordPress files that you haven't touched
• PHP files appearing inside your uploads folder
• Random numeric .htm files appearing across your server

Visible to your hosting provider:

• Account suspended for sending spam
• Account suspended for unusual resource usage
• Security alerts from your host's malware scanner

If you're seeing any of these signs, your site has almost certainly been infected and needs immediate attention.

ScanHow to Scan a WordPress Site for Malware

There are several approaches to scanning your WordPress site for malware, ranging from quick online checks to deep server-level scans.

Method 1: Online WordPress Malware Scanners

Online scanners check your site's publicly visible pages for malware signatures. They're fast and require no installation, but they can only see what an external visitor sees — they cannot scan your actual server files or database.

Good for: a quick first check, or confirming whether visible malware is present.
Not good for: finding hidden backdoors, database injections, or files that don't render publicly.

Useful free online scanners:

• Sucuri SiteCheck (sitecheck.sucuri.net)
• VirusTotal (for individual files)
• Google Safe Browsing Check

Method 2: WordPress Malware Scanner Plugins

Plugin-based scanners run directly on your server and can scan actual file contents, check file integrity against known-good versions, and detect database injections. These are significantly more thorough than external scanners.

Top WordPress malware scanner plugins:

Wordfence Security — The most widely used WordPress security plugin. Its scanner checks all files against the official WordPress.org repository versions, flags modifications, and detects known malware signatures. The free version includes a scanner; the premium version adds real-time threat intelligence.

MalCare — Uses deep scanning algorithms that run on MalCare's own servers, so it doesn't slow down your site during a scan. Particularly good at detecting complex, obfuscated malware that simpler scanners miss.

Sucuri Security — Combines a server-side scanner with an external blacklist check. The free plugin provides basic scanning; the premium service adds a web application firewall and malware removal guarantee.

All In One WP Security & Firewall — A comprehensive free plugin that includes file integrity monitoring alongside its other security features.

iThemes Security (now Solid Security) — Includes file change detection and malware scanning as part of its broader security suite.

Method 3: Manual File Scanning via FTP or File Manager

For a thorough scan, you can check your files directly through your hosting control panel's File Manager or via FTP. This lets you look for:

• Files with suspicious names (shell.php, godsend.php, c99.php, r57.php)
• PHP files inside your uploads folder (there should be none)
• Files recently modified that you didn't change
• Files with random numeric names (e.g., 39632216583.htm)
• Large collections of .htm files that shouldn't exist

Sort all files by "Last Modified" date and look for anything changed around the time you first noticed problems.

Method 4: Check Your WordPress Database for Malware

Malware is often injected into the WordPress database rather than the file system — making it invisible to file-level scanners. Database malware typically appears as:

• JavaScript injected into post content, widget text, or theme customizer settings
• iframe tags redirecting visitors to malicious sites
• Base64-encoded strings that decode to malicious code (look for eval(base64_decode(...))
• Spam posts or pages created automatically by the hacker
• Malicious links added to menus or footers
• Unauthorized admin user accounts

To check your database, log in to phpMyAdmin via your hosting panel and search your wp_posts, wp_options, and wp_usermeta tables for suspicious content. Alternatively, use a plugin like WP-Optimize to search for common malware strings.

RemoveHow to Remove Malware From a WordPress Site

Once you've confirmed malware is present, here are your removal options in order of reliability.

Option 1: Restore From a Clean Backup (Best Option)

If you have a clean backup from before the infection, restoring it is the most reliable way to remove malware. A restore wipes all injected files and database changes simultaneously, whereas manual cleanup risks missing something.

Steps:

1. Log in to your hosting control panel
2. Navigate to Backups
3. Identify the most recent backup from before the infection
4. Restore both the files backup (public_html) and the database backup
5. Immediately change all passwords after restoring

The only downside of a restore is losing any content you added after the backup date. Weigh this against the time and risk of manual cleanup.

Option 2: Use a WordPress Malware Removal Plugin

Several plugins offer automated malware removal in addition to scanning. This is faster than manual cleanup and more thorough than it sounds, though complex infections may require multiple passes.

MalCare — Offers one-click malware removal even in its paid plan. Particularly effective for complex infections.

Wordfence — Can repair files that have been modified by replacing them with clean versions from WordPress.org. Works well for core file infections.

Sucuri (premium) — Includes a malware removal service where their team manually cleans your site — backed by a guarantee.

WP Antivirus / Anti-Malware Security and Brute-Force Firewall — Free options that provide basic automated removal.

Option 3: Manual WordPress Malware Removal

If you don't have a clean backup and prefer not to use a paid removal service, here's how to manually remove malware from your WordPress site.

Step 1: Put your site in maintenance mode

Install a maintenance mode plugin or add a temporary redirect so visitors don't encounter malware while you clean.

Step 2: Download a fresh copy of WordPress

Go to wordpress.org and download the latest version. You'll use these clean files to replace potentially infected core files.

Step 3: Replace WordPress core files

Upload and overwrite all files in your WordPress root directory and the wp-admin/ and wp-includes/ folders. Do NOT touch wp-content/ or wp-config.php at this stage.

Step 4: Clean wp-content/themes/

Open each theme folder and look for:

• PHP files with obfuscated code (long strings of random characters)
• Injected code at the very top or bottom of functions.php, header.php, or footer.php
• Files you don't recognize

Compare your theme files against the original theme from the developer's official source.

Step 5: Audit wp-content/plugins/

Deactivate and delete all plugins. Then reinstall them fresh from wordpress.org. Never restore plugins from your potentially infected server — always download clean copies.

Step 6: Check wp-content/uploads/

There should be no PHP files in your uploads folder. Delete any .php, .js, or .htm files that appear there. Image and document files are generally fine, but verify anything suspicious.

Step 7: Clean your database

Using phpMyAdmin, search your database for malicious strings. Common things to search for:

• eval(
• base64_decode(
• <iframe
• <script followed by external URLs you don't recognize
• hacked by
• Known spam domains

Remove any injected code carefully, making sure not to delete legitimate content.

Step 8: Clean wp-config.php

Open wp-config.php and verify that no extra code has been added to the top or bottom of the file. It should start with <?php and contain only standard WordPress configuration settings.

Step 9: Clean .htaccess

Delete your current .htaccess file and regenerate a clean one by going to WordPress Admin → Settings → Permalinks and clicking Save Changes.

Step 10: Search for and remove backdoors

Backdoors are hidden files that let hackers regain access after you clean the obvious infection. Search your entire server for files containing these common backdoor functions:

• eval(
• base64_decode(
• gzinflate(
• str_rot13(
• preg_replace with /e modifier
• assert(
• system(
• passthru(
• exec(
• shell_exec(

Any legitimate plugin or theme code that contains these functions in isolation is suspicious. Cross-reference with the official source.

Get HelpWordPress Malware Removal Service: When to Call in Professionals

Manual malware removal is time-consuming, technically demanding, and carries the risk of missing something — especially backdoors. Professionals who handle WordPress malware removal daily know exactly where to look and what to do.

Consider a professional WordPress malware removal service when:

• Your site has been infected multiple times (likely missed backdoors)
• You don't have technical knowledge of PHP and server file systems
• Your site handles customer data or payment information
• You can't find the source of the infection after cleaning
• Your Google blacklist is affecting your business revenue
• Your hosting provider has suspended your account
• You need the site cleaned urgently with minimal downtime

A professional WordPress malware cleanup service will typically:

1. Perform a full server-level scan of all files and database tables
2. Identify every infected file, injected database entry, and backdoor
3. Clean or replace infected files with verified clean versions
4. Harden your security configuration to prevent reinfection
5. Submit a Google blacklist review request on your behalf
6. Provide documentation of what was found and removed
7. Offer a guarantee against reinfection within a set period

At Website Maintenance Services, our WordPress malware removal service includes all of the above — plus ongoing monitoring so you're protected going forward, not just cleaned up and left to be infected again.

ToolsBest WordPress Malware Removal Plugins in 2026

Here's a comparison of the best WordPress malware scanner and removal plugins currently available:

Our recommendation: For most WordPress sites, start with Wordfence free for scanning, then consider MalCare or Sucuri premium if you need automated removal or ongoing professional monitoring.

PreventHow to Protect Your WordPress Site From Malware

Removing malware solves the immediate problem. These steps prevent the next infection.

Keep Everything Updated

Plugin vulnerabilities are the number one cause of WordPress malware infections. Enable automatic updates for minor WordPress versions, and manually update plugins and themes at least weekly. Delete any plugins or themes you're not actively using — inactive code is still executable code.

Use Strong, Unique Passwords

Every WordPress admin account, FTP account, hosting account, and database user should have a long, randomly generated password. Use a password manager. Never reuse passwords across services.

Enable Two-Factor Authentication

Add 2FA to your WordPress admin login. Even if your password is stolen, the attacker can't log in without your second factor. Plugins like WP 2FA or Google Authenticator make this straightforward to set up.

Install a WordPress Firewall

A web application firewall (WAF) blocks malicious requests before they reach your WordPress installation. Options include:

• Wordfence (plugin-level WAF)
• Cloudflare (DNS-level WAF, blocks attacks before they hit your server)
• Sucuri (CDN + WAF)

Limit Login Attempts

By default, WordPress allows unlimited login attempts. This makes brute-force attacks viable. Plugins like Limit Login Attempts Reloaded or Login LockDown add a lockout after a set number of failed attempts.

Change the Default Admin Username

Never use "admin" as your WordPress username. It's the first thing brute-force scripts try. Create a new administrator account with a unique username and delete the default admin account.

Protect wp-login.php and wp-admin

Options include:

• Moving the login URL with a plugin like WPS Hide Login
• Password-protecting the wp-admin directory at the server level
• Restricting access to specific IP addresses via .htaccess

Disable XML-RPC

XML-RPC is a WordPress API that allows remote publishing. Most sites don't need it, and it's a common target for brute-force and DDoS attacks. Disable it via your .htaccess or a security plugin.

Use Secure, Managed Hosting

Your hosting environment matters. Quality managed WordPress hosting providers implement server-level firewalls, malware scanning, automatic backups, and proper account isolation — making it much harder for infections to take hold or spread.

Set Up Daily Backups

Backups don't prevent malware, but they dramatically reduce the damage when it happens. With a clean backup from yesterday, a full recovery takes hours rather than days. Store backups off-site — not just on your hosting server.

Monitor Your Site for Changes

File integrity monitoring alerts you when WordPress files are modified. This catches malware infections early — sometimes within minutes of the initial compromise — before significant damage is done.

TimelineHow Long Does WordPress Malware Removal Take?

Professional WordPress malware removal services can significantly compress these timelines, particularly for complex infections, because they know exactly where to look and have tools that automate much of the detection work.

FAQWordPress Malware FAQs

ChecklistWordPress Malware Removal Checklist

Use this checklist after a malware infection to make sure you've covered everything:

The Real SolutionWhy Ongoing Maintenance Is the Real Solution to WordPress Malware

One-time malware cleanup is like treating the symptoms without addressing the disease. If you don't fix the underlying vulnerabilities and put ongoing monitoring in place, the next infection is a matter of when, not if.

A professional WordPress maintenance plan is the only sustainable solution. It ensures:

• Everything is always updated — vulnerabilities are patched before they can be exploited
• Your site is monitored 24/7 — infections are caught within minutes, not weeks
• Clean backups exist — recovery takes hours, not days
• Your firewall is active — most attacks never reach your WordPress installation
• You have expert support — if something does happen, someone knowledgeable handles it immediately

At Website Maintenance Services, our maintenance plans include everything described above. We handle the updates, monitoring, backups, security hardening, and emergency response — so you can run your business without worrying about what's happening to your website while you sleep.