How to Remove Malware From a WordPress Site: A Complete Step-by-Step Guide

If your WordPress site has been hacked or infected, don’t panic. The right process can help you remove malware completely, restore performance, and prevent reinfection. This guide walks through every phase — from backup to cleanup to hardening — so you can regain control of your site with minimal downtime.

Before you begin, remember that a hacked site isn’t just a technical issue; it’s a trust issue. Visitors, search engines, and customers all depend on your website being safe. The goal is not only to clean the infection but to ensure it never happens again.

You can also get expert-managed hosting with built-in security from ServerFellows.com — ideal for users who want protection and performance without constant manual monitoring.

Key Takeaways

• Always create complete offsite backups before making any changes.
• Run full scans of both the file system and database using trusted tools.
• Replace infected or modified files with clean originals from verified sources.
• Identify how the malware entered — and close all entry points.
• Harden your WordPress site after cleanup with updates, 2FA, and secure configurations.

Step 1: Back Up Your WordPress Site and Database

Your first move before any malware removal should always be to back up everything — files, media, themes, plugins, and the database. This backup is your safety net if anything breaks during cleanup.

Why Backups Are Non-Negotiable

When you start deleting or repairing files, it’s easy to make mistakes. A verified backup ensures that even if a file gets corrupted, you can restore your website instantly.

How to Create a Backup

Use tools like UpdraftPlus, Jetpack Backups, or your hosting panel’s built-in backup system (e.g., cPanel or Softaculous). Save copies to offsite storage such as Google Drive or Amazon S3 instead of keeping them on the same server.

Make sure to:

• Check backup file integrity by opening and verifying them.
• Record your WordPress version, active theme, and plugin list.
• Keep multiple restore points from different days or weeks.

If you prefer hands-free automated backups, consider hosting on ServerFellows.com, which offers one-click recovery and daily backups.

Step 2: Scan Your WordPress Site and Database

After securing backups, you’ll need to scan the entire website — not just for obvious malicious code, but also for hidden backdoors and suspicious behavior.

What to Scan For

• Altered WordPress core files
• Infected theme or plugin scripts
• Suspicious uploads (like fake image files containing PHP code)
• Malicious database injections (spam, redirects, or hidden links)

Recommended Scanning Tools

You can use plugins such as Wordfence Security, MalCare, or iThemes Security. These detect known malware signatures and unusual file changes.

If you can’t access your dashboard, try external scanners like Sucuri SiteCheck or your hosting provider’s malware detection tools (e.g., ImunifyAV, Patchman).

Action	Tool / Source
Full File Scan	Wordfence, MalCare
Database Scan	iThemes Security, host tools
External Check	Sucuri SiteCheck
File Integrity Comparison	Core file checksums
Review & Plan	Based on scan report

A proper scan reveals the scope of infection and helps you decide whether you can manually clean it or need a full rebuild.

Step 3: Remove or Repair Infected Files and Database Entries

Once you know what’s infected, it’s time to remove malware from your WordPress site manually or through cleanup tools.

Clean Files via FTP or File Manager

Use FTP (e.g., FileZilla) or cPanel’s File Manager to delete suspicious files. Replace modified WordPress core files, themes, and plugins with fresh, clean copies downloaded from official sources.

Common infected locations include:

• /wp-content/uploads/
• /wp-includes/
• /wp-admin/
• Theme and plugin folders

Set correct file permissions afterward (typically 644 for files and 755 for directories).

Clean the Database

Access phpMyAdmin and search for spammy scripts or malicious links in these tables:

• wp_posts
• wp_options
• wp_usermeta

Remove injected iframes, strange JavaScript snippets, or unauthorized users. Also, inspect cron jobs and autoload options for persistent malware.

After cleanup, run a final malware scan to ensure the site is fully clean and operational.

If manual work feels risky, ServerFellows offers managed WordPress hosting with active malware monitoring and instant rollback options.

Step 4: Identify and Close the Vulnerability

Cleaning malware is only half the job. You must find how the hacker got in — otherwise, the site could be reinfected within days.

Typical Entry Points

• Outdated plugins or themes
• Weak admin passwords
• Unsecured file permissions
• Infected uploads or pirated themes
• Vulnerable PHP scripts

How to Detect Backdoors

Search for suspicious code patterns such as:

• base64_decode, eval, assert, exec, or system
• Hidden .php files in uploads
• Unauthorized cron jobs
• Extra .htaccess files or strange redirects

Compare each file against a clean WordPress installation to confirm tampering. Remove all rogue files, including modified .htaccess or random PHP scripts.

Once done, perform another complete scan. Reinfections often occur due to overlooked backdoors.

Step 5: Secure and Harden Your WordPress Installation

Now that your site is clean, focus on long-term protection.

Strengthen Login Security

• Delete unused or suspicious admin accounts.
• Reset all passwords — including WordPress, hosting, FTP, and database.
• Enable Two-Factor Authentication (2FA) for admin users.
• Rotate WordPress salts in wp-config.php for better encryption.

Update Everything

Outdated components are the #1 cause of malware infections. Update:

• WordPress core
• All plugins and themes
• PHP version via your hosting control panel

Lock Down Permissions

Disable file editing inside WordPress:

define('DISALLOW_FILE_EDIT', true);

Ensure correct ownership and permission levels on your server files.

Use a Firewall and Security Plugin

A Web Application Firewall (WAF) filters bad traffic and blocks brute-force attacks. Combine it with a security plugin for continuous monitoring and automatic scans.

Managed hosts like ServerFellows.com integrate these protections out-of-the-box, ensuring your website stays fast and secure.

Step 6: Prevent Future Malware Attacks

Security is not a one-time fix — it’s an ongoing habit.

Implement a Regular Maintenance Schedule

• Schedule weekly malware scans
• Back up your site daily or before major updates
• Review user activity logs for suspicious actions
• Monitor server resources and bandwidth usage

Use SSL and Secure Connections

Ensure all connections (including login and admin pages) use HTTPS. This encrypts data between your site and users.

Limit Plugin Count

Every plugin is an entry point. Only install what’s essential and from trusted developers. Delete unused ones completely — not just deactivate them.

Frequently Asked Questions

How Can I Prevent My Site From Being Blacklisted After Malware?

Immediately take the site offline and display a maintenance message. Clean all infected files and request a review from Google Search Console once it’s fixed. Update everything, rotate passwords, and resubmit your sitemap for faster reindexing.

Does Malware Affect SEO Rankings?

Yes. Infected websites can drop sharply in search rankings due to spammy redirects and blacklisting. To recover:

1. Clean all infections.
2. Remove spam URLs from Google Search Console.
3. Resubmit your sitemap.
4. Monitor ranking changes weekly.

How Long Does Google Reconsideration Take?

After you submit a review request, Google typically takes a few days to two weeks to verify that your site is safe again. The cleaner your logs and documentation, the faster the approval.

Should I Notify Users About the Breach?

If sensitive data was compromised, yes. Follow privacy laws (GDPR, CCPA, etc.), and provide a transparent notice explaining what happened, what’s being done, and how users can protect themselves.

Can I Claim Insurance or Financial Restitution?

If you have a cyber liability insurance policy, review your coverage for data restoration or downtime compensation. Keep detailed evidence — scan logs, cleanup receipts, and communication trails — to support your claim.

Conclusion

Learning how to remove malware from a WordPress site is about more than cleaning files — it’s about understanding, prevention, and resilience. A well-planned cleanup process backed by strong security habits ensures your website remains stable, trustworthy, and fast.

By maintaining verified backups, scanning regularly, and closing vulnerabilities promptly, you safeguard your site’s long-term health.

If you prefer a hassle-free, secure hosting environment where malware protection is proactive and performance-optimized, explore ServerFellows.com. It’s a smart step toward keeping your WordPress site secure and worry-free