How to Remove Malware from an Infected WordPress Site (Guide)

If your WordPress site has been hacked, the priority is to act fast: take an immediate backup, scan all files for malicious code, and restore a clean state before search engines penalize your domain or your hosting provider suspends your account.

This guide covers the entire process — from recognizing infection symptoms to cleaning compromised files and hardening your site to prevent it from happening again.

Signs That Your WordPress Site Has Malware

Before cleaning, confirm there is actually an infection. The most common indicators are:

• Google displays a "Deceptive site ahead" or "Site contains malware" warning.
• Your host suspended the account or blocked outgoing email.
• Pages or links appear that you didn't create (SEO spam, pharmaceuticals, gambling).
• Visitors are redirected to unknown domains.
• The WordPress admin panel won't load or shows a blank screen.
• You receive alerts from your security plugin or Google Search Console.

If you spot one or more of these symptoms, follow the steps below without delay.

Step 1 — Take a Full Backup Before Touching Anything

It might seem counterintuitive to back up an infected site, but it's necessary: if something goes wrong during cleanup, you need a known starting point to return to.

Download the entire root folder via FTP (or your hosting file manager) and export the database with phpMyAdmin or WP-CLI:

wp db export backup-before-cleanup.sql

Store the backup off the server — on your local machine or in cloud storage.

Step 2 — Scan with a Specialized Tool

An automated scanner speeds up malware detection. The most widely used options are:

Install Wordfence if you still have access to the WordPress dashboard, navigate to Wordfence → Scan, and launch a full scan. The results will list all modified or suspicious files.

Step 3 — Clean the Infected Files

With the list of compromised files in hand, begin manual cleanup in this order:

3a. Replace the WordPress Core

Download a clean copy of WordPress.org matching your currently installed version and upload all folders except wp-content and wp-config.php. This replaces any core files that may have been tampered with.

3b. Review and Clean Plugins and Themes

Uninstall any plugins you don't use. For those you do use, download a fresh copy from the WordPress.org repository (or from your premium provider) and replace the entire plugin/theme folder inside wp-content/plugins/ and wp-content/themes/.

Never use nulled themes or plugins — they are the most common source of backdoors and reinfections.

3c. Search for Manually Injected Malicious Code

Search all PHP files for strings commonly used by malware. Via SSH or the hosting file manager:

grep -r "eval(base64_decode" /public_html/ --include="*.php"
grep -r "document.write(unescape" /public_html/ --include="*.js"

Also check the .htaccess file: malicious redirects are frequently added there. Compare it against the clean version generated by WordPress.

3d. Clean the Database

In phpMyAdmin, search the wp_posts and wp_options tables for strings like <script>, eval(, or unknown URLs. With WP-CLI you can run bulk searches:

wp search-replace 'malicious-code.com' '' --all-tables --dry-run

Remove the --dry-run flag only when you are confident in the results.

Step 4 — Change All Credentials

After cleaning the files, assume all credentials are compromised. Change:

• Passwords for all WordPress users, starting with administrators.
• Secret keys in wp-config.php (generate new ones at api.wordpress.org/secret-key).
• The database password and update wp-config.php accordingly.
• FTP/SFTP credentials in your hosting account.
• Your hosting control panel password (cPanel, Plesk, etc.).

Step 5 — Request a Google Review and Remove Blacklist Entries

If Google flagged your site, you must request a review after cleanup:

1. Open Google Search Console and go to Security & Manual Actions → Security Issues.
2. Review which URLs Google detected as problematic.
3. Click Request a Review and briefly describe the steps you took to fix the issue.

Google typically responds within 1-3 business days. For antivirus blacklists (McAfee, Symantec, etc.), use the Sucuri SiteCheck tool to identify which vendors flagged you and follow their individual removal processes.

If you need professional help cleaning a compromised site or want a preventive audit, the team at web security specialists can guide you through every step.

How to Prevent Future Infections

Cleanup is pointless if you don't close the doors malware used to get in. Apply these measures immediately:

• Keep WordPress, themes, and plugins up to date at all times. Most hacks exploit known vulnerabilities in outdated versions.
• Use only themes and plugins from official sources. Nulled copies contain deliberate backdoors.
• Install a web application firewall (WAF). Wordfence (free) or Cloudflare WAF filter malicious traffic before it reaches PHP.
• Enable two-factor authentication (2FA) on all administrator accounts.
• Limit login attempts and consider changing the admin URL away from /wp-admin.
• Set up automated daily backups stored off the server.
• Review file permissions: folders at 755, files at 644, and wp-config.php at 600.

You can find more resources on web protection in our SSL security and site protection guide.

Key Takeaways

• When an infection strikes, act fast: backup first, clean second.
• Replace the WordPress core and all plugins/themes with clean versions from the official repository.
• Remove malicious code from PHP files, .htaccess, and the database.
• Change all credentials after cleanup is complete.
• Request a Google review if your site was flagged as dangerous.
• Implement a WAF, 2FA, and automatic backups to prevent reinfection.

Was your site hacked, or do you want to lock it down before it happens? Visit elenlace.com and request a security audit for your WordPress installation.

FAQ

Can I remove WordPress malware without access to the admin panel?

Yes. If malware locked you out of the dashboard, connect via FTP or SFTP, replace WordPress core files directly on the server, and correct wp-config.php. You can also reset the administrator password directly in the database through phpMyAdmin.

How long does it take Google to remove the dangerous site warning?

Once you submit a review request in Google Search Console, the process typically takes between 24 hours and 3 business days. Google must verify that the site no longer contains malware before removing the warning.

Is restoring a backup enough to remove malware?

Only if the backup predates the infection. If you restore a contaminated backup, the malware will still be there. Confirm the backup date and verify with a scanner that the backup version is clean before restoring it.

Are free security plugins enough to protect WordPress?

For most small and medium sites, plugins like Wordfence (free tier) provide reasonable protection: file scanning, IP blocking, and a basic firewall. For higher-traffic sites or those handling sensitive data, a premium solution or a managed security service offers broader coverage and faster incident response.

Further reading

Other providers and guides worth comparing:

• Hostinger
• HubSpot
• IONOS