How to Manually Remove Malware from Your Website

To remove malware from a website you need to identify the infected files, clean or replace them with known-good versions, and close the vulnerability that let the attacker in. Skip any one of those three steps and reinfection is almost guaranteed.

This guide walks through the complete process — from first diagnosis to final verification — with steps that apply to WordPress and generic PHP sites hosted on cPanel.

1. Confirm the Infection Before Touching Anything

Before modifying any file, gather evidence. Acting blind risks deleting legitimate files or missing malware that's still hiding.

Common signs of infection:

• Google Search Console shows warnings about "deceptive site" or "harmful software."
• The browser redirects visitors to spam or ad pages.
• Your hosting provider suspended the account for mass email sending.
• Unknown PHP files appear in image upload folders.
• The page source contains hidden iframes or unfamiliar external scripts.

Free external diagnostic tools:

• Google Safe Browsing: https://transparencyreport.google.com/safe-browsing/search?url=yourdomain.com
• Sucuri SiteCheck: free online malware scanner.
• VirusTotal: for analyzing individual URLs and files.

2. Enable Maintenance Mode and Back Up

Before making any changes, put the site into maintenance mode so visitors don't see infected content. Then create a full backup of the infected version — you'll need it for comparison and to avoid losing database data.

From cPanel:

1. Go to Files > File Manager.
2. Compress the entire public_html folder.
3. Download the ZIP to your local machine.
4. Also export the database from phpMyAdmin > Export.

If your plan includes automatic backups, download the most recent copy before the infection too — but don't restore it yet; it may also be compromised if the malware has been active for days.

3. Scan Files for Malicious Code

This is the most technical step. The goal is to find every file the attacker modified or added.

Option A: cPanel scanner (ImunifyAV / Maldet)

Many hosts include ImunifyAV. Find it in cPanel under Imunify360 or ImunifyAV, run a full scan, and review the report. Only mark files as clean after you've personally verified them.

Option B: manual grep for common malware patterns

Connect via SSH and use grep to find obfuscated code typical of PHP malware:

# Dynamic execution functions common in backdoors
grep -rl "eval(base64_decode" public_html/
grep -rl "eval(gzinflate" public_html/
grep -rl "eval(str_rot13" public_html/

# Remote file loading
grep -rl "file_get_contents(\"http" public_html/
grep -rl "curl_exec" public_html/

# Common web shells
grep -rl "FilesMan" public_html/
grep -rl "c99shell\|r57shell\|webshell" public_html/

Save the list of suspicious files before changing anything.

Option C: check modification timestamps

Infected files often have modification dates that fall outside the normal pattern for your site.

# PHP files modified in the last 7 days
find public_html/ -name "*.php" -newer public_html/index.php -mtime -7

Open each result in a text editor and decide whether the code is legitimate or malicious.

4. Clean or Replace Infected Files

There are two strategies depending on the file type:

For WordPress, replacing the core is straightforward:

1. Download the exact WordPress version you're running from wordpress.org/download/releases/.
2. Upload and unzip on the server.
3. Copy wp-includes and wp-admin over the existing folders. Do not overwrite wp-config.php or wp-content.

5. Clean the Database

Malware often injects code into the database: posts, site options, widgets, and even user accounts. Open phpMyAdmin and search key tables for patterns like these:

SELECT * FROM wp_options WHERE option_value LIKE '%eval(base64%';
SELECT * FROM wp_posts WHERE post_content LIKE '%

If you find posts with embedded scripts, edit them and delete the malicious block. If you find administrator accounts you don't recognize, delete them immediately.

Also check the wp_options table for the siteurl and home fields — malware sometimes alters these values to redirect traffic away from your site.

6. Close the Original Vulnerability

Cleaning without closing the entry point is wasted effort. The most common attack vectors are:

• An outdated plugin or theme with a known vulnerability. Update everything immediately, or uninstall what you don't use.
• A weak or reused password. Change all passwords: WordPress admin, cPanel, database, and FTP.
• Incorrect file permissions. PHP files should be 644, directories 755. Never 777.
• A nulled (pirated) theme or plugin. Remove them — they contain intentional backdoors.
• An outdated PHP version. PHP 7.4 and below no longer receive security patches. Migrate to PHP 8.2+.

# Fix permissions in bulk
find public_html/ -type d -exec chmod 755 {} \;
find public_html/ -type f -name "*.php" -exec chmod 644 {} \;

7. Verify and Request a Google Review

Once the cleanup is done, scan again with Sucuri SiteCheck to confirm nothing remains. Then:

1. In Google Search Console, go to Security & Manual Actions > Security Issues.
2. Review the details of the flagged files.
3. Click Request Review and describe the steps you took.
4. Google typically responds within 1–3 business days; the warning stays active in the meantime.

If your hosting account was suspended, contact support with your cleanup report so they can reactivate the service.

For ongoing protection, consider a professional web security service that monitors and cleans infections on a continuous basis — especially important if you handle customer data or process payments.

Key Takeaways

• Confirm the infection with external tools before making any changes.
• Always back up the infected version as a reference point.
• Use grep and modification timestamps to scan, not just plugins.
• Replace WordPress core files with the official version rather than trying to edit them.
• Check the database too: injected scripts in posts and unauthorized admin accounts are common.
• Close the original vulnerability — without this step, reinfection happens within hours.
• Submit a review request in Google Search Console to lift the security warning.

If the process feels too technical or your site is severely compromised, the team at elenlace.com offers hacked-site recovery and cleanup with a reinfection guarantee. Get in touch and we'll sort it out today. You can also find more guides in our web security section.

FAQ

Can I just restore a backup and call it done?

Only if the backup predates the infection and you also close the vulnerability that allowed access. If you skip that second part, the attacker will reinfect the site using the same method within hours or days.

How long does Google take to remove the "dangerous site" warning?

After submitting a review request in Search Console, Google typically responds within 1–3 business days for smaller sites. The Chrome warning disappears once Google confirms the site is clean.

Are security plugins like Wordfence enough to clean the malware?

Plugins help detect and sometimes clean infections, but they're not foolproof — they don't scan the database as thoroughly, and some backdoors are designed to evade plugin-based scans. Use them as an additional layer, not your only defense.

Why are there PHP files inside my image upload folders?

That's a classic sign of a web shell uploaded by the attacker. Upload directories usually have write permissions, and if the server doesn't block PHP execution in those folders, attackers exploit that. Delete those files and add an .htaccess file in the uploads folder to prevent PHP execution.

Useful resources

Other providers and guides worth comparing:

• Hostinger
• HubSpot
• IONOS