Step-by-step process to remove WordPress malware quickly

If your website suddenly starts redirecting visitors, showing suspicious ads, or receiving warnings from search engines, there is a high chance it has been compromised. When this happens, the first priority is to remove WordPress malware quickly before it causes further damage to your website, reputation, and search rankings.

In this guide, you will learn how to remove WordPress malware step by step, detect hidden malicious code, and secure your website to prevent future attacks.

Preparing before scanning your website for malwareLink to heading

Before you begin scanning or attempting to remove WordPress malware, proper preparation is essential. These initial steps help prevent data loss and ensure the cleaning process runs safely and efficiently.

Backup your entire websiteLink to heading

Never skip the backup step when checking a website for malware. During the cleanup process, it is possible to accidentally delete important files or damage the website. A full backup allows you to restore the site quickly if something goes wrong.

To back up your website:

• Log in to cPanel or your hosting control panel and find the Backup or Backup Wizard section.
• Create a full backup of both website files (Home Directory) and databases.
• Download the backup copy to your local computer for safe storage.

If your site runs on WordPress, you can simplify the process using backup plugins such as UpdraftPlus or All-in-One WP Migration. These tools create complete backups of your files and database before you start scanning or trying to remove WordPress malware.

Access your website filesLink to heading

To inspect and clean infected files, you need direct access to your server.

Common access methods include:

• FTP (File Transfer Protocol): FTP software like FileZilla or Cyberduck allows you to connect to your hosting server and browse website files easily.
• SSH (Secure Shell): For users familiar with command-line tools, SSH provides deeper server access and faster file management.
• cPanel File Manager: Beginners often find this option easiest. It allows you to view and manage website files directly through your hosting control panel using a web browser.

Put the website into maintenance modeLink to heading

Before starting the scan, temporarily place your website in maintenance mode. This prevents visitors from accessing the site while you investigate or attempt to remove WordPress malware. It also stops malicious scripts from spreading or affecting users.

Ways to enable maintenance mode:

For WordPress websites

• Install plugins such as WP Maintenance Mode or SeedProd
• Or add a short maintenance code snippet in the theme’s functions.php

For other websites or manual setup

• Create a simple index.html file displaying a message like “Website under maintenance.”
• Upload it to the root directory and temporarily rename the original index.php so the maintenance page loads instead.

Identify initial signs and analyze the situationLink to heading

Before digging into website files, collect basic information about the site’s current condition. This helps narrow down possible infection sources and speeds up the malware detection process.

Check Google Search ConsoleLink to heading

Log in to your Google Search Console account and review your site’s security status.

Look for alerts in:

• Security & Manual Actions – to see if Google has detected malware or blacklisted your website.
• Messages – where Google may send warnings about suspicious activity or security problems.

These alerts often provide early clues when trying to identify and remove WordPress malware.

Use Online Malware ScannersLink to heading

Online scanners analyze your website from the outside and quickly detect common threats such as hidden malware, SEO spam, or blacklist issues.

Recommended tools include:

• System443: Simply enter your website URL and the system analyzes the site for potential malware.
• Sucuri SiteCheck: Provides detailed reports on malware, blacklist status, and SEO spam issues.
• VirusTotal: Checks your website URL using multiple antivirus engines.

Important: Online scanners only examine the public side of a website. They cannot access internal server files, so they may not detect every infection. A deeper inspection is usually required when attempting to fully remove WordPress malware.

Check Access Logs and Error LogsLink to heading

When investigating a compromised website, reviewing server logs is an important step before attempting to remove WordPress malware. Logs can reveal suspicious activities that indicate hacking attempts or malicious scripts running on the server.

Start by logging into cPanel or your hosting control panel and locating the Logs or Raw Access Logs section.

While reviewing logs, look for unusual behavior such as:

• Requests made to strange or non-existent files
• Large amounts of traffic coming from unfamiliar IP addresses
• Multiple 404 errors (Not Found) for files you do not recognize
• Repeated 500 errors (Internal Server Error) that appear unexpectedly

These irregular patterns may suggest ongoing attacks or malicious files trying to execute within the system.

Inspect suspicious filesLink to heading

The next stage of scanning a website for malware involves directly reviewing files stored on your hosting server. This step helps identify suspicious elements before performing deeper cleanup to remove WordPress malware.

Check recently modified or newly created filesLink to heading

Using an FTP client such as FileZilla or the cPanel File Manager, sort website files by Date Modified in descending order.

Look for files that were edited or created recently, especially if the changes happened after the suspected attack. Pay special attention to files you did not modify yourself.

Focus on files with extensions such as:

• .php
• .js
• .css

Also check for files that have no extension or contain confusing names. Malware often hides in files with random or unusual names, for example:

• aajshd.php
• wp-vcd.php
• cache.php

These types of files may indicate unauthorized code that must be investigated when trying to remove WordPress malware.

Review core WordPress directoriesLink to heading

Certain folders are critical to WordPress operation and should only contain official files.

Common WordPress core directories include:

• /wp-admin/
• /wp-includes/
• /wp-content/

Verify that these folders do not contain unexpected files outside the standard WordPress structure. Unknown files in these locations may be signs of malicious code.

Check Themes and PluginsLink to heading

Hackers frequently hide malware inside theme or plugin files because these locations are less likely to be inspected.

Review the directories:

• /wp-content/themes/
• /wp-content/plugins/

Inspect installed themes and plugins carefully. Look for unfamiliar files or suspicious code added to common files such as:

• functions.php
• header.php
• footer.php
• index.php

Malware often uses functions like:

• eval()
• base64_decode()
• gzinflate()

These functions may appear inside legitimate files but contain hidden malicious code. Also review index.php files in subdirectories to ensure they have not been modified.

Search for files in unexpected locationsLink to heading

Malicious scripts are sometimes uploaded to directories where they normally should not exist. This technique helps attackers hide their code from basic scans.

Check folders such as:

• /uploads/
• /tmp/ (if accessible)
• subdirectories inside /wp-content/

Look for executable files like .php scripts placed in these directories. Files running in unexpected locations may be used to maintain unauthorized access, which must be removed when working to remove WordPress malware.

Analyze file contentLink to heading

After identifying suspicious files, examine their contents to determine whether they contain malicious code. This step helps confirm which files must be cleaned or deleted during the process to remove WordPress malware.

Search for common malware codeLink to heading

Open suspicious .php or .js files using a text editor such as Notepad++, Sublime Text, or VS Code.

Look for functions frequently used in malicious scripts, including:

• base64_decode
• eval
• gzinflate
• str_rot13
• exec
• shell_exec
• passthru
• system
• preg_replace with the /e modifier

Malicious code is often obfuscated or encoded to hide its real purpose. You may see long strings of meaningless characters or unusual code inserted at the beginning or end of legitimate files.

Inspect suspicious JavaScript and iFramesLink to heading

Review .js files and any JavaScript code embedded inside .php or .html files. Look for scripts that load resources from unknown external domains or create hidden iframe elements. Attackers frequently use hidden iframes to load malicious content or redirect visitors to harmful websites.

Check the .htaccess and wp-config.php FilesLink to heading

• .htaccess: This server configuration file can be modified to redirect visitors to malicious websites, block administrator access, or allow execution of harmful scripts. Compare the file with a clean WordPress version or a backup copy to detect unauthorized changes.
• wp-config.php: This file contains sensitive database credentials. Attackers may insert malicious code to connect your site to external servers or modify security settings. Carefully inspect it for unknown code blocks or suspicious additions.

Compare files with clean versionsLink to heading

Compare WordPress Core FilesLink to heading

• Download the latest WordPress installation package from wordpress.org. Extract it on your computer and compare those files with the ones on your hosting server.
• Focus especially on the wp-admin and wp-includes directories. File comparison tools such as WinMerge (Windows) or DiffMerge (macOS/Linux) can help highlight differences.
• Any changes in core WordPress files, except for legitimate modifications like wp-config.php, may indicate malicious code that needs to be removed.

Compare Plugins and Themes with official versionsLink to heading

If you suspect a plugin or theme may contain malware, download the latest clean version from the official WordPress repository or from a trusted developer. 

Compare those files with the versions stored on your hosting server. Unexpected modifications, additional files, or hidden code may reveal the source of the infection.

This comparison process helps identify altered files and is a critical step when working to remove WordPress malware completely and restore the security of your website.

Remove and clean malware from your websiteLink to heading

Once you have identified malicious code on your website, the next step is to clean the infection carefully. The goal is to eliminate harmful files, remove unauthorized access, and ensure the system is safe before restoring normal operation.

Delete suspicious filesLink to heading

If you find files with unusual names, unknown scripts, or unexpected .php files inside directories such as the uploads folder, these may be malicious. Such files are commonly used by attackers to run hidden backdoors or malicious commands on the server.

Delete these files immediately if you are certain they are not part of your website’s normal structure. Removing these suspicious files is one of the most direct steps to remove WordPress malware and stop attackers from maintaining access to your system.

Clean malware from infected filesLink to heading

Sometimes malware is not stored as a separate file but instead inserted into legitimate website files.

In this case, open the infected file and carefully locate the malicious code. Remove only the harmful section while keeping the rest of the file intact. It is important to avoid deleting essential parts of the code that could break the website’s functionality.

If you are unsure which section is malicious, it may be safer to remove the entire infected file and replace it with a clean version. You can restore the file from a trusted backup or download a fresh copy from the official source. This approach helps ensure that the process to remove WordPress malware does not accidentally damage the website structure.

Remove unknown user accountsLink to heading

Hackers often create hidden user accounts to maintain access to the website after an attack. These accounts can allow them to return even after malware has been removed.

To prevent this:

• Review all user accounts in the WordPress admin dashboard or your website management system.
• Delete any user accounts that you do not recognize or did not create.
• Check your hosting environment for unauthorized FTP or SSH accounts.

Removing these unknown accounts is an essential step when trying to fully remove WordPress malware and prevent reinfection.

Check the Website DatabaseLink to heading

Malicious code can also be injected into the website database. Attackers sometimes insert SEO spam, malicious scripts, or hidden administrator accounts directly into database tables.

To inspect the database:

• Access phpMyAdmin through your hosting control panel.
• Browse database tables and search for unusual entries or suspicious strings.
• Carefully review tables related to website content such as posts or comments.

For WordPress websites, pay close attention to the following tables:

• wp_users – to detect unauthorized administrator accounts
• wp_options – to identify suspicious configuration entries

Working with databases requires caution. If you are not confident editing database records, it is recommended to seek assistance from a qualified professional. Incorrect changes could damage your website.

Strengthen security after malware removalLink to heading

After you successfully remove WordPress malware, the next priority is protecting the website from future attacks. Without proper security measures, the site could easily become infected again.

Change all passwordsLink to heading

Updating all credentials helps block attackers who may still possess old login information.

You should change passwords for:

• WordPress administrator accounts or other CMS admin accounts
• Hosting control panel such as cPanel
• FTP and SSH access
• Website database credentials (update them in wp-config.php if using WordPress)
• Email accounts associated with the website

Using strong and unique passwords significantly reduces the risk of unauthorized access.

Update all website componentsLink to heading

Outdated software is one of the most common causes of malware infections.

To improve security:

• Ensure the WordPress core or your CMS platform is updated to the latest version.
• Update all themes and plugins from trusted sources.
• Remove any plugins or themes that are no longer in use.

Regular updates help close known vulnerabilities and support long-term efforts to remove WordPress malware and prevent new infections.

Install a security pluginLink to heading

For WordPress websites, installing a reliable security plugin provides additional protection.

Popular options include:

• Wordfence Security
• iThemes Security
• Sucuri Security

These tools provide features such as:

• Web application firewall protection
• Scheduled malware scanning
• Brute-force attack prevention
• Security monitoring and alerts

Using a security plugin helps detect threats early and reduces the chance that malware will return.

Request a Google review if the site was blacklistedLink to heading

If your website was flagged by search engines for malware or security issues, you should request a review after cleaning the infection.

Through Google Search Console, submit a reconsideration request once the malware has been removed and the website is secure. Google will re-evaluate the site and may remove security warnings or blacklist status if the problem has been resolved.

Monitor your website continuouslyLink to heading

Ongoing monitoring is critical for long-term security.

Best practices include:

• Regularly reviewing server access logs for suspicious activity
• Using monitoring tools that alert you to unusual behavior
• Scheduling routine malware scans
• Creating regular backups and storing them securely

Consistent monitoring ensures that if new threats appear, you can quickly detect them and respond before serious damage occurs. This proactive approach supports a safer environment after you successfully remove WordPress malware.

ConclusionLink to heading

Finding and trying to remove WordPress malware can be a stressful experience for any website owner. We hope this guide has provided you with a clear, professional roadmap to restore your site’s integrity. Stay proactive with regular updates, strong passwords, and consistent monitoring to ensure your WordPress site remains a safe environment for your visitors.

If you want to reduce the risk of future attacks, installing a firewall is one of the most effective security measures for your website. W7SFW is a security solution designed specifically to protect WordPress websites from common threats such as brute-force attacks, malicious bots, and vulnerability exploits. By filtering suspicious traffic before it reaches your website, W7SFW helps block potential attacks early and keeps your system safer.

If you want to keep your WordPress website stable, secure, and protected from malware risks, consider activating W7SFW today.