WordPress malware: how to remove it safely, step by step

Signs your WordPress site has malware

• ✓Google warnings. A warning under your listing in search that says this site may be hacked. Or a red Dangerous site screen when visitors open it in Chrome.
• ✓Strange redirects. Visitors are sent to spam or scam sites, often only on mobile or only when they arrive from Google.
• ✓Spam pages in search. Search for site:yourdomain.com and you see pages you never made, sometimes in another language or selling fake goods.
• ✓Unknown users or files. Administrator accounts you did not create. New files with odd names in your hosting.
• ✓Host or email warnings. Your host flags or suspends the account. Emails from your domain start landing in spam.

Step 1: Stay calm and limit the damage

If your site is sending visitors to harmful pages, put it into maintenance mode or ask your host to take it offline for a short while. Protecting your visitors comes first.

Tell your host what is happening. Many hosts will scan the account and tell you which files they flagged. If you run an online store, pause new orders until you know whether customer data was affected.

Step 2: Back up everything, even the infected site

It sounds odd, but take a full backup of your files and database before you change anything. If a step goes wrong, you can go back. It also keeps a record of what the attacker changed. Store it on your computer or in cloud storage, not on the server.

Then look for a clean backup from before the infection. Restoring it can save a lot of time, but only if you also close the hole the attacker used. Otherwise they will simply come back.

Step 3: Scan to find what is infected

Run a full scan with a trusted security plugin such as Wordfence or Sucuri Security. Use your host's malware scanner too if it offers one. The results show which core files were changed, which plugin or theme files look suspicious and where PHP files sit in places they should not.

If you are comfortable with the command line, WordPress's own command line tool can check every core file against the official copy. Note everything flagged for the next steps.

Step 4: Replace the WordPress core files properly

Core files are the files that make up WordPress itself. Do not paste new ones on top of the old ones. Replace them cleanly:

• ✓Download a fresh copy. Get the latest WordPress from wordpress.org only, never from a third party site.
• ✓Delete the core folders. On your server, delete the two core folders whose names end in admin and includes. Then upload the same two folders from your fresh download.
• ✓Replace the main files. Replace the loose files in your main folder, such as index.php, with the fresh ones. Keep your configuration file (the one ending in config.php) and your content folder for now.
• ✓Remove strangers. Look for any other PHP files in the main folder that are not part of WordPress. Check them, then remove them.

Step 5: Clean your plugins, themes and uploads

Malware often hides in the content folder, which holds your plugins, themes and uploads. Delete every plugin and reinstall a fresh copy from WordPress.org or the developer's own site. Do the same for your themes. If your theme was custom built, compare it with a clean copy from your developer or your last clean backup.

Do not reinstall anything you no longer use or do not recognise. If you used a pirated or nulled premium plugin or theme, replace it with a licensed copy. Pirated copies are a very common source of infection.

Your uploads folder should only hold images and documents. A PHP file in there is a red flag. Finally, open the configuration file and the .htaccess file and look for code you did not add, such as long scrambled lines or redirects to other sites.

Step 6: Check users and the database

Go to Users and remove any administrator you do not recognise. Attackers often create one as a back door.

In the database, check that the site address settings point to your own domain. Look for injected scripts in posts, pages and widgets, especially long blocks of code you did not write. Delete any spam pages the attacker created. They should return a 404 or 410 error, which tells Google to drop them from search.

Also check your hosting panel for scheduled tasks (cron jobs) you did not set up. Some malware reinstalls itself from there.

Step 7: Update everything

Update WordPress, every plugin, every theme and your PHP version. The hole the attacker used is very often an old plugin. If you skip this step, you have cleaned the house but left the door open.

Step 8: Change every password and reset the security keys

Assume the attacker knows every password linked to the site. Change them all:

• ✓WordPress users. New passwords for every admin. Ask all other users to reset theirs.
• ✓Hosting and file access. Your hosting panel, FTP or SFTP accounts and the database password. Put the new database password in the configuration file too.
• ✓Email. Any email account connected to the site or used for password resets.
• ✓Security keys and salts. Replace them in the configuration file with fresh ones from the official generator at https://api.wordpress.org/secret-key/1.1/salt/ and save the file. This signs everyone out, including the attacker.
• ✓Two factor login. Turn it on for every admin before the site goes back online.

Step 9: Ask Google to review your site

Scan the site again and open it in a private browser window, on both desktop and mobile. When everything is clean, open Google Search Console, go to Security issues and click Request review. Explain briefly what you found and what you fixed.

Google then checks the site again. Depending on the problem, this can take from a few days to a few weeks. If antivirus tools or email providers also flagged your domain, ask them for a review too.

No Search Console account yet? Set one up now. You need it for the review and it warns you early next time.

When to call in a professional

Some clean ups are too risky to do alone. Get expert help if:

• ✓It keeps coming back. The malware returns days after you cleaned it, which means a back door is still open.
• ✓You handle payments or customer data. Online stores and booking sites need a careful clean up with a record of what was found.
• ✓Your host has suspended the site. You may need to show the host a clean scan before they restore access.
• ✓You are not comfortable with server files. Deleting the wrong folder can take the whole site down.

How to stop it happening again

Sites often get infected again because the original hole was never closed. Keep everything updated, use two factor login, delete what you do not use and keep daily backups off the server. Our website security guide explains each habit in simple words.

Read the website security guide →