How to Remove WordPress Malware and Prevent Reinfection

If your WordPress website is hacked, every minute matters. A hacked site can damage your SEO rankings, expose customer data, infect visitors, send spam, redirect users to malicious pages, and even get your hosting account suspended.

The good news is that a hacked WordPress site can usually be cleaned and secured if you follow the right process. The key is not only to remove malware from WordPress, but also to identify how the infection happened and close the door so it doesn’t come back.

In this guide, we’ll walk you through how to detect a hacked website, remove malicious code, clean your database and files, restore safe access, and prevent reinfection. Whether you are a business owner, blogger, or eCommerce store manager, this guide will help you understand the right recovery process.

If you need expert help, our team can assist with WordPress malware removal, security hardening, and reinfection prevention for hacked websites.

How to Know If Your WordPress Website Has Been Hacked

Sometimes the signs are obvious. Other times, malware can sit quietly inside your website for weeks without being noticed.

Here are the most common warning signs that suggest your WordPress website has been hacked:

Your site redirects visitors to spam or suspicious pages
Google shows a “This site may be hacked” warning
Your hosting provider disables your account
New admin users appear in WordPress without your knowledge
Unknown plugins or files show up in your installation
Your site suddenly becomes very slow
Spam pages or spam posts appear in search results
Security plugins report malware or file changes
Visitors report browser warnings
Your login page behaves strangely or access changes unexpectedly
Core files, theme files, or wp-config.php contain suspicious code

A hacked WordPress site may also include hidden backdoors. Even if the visible malware is removed, the infection can return if the backdoor remains active.

That is why WordPress malware removal must always go beyond simply deleting a few suspicious files.

Why WordPress Websites Get Hacked

To properly clean a hacked site, you should understand the most common entry points.

1. Vulnerable plugins or themes

Outdated or poorly coded plugins and themes are among the biggest reasons WordPress sites get hacked. If a plugin has a known vulnerability and is not updated, attackers can exploit it to upload malicious files or gain admin access.

2. Weak passwords

Weak passwords for WordPress admin, FTP, hosting, or database access make brute-force attacks easier.

3. Compromised hosting environment

Sometimes the issue is not only WordPress itself. Weak server security, improper file permissions, or cross-site contamination in shared hosting environments can expose your site.

4. Pirated or nulled themes/plugins

Nulled plugins and themes are a major security risk. They often contain hidden backdoors, spam scripts, or remote-access code.

5. Infected admin devices

If your computer is infected with malware or a password-stealing tool, your credentials can be captured and used to access the website.

6. Poor cleanup from a previous infection

A website may appear clean at first, but if a hidden backdoor, malicious cron job, or injected database record is missed, the infection can return.

That is why many site owners face the frustrating situation where they delete malicious files and they come back again after a few seconds or minutes.

Immediate Steps to Take If Your WordPress Website Is Hacked

If you suspect that your site has been hacked, do not panic. Follow a structured response.

1. Put the site in maintenance mode if needed

If the infection is visibly harming users, redirecting traffic, or affecting customer trust, consider placing the site in maintenance mode while you investigate.

2. Contact your hosting provider

Your host may already have logs, malware scans, quarantine tools, or recent backups available. In some cases, they may have detected the infection before you did.

3. Create a backup of the infected site

Even though the site is compromised, take a backup before cleaning. This helps preserve evidence and gives you a fallback if you need to inspect files or data later.

Back up:

Full website files
Database
Error logs
Access logs if available

4. Change all passwords immediately

Change passwords for:

WordPress admin accounts
Hosting control panel
FTP/SFTP
SSH
Database user
Email accounts connected to the site

Also enable two-factor authentication where possible.

5. Record visible symptoms

Document what you are seeing:

Suspicious files
Redirect behavior
Strange admin users
Security warnings
Infected URLs
Spam content

This helps you track what was affected and verify later that everything is actually fixed.

Step-by-Step WordPress Malware Removal Process

If your WordPress website is hacked, the cleanup process should be systematic. Do not randomly delete files unless you know what they are.

Step 1: Identify the scope of infection

First determine how widespread the infection is.

Check:

WordPress core files
Active and inactive themes
Plugins
Uploads folder
wp-config.php
.htaccess
Database tables
MU-plugins folder
Cron jobs
Recently modified files

Malware often hides in places such as:

/wp-content/uploads/
/wp-includes/
/wp-admin/
theme functions.php
custom plugin files
randomly named PHP files
obfuscated code blocks using base64_decode, eval, gzinflate, or long encoded strings

Not all uses of these functions are malicious, but they are common red flags and should be reviewed carefully.

Step 2: Scan the website

Use a trusted security scanner or manually inspect the site.

A scan can help detect:

Malicious files
Suspicious code injections
Modified core files
Backdoors
Database spam
Blacklist issues

A scan is helpful, but it should not be your only method. Automated tools often miss custom malware or hidden persistence techniques.

Step 3: Replace WordPress core files

A safe first cleanup step is to replace WordPress core files with fresh copies from the official WordPress package.

This helps remove infected core files while preserving your content.

Usually, you should:

Download a fresh copy of WordPress
Remove old core folders like /wp-admin/ and /wp-includes/
Replace them with clean versions
Carefully preserve wp-content and wp-config.php while inspecting them separately

This process removes many core-level infections, but it does not clean infected plugins, themes, uploads, or the database.

Step 4: Audit plugins and themes

Review every installed plugin and theme.

Ask:

Is it still needed?
Was it obtained from a trusted source?
Is it actively maintained?
Does it have known vulnerabilities?
Was it recently modified unexpectedly?

Delete any unused, suspicious, or nulled plugins/themes completely.

For plugins and themes you trust, replace them with clean copies from official or verified sources rather than simply editing infected files line by line.

Step 5: Inspect the uploads folder

The uploads folder should mostly contain media files such as images, PDFs, and videos.

If you find PHP files or unfamiliar scripts in wp-content/uploads, investigate immediately. Attackers often hide web shells or malware there because uploads folders are less likely to be reviewed closely.

Look for:

.php files in uploads
randomly named files
hidden folders
recently modified suspicious files

If not needed, remove them after preserving evidence.

Step 6: Check `wp-config.php` and `.htaccess`

These files are common malware targets.

Attackers may inject code into wp-config.php to:

load malicious files
create hidden admin access
run redirects
execute remote code

Check .htaccess for:

suspicious redirects
injected rewrite rules
hidden spam behavior

If needed, recreate .htaccess from a clean WordPress or WooCommerce configuration.

Step 7: Clean the database

A hacked WordPress site is not always only a file problem. Malware can also inject spam or malicious content into the database.

Check for:

spam posts
hidden admin users
suspicious options
injected JavaScript
malicious iframes
fake plugin or theme settings
scheduled malicious tasks
injected links in posts/pages/widgets

Pay special attention to:

wp_users
wp_usermeta
wp_options
wp_posts
wp_postmeta

If spam pages or malicious links keep reappearing, database persistence may be the reason.

Step 8: Remove unknown admin users

Review all WordPress users, especially administrator accounts.

Delete any user you do not recognize and reset passwords for all valid users. Also inspect user roles to confirm no editor, author, or shop manager account has been silently elevated.

Step 9: Check cron jobs, MU-plugins, and hidden persistence

This is where many incomplete cleanups fail.

Attackers may use:

WordPress cron events
server cron jobs
MU-plugins
hidden files
database options that auto-load malware
injected code in active theme functions
fake plugin folders

If these remain, the infection can restore itself after cleanup.

Step 10: Rescan and verify

After cleaning, scan the site again and manually verify:

no unexpected redirects
no suspicious users
no spam pages
no browser warnings
no infected files returning
no suspicious outbound activity

A clean scan is good, but manual testing is equally important.

When Restoring from Backup Is the Better Option

Sometimes restoring from a clean backup is faster than manually removing malware.

A backup restore is useful when:

you know the backup predates the infection
the infection scope is large
the site has widespread file corruption
you can verify the vulnerability and patch it immediately after restore

However, restoring a backup alone is not enough.

If you restore the site without fixing the original vulnerability, the site can get infected again almost immediately.

That’s why backup restoration should always be followed by:

full patching
password resets
plugin/theme auditing
security hardening
malware rescanning

How to Prevent WordPress Reinfection

Keeping your WordPress website updated is essential for preventing security vulnerabilities. Our professional WordPress Maintenance Services help keep your website secure, updated, monitored, and running smoothly, reducing the risk of malware infections and unexpected downtime.

1. Update everything

Keep updated:

WordPress core
plugins
themes
PHP version

Outdated software is one of the biggest causes of reinfection.

2. Remove unused plugins and themes

Even inactive plugins and themes can create risk if they remain on the server. Remove what you do not need.

3. Use strong passwords and 2FA

Use unique, complex passwords for all access points and enable two-factor authentication for admin users.

4. Limit login attempts and protect admin access

Brute-force attacks are common. Use tools or server rules to limit repeated failed logins and protect /wp-admin/ access where practical.

5. Install a reliable security solution

A good security setup can help with:

malware scanning
firewall protection
login protection
file change detection
suspicious activity monitoring

6. Use secure hosting

A good host can make a huge difference. Managed WordPress hosting or well-configured hosting environments usually provide better isolation, backups, and security features.

7. Disable file editing in WordPress

If appropriate, disable theme and plugin file editing from the WordPress dashboard. This reduces one path attackers may abuse after gaining admin access.

8. Set proper file permissions

Incorrect file permissions can make it easier for attackers to write malicious files. Review recommended permissions with your host or developer.

9. Monitor for suspicious activity

Ongoing monitoring helps detect problems early.

Track:

file changes
new admin users
failed login attempts
plugin/theme modifications
malware scan alerts
unusual traffic patterns

10. Keep regular off-site backups

Your backup strategy should include:

automated backups
separate storage location
database backups
full file backups
regular restore testing

A backup is only useful if it can actually be restored successfully.

Common Mistakes to Avoid During WordPress Malware Removal

When a WordPress website is hacked, many site owners unknowingly make the problem worse.

Deleting files without understanding what they do

Random deletion can break the site and miss the real infection source.

Only cleaning visible malware

If you remove only obvious malicious code but ignore backdoors, cron jobs, or database injections, the infection can come back.

Restoring a backup without patching the vulnerability

This is one of the most common reinfection causes.

Ignoring user accounts

A compromised or fake admin user can immediately reintroduce malware.

Leaving unused software installed

Old themes, plugins, and test installations are common attack surfaces.

Trusting one scan as final proof

A single clean scan does not always guarantee a clean website. Manual review is still important.

Do You Need Professional WordPress Malware Removal?

A small infection on a simple brochure website may be manageable if you have technical experience.

But you should strongly consider professional help if:

the malware keeps coming back
the site is an eCommerce store
customer data may be involved
Google has blacklisted the site
your host suspended the account
you found suspicious admin users
you are not sure which files are safe
the database appears infected
multiple websites in the same hosting account are affected

Professional cleanup usually includes:

malware investigation
infected file cleanup
database cleanup
hidden backdoor detection
security hardening
vulnerability patching
blacklist guidance
reinfection prevention

For business websites, especially WooCommerce stores, professional cleanup can reduce downtime and lower the risk of missed persistence mechanisms.

WordPress Website Hacked? Recovery Checklist

Use this quick checklist if your WordPress website is hacked:

Back up infected files and database
Change all passwords
Contact hosting provider
Scan files and database
Replace WordPress core files
Reinstall trusted plugins/themes from clean sources
Remove suspicious files in uploads
Clean wp-config.php and .htaccess
Check database tables for spam and injected code
Remove unknown admin users
Review cron jobs and MU-plugins
Patch vulnerabilities
Harden security settings
Rescan and test thoroughly
Monitor the website after cleanup

Final Thoughts

If your WordPress website has been hacked, fast action and a proper cleanup process are essential. Deleting a few malicious files is rarely enough. Real WordPress malware removal requires checking the full site, cleaning both files and database records, removing hidden persistence methods, and strengthening security to stop reinfection.

The best approach is always: clean, patch, harden, monitor.

If you want peace of mind and a more reliable recovery process, it’s worth getting expert help—especially for business-critical websites, WooCommerce stores, or repeatedly infected WordPress installations.

If you need help with a hacked WordPress site, malware cleanup, or reinfection prevention, our team can assist with a full security review and cleanup process. Contact us today to discuss your website security concerns and get professional assistance.