You open your browser, type in your own domain, and something is wrong. Visitors are being redirected to a gambling site. Google is showing a “This site may be hacked” warning in search results. Your hosting provider just sent you a suspension notice. Or your site is simply down — no error message, just gone.
This is what a WordPress malware infection looks and feels like. And it happens to thousands of US small business websites every month.
The good news: most WordPress malware infections can be fully cleaned. The key is acting methodically rather than panicking, working through the right steps in the right order, and not stopping the cleanup process too early.
This guide gives you the complete 2026 process — from the first moment you suspect something is wrong, through full removal and cleanup, all the way to hardening your site so it doesn’t happen again.
Malware — short for malicious software — is any code that an attacker injects into your WordPress files or database in order to exploit your site, your visitors, or your server resources without your knowledge or permission.
WordPress is the world’s most popular CMS, powering over 43% of all websites globally. That popularity makes it the single most targeted platform for automated attacks. Attackers don’t manually pick your site — they run automated bots that scan millions of WordPress sites continuously looking for known vulnerabilities.
The most common entry points in 2026 are:
Outdated plugins and themes are the leading cause of WordPress infections. Every unpatched vulnerability in a plugin is a door an automated scanner can find and walk through. This includes plugins you installed and forgot about — they don’t need to be active to be exploited.
Nulled or pirated plugins and themes are pre-packaged with backdoors and malware. Downloading a premium plugin from an unofficial source to avoid paying for it is one of the fastest ways to hand attackers direct access to your site.
Weak or reused passwords enable brute-force attacks. Bots run thousands of login attempts per minute against WordPress login pages. A weak admin password can fall in minutes.
Compromised hosting environments mean your site can be infected through another site on the same shared server — a risk specific to low-cost shared hosting plans with poor isolation.
Infected admin devices transfer malware when you upload files from a computer that is itself compromised.
The common types of malware that attack WordPress sites include backdoors (hidden access points that survive cleanup if not found), SEO spam injections (hidden links and spam content injected into your pages to manipulate rankings), redirect malware (sending your visitors to scam, phishing, or adult sites), crypto mining scripts (using your server and your visitors’ browsers to mine cryptocurrency), phishing pages (fake login or payment pages hosted on your domain), and defacement (attackers replacing your content with their own messaging).
Malware doesn’t always announce itself immediately. Some infections are designed to stay invisible for as long as possible. Here are the warning signs to watch for, whether obvious or subtle.
Obvious signs include visitors being redirected to unfamiliar or harmful websites, your homepage being replaced with different content, a Google warning appearing in search results (“This site may be hacked” or “Deceptive site ahead”), your hosting provider suspending your account and citing malware, browser security warnings when visiting your site, and your site going completely offline without any action on your part.
Subtle signs that often go unnoticed include a sudden and unexplained drop in organic search traffic (Google may have quietly deindexed pages), new admin user accounts appearing in WordPress that you didn’t create, unfamiliar files in your wp-content or uploads directory, your site loading noticeably slower without any content changes, spam emails being sent from your domain causing you to end up on email blacklists, Google Search Console showing security issues or manual actions, and unusual spikes in server resource usage.
If you notice any combination of these, treat it as a confirmed compromise and begin the removal process immediately. Do not wait and watch to see if it resolves itself — malware does not self-remove.
Before you touch a single file, do these three things.
First, document what you’re seeing. Write down every symptom — what the site is doing, what error messages appear, when you first noticed the problem, and any recent changes made to the site (new plugins installed, theme updates, new admin users added). This information helps you identify the entry point and is important if you later involve a professional.
Second, check Google Search Console immediately. Log in to Google Search Console and navigate to Security and Manual Actions. This will tell you whether Google has already flagged your site and what type of infection they detected. This information is valuable for both cleanup and the post-cleanup reinstatement process.
Third, contact your hosting provider. Your host has server-level visibility into your site that you don’t have from the WordPress dashboard. Many US hosting providers have built-in malware scanning tools (such as Imunify360 or SiteLock integrations) that can scan at the server level and provide a detailed infection report. Call or chat with your host’s support team before starting cleanup — they may be able to run a scan and flag infected files before you begin.
The moment you confirm a malware infection, your first priority is stopping visitors from being exposed to it. An infected WordPress site can redirect users to phishing pages, install malware on their devices, or expose their personal data. Every minute your infected site is publicly accessible, you’re putting your visitors at risk and compounding potential legal and reputational liability.
Lock down access immediately by editing your .htaccess file in your WordPress root directory to block all traffic except your own IP address. Add the following to the top of the file, replacing YOUR.IP.ADDRESS with your actual IP (search “what is my IP” in Google to find it):
order allow,deny
deny from all
allow from YOUR.IP.ADDRESS
This blocks all public access while leaving you able to work on the site. Be aware that if you have a dynamic IP address that changes, you’ll need to update this each time.
If you cannot access your .htaccess file, contact your hosting provider immediately — they can place your site in maintenance mode at the server level.
This step confuses some people. Why would you back up a site that’s infected with malware?
The answer: because you may need to reference the infected files later to understand what was changed, and because any cleanup process carries the risk of accidentally deleting files that your site needs. A backup of the infected site is not a restore point — it’s a reference copy.
Back up everything: all files (via FTP or your hosting file manager) and your full database (via phpMyAdmin or your hosting control panel’s database backup tool). Store this backup somewhere separate from your server — a local drive or a separate cloud storage account.
If you have a confirmed clean backup from before the infection (from a service that runs daily offsite backups), note when that backup was made and whether it predates the infection. A clean pre-infection backup is your most powerful recovery tool.
You cannot effectively remove malware without first knowing exactly where it is. Guessing and randomly deleting files is how people break their own sites during cleanup.
Run at least two different types of scans.
For a frontend scan, use Sucuri SiteCheck (sitecheck.sucuri.net). Enter your domain and Sucuri will scan what is publicly visible — checking for known malware signatures, blacklist status across Google, McAfee, Norton, and others, and signs of injection in visible page code. This is free and takes under a minute. It will not catch server-side malware that isn’t exposed in public output, so it’s a starting point, not a complete diagnosis.
For a plugin-based backend scan, install a reputable WordPress security plugin. Wordfence Security and MalCare are both strong options for 2026. Wordfence scans your WordPress files against the known clean versions of every plugin and theme in the WordPress repository, flagging any files that have been modified. MalCare uses a cloud-based scanning approach that doesn’t slow down your server. Run a full scan and review every flagged item carefully before taking action — not every flagged file is malware, particularly if you have customizations.
For a server-level scan, contact your hosting provider. Many US hosts include server-level malware scanning in their plans or offer it as an add-on. Server-level scans can detect malware in locations that WordPress plugins cannot access.
For a database scan, you’ll need to use phpMyAdmin (available in most hosting control panels) and look manually, or use a tool like WP-CLI with a security extension. More on this in Step 5.
After scanning, compile a list of every flagged file and location. This is your cleanup checklist.
This is the most technical step in the process. If you’re not comfortable working with files via FTP or your hosting file manager, skip ahead to the plugin-based removal option or consider professional assistance.
The high-risk locations to check first are wp-config.php, .htaccess, the wp-content/uploads directory, theme files in wp-content/themes, plugin files in wp-content/plugins, the mu-plugins directory (wp-content/mu-plugins), and any recently modified files (sort by date modified in your file manager).
Open wp-config.php and look for anything you don’t recognize — unexpected PHP functions, encoded strings, eval() calls, base64_decode() calls, or any code outside the normal WordPress configuration variables. If you find injected code, remove only the injected portion carefully, not the entire file.
Open .htaccess and look for unexpected redirects, unfamiliar RewriteRule entries, or code blocks you didn’t put there. A clean WordPress .htaccess in most cases should look simple — just the standard WordPress permalink rules. Delete the file entirely and regenerate it by going to Settings then Permalinks in WordPress and clicking Save Changes (which forces WordPress to write a fresh .htaccess).
Check the wp-content/uploads directory carefully. This directory should contain media files — images, PDFs, videos. It should not contain PHP files. Any .php, .phtml, .php5, .phar, or other executable files in the uploads directory are almost certainly malware and should be deleted.
For each infected file identified by your scanner, compare it against the original clean version. For plugin and theme files, download the clean version from the official WordPress repository and compare. For core WordPress files, download a fresh copy from wordpress.org and compare. Do not delete files blindly — confirm they are actually infected before removing them.
This is the step that most basic cleanup guides skip — and it’s one of the most important. Malware frequently injects code into your WordPress database, not just your files. Database infections persist even if you replace all your files with clean copies.
Access your database via phpMyAdmin in your hosting control panel. You’re looking for injected content in several tables.
In the wp_posts and wp_postmeta tables, search for entries containing script tags, iframe tags, eval(base64_decode entries, obfuscated JavaScript, or links to unfamiliar external domains. Look at the post_content column in wp_posts — injected spam links, hidden iframes, and redirect scripts are commonly hidden there.
In the wp_options table, look at the siteurl and home values (which should match your actual domain), the active_plugins value, and any option values that contain encoded or obfuscated strings. Malware is frequently stored in the wp_options table under legitimate-looking option names.
In the wp_users and wp_usermeta tables, look for admin accounts you don’t recognize. Unknown admin users are a common indicator of compromise and a common persistence mechanism — the attacker creates a hidden admin account they can use to re-access your site even after cleanup.
Use phpMyAdmin’s Search function to search across all tables for common malware strings such as eval(base64_decode, <script src=, <iframe src=, and document.write. Be careful — some legitimate plugins use base64 encoding, so verify before deleting anything.
If you find injected database content, remove it carefully. If you are not confident editing database entries directly, use a security plugin like MalCare or NinjaScanner that includes database cleaning functionality.
After cleaning infected files and the database, replace all core WordPress files with clean verified copies.
Download a fresh copy of WordPress from wordpress.org. Replace your existing wp-admin and wp-includes folders entirely with the clean versions — delete the old folders and upload the new ones. Do not replace wp-content (which holds your themes, plugins, and uploads) or wp-config.php (which holds your database settings).
For each active plugin, deactivate it, delete it, and reinstall from the official WordPress plugin repository. Do not reactivate a plugin without reinstalling it from the original source. If a plugin is no longer available on the repository (which sometimes means it was removed due to security issues), replace it with an actively maintained alternative.
Delete all inactive plugins and themes. Inactive plugins and themes can still be exploited — if you’re not using them, remove them completely. Keep only one unused theme as a WordPress fallback (the current default theme) and nothing else.
For your active theme, download a clean copy from the original source and compare against your current files. If your theme is a premium theme, log into your purchase account and download the latest clean version. If you’ve made customizations directly to your theme files (which is not recommended — always use a child theme), you will need to carefully reapply those customizations to the clean theme files.
This is the step that causes most reinfections. People clean the visible malware and assume the job is done — but the attacker left a backdoor to regain access, and the infection comes back within days.
Backdoors are hidden pieces of code that let an attacker re-enter your site even after cleanup. They can be hidden in theme files, plugin files, mu-plugins (which load automatically and are often overlooked), the uploads directory, or even inside legitimate-looking PHP files with innocuous names.
Common backdoor signatures to search for include eval(base64_decode, system(, exec(, passthru(, shell_exec(, base64_decode combined with gzinflate or str_rot13, and preg_replace with the /e modifier (which executes code). Use your hosting file manager’s search function or an FTP client with search capability to scan all PHP files for these patterns.
Check the mu-plugins directory (wp-content/mu-plugins) specifically. This directory is designed for must-use plugins that load automatically regardless of what’s activated in WordPress. Attackers frequently place backdoors here because most site owners never look in this directory.
If you find a backdoor, delete the entire file — not just the backdoor code within it — because the rest of the file may also be compromised. Then check your scanner results again to ensure nothing was missed.
Also check for XML-RPC exploitation. The xmlrpc.php file is a legitimate WordPress file that allows remote publishing and application connections. It’s also a common brute-force target. If you don’t use remote publishing tools or mobile apps that connect to your site through XML-RPC, block access to this file entirely by adding the following to your .htaccess:
<files xmlrpc.php> order allow,deny deny from all </files>
After cleaning your site, assume that every credential associated with it has been compromised. Change all of them.
Change your WordPress admin password — all admin users, not just your own. Use a strong unique password of at least 16 characters that you’re not using anywhere else.
Change your hosting control panel password (cPanel, Plesk, or your host’s dashboard).
Change your FTP and SFTP passwords.
Change your database password in phpMyAdmin or your hosting control panel, then update the new password in wp-config.php (find the DB_PASSWORD line).
Change your WordPress secret keys and salts. Go to api.wordpress.org/secret-key/1.1/salt/ to generate a new set and replace the existing key definitions in wp-config.php. This immediately invalidates all existing login sessions — anyone who was logged in (including any attacker with an active session) will be logged out instantly.
Revoke and regenerate any API keys your site uses — particularly for e-commerce payment gateways, CRM integrations, email marketing tools, and any third-party service with write access to your site or data.
Remove any admin user accounts that you don’t recognize or that can’t be attributed to a real person on your team.
If Google flagged your site in search results or Google Search Console showed a security issue, simply cleaning your site does not automatically restore your search presence. You need to actively request Google to review your site.
First, verify your cleanup is complete by running another full scan with your security plugin and Sucuri SiteCheck. Do not submit to Google until you are confident the cleanup is thorough.
In Google Search Console, navigate to Security and Manual Actions. If there is a manual action on your site, you’ll see a Request Review button. Click it and submit a detailed description of what happened, what you found, and what steps you took to clean and harden the site. The more specific and thorough your description, the faster Google will process the review.
For Google Safe Browsing warnings (the red “Deceptive Site Ahead” browser warning), submit your site for review at google.com/safebrowsing/report_badware. Review typically takes 1 to 3 days.
Resubmit your XML sitemap in Google Search Console to prompt re-crawling of your clean pages.
If your domain ended up on email blacklists (check at mxtoolbox.com/blacklists.aspx), submit delisting requests to each blacklist that flagged you. Email blacklisting happens when malware uses your server to send spam, and it can disrupt all email from your domain until you request removal.
Cleaning a site without hardening it is how people end up doing this process again three months later. The same vulnerability that allowed the original infection still exists until you close it.
Keep everything updated. WordPress core, every active plugin, and every active theme should always be running the latest version. Most WordPress infections in 2026 exploit vulnerabilities that have already been patched — meaning the update was available but not applied. Turn on automatic updates for minor WordPress core releases. Review plugins weekly for available updates.
Install a Web Application Firewall. A WAF inspects incoming traffic before it reaches your WordPress site and blocks known malicious requests, SQL injection attempts, and brute-force login attacks. Wordfence includes a WAF in its free tier. Cloudflare offers WAF capabilities on paid plans. Your hosting provider may also offer server-level WAF protection.
Enable two-factor authentication for all admin accounts. Even if an attacker has your password, 2FA prevents them from logging in without the second factor. The WP 2FA plugin makes this straightforward to implement across all admin users.
Limit login attempts. Install a plugin like Login LockDown or use Wordfence’s login protection to block IP addresses after a set number of failed login attempts. This defeats automated brute-force attacks that try thousands of password combinations.
Change your WordPress login URL. The default login page at yourdomain.com/wp-admin is where bots focus their attacks. A plugin like WPS Hide Login lets you change this to any URL you choose, which significantly reduces automated login attempts.
Set correct file permissions. WordPress files should be set to 644 and directories to 755. The wp-config.php file should be set to 600 or 640. Overly permissive file permissions are a common misconfiguration that attackers exploit.
Disable file editing from the WordPress dashboard. By default, WordPress allows admin users to edit theme and plugin files directly from the dashboard. This is a major risk — if an attacker gains admin access, they can inject malware without touching the server. Disable it by adding this line to wp-config.php:
define(‘DISALLOW_FILE_EDIT’, true);
Move wp-config.php one directory above your public_html folder if your hosting configuration allows it. WordPress will still find it automatically, but it becomes inaccessible to web-based exploits targeting your public web root.
Install a security headers plugin or configure security headers at the server level. Headers like Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options reduce the risk of cross-site scripting and clickjacking attacks.
Run regular malware scans. Set your security plugin to run automatic scans daily. Review the results weekly. Don’t wait for symptoms to appear before scanning.
Malware isn’t a problem you solve once. New vulnerabilities are discovered continuously, new attack methods emerge regularly, and one missed plugin update can undo all your hardening work. A regular scanning schedule is what turns security from a reactive emergency into a manageable routine.
Daily automated scans should be handled by your security plugin. Configure Wordfence or your chosen tool to run a full automated scan every 24 hours and email you the results. Review any flagged items within 24 hours of notification — the faster you detect an infection, the simpler the cleanup.
Weekly manual reviews should include logging into your WordPress dashboard and checking for unfamiliar admin users, reviewing recently modified files in your hosting file manager, and confirming that all plugins and themes are updated.
Post-update scans should be run any time you update WordPress core, a theme, or a plugin. New code can introduce new vulnerabilities or occasionally contain injections if your update came from a compromised source. A post-update scan confirms the update was clean.
Monthly security audits should include reviewing all admin user accounts and removing any that are no longer active, reviewing all installed plugins and removing any that are unused or no longer maintained, checking Google Search Console for any new security flags, and reviewing your hosting account for any suspicious activity in access logs.
Quarterly backups should be tested. A backup that has never been tested is a backup that might not work when you need it. Once a quarter, do a test restoration of a backup to a staging environment to confirm your restore process works.
Manual malware removal is appropriate if you’re comfortable working with FTP or a hosting file manager, can read and identify suspicious PHP and JavaScript code, can navigate phpMyAdmin and database tables, are willing to work methodically through a multi-step process, and have time — a thorough cleanup typically takes 3 to 8 hours for a standard small business site.
You should strongly consider hiring a professional WordPress security specialist if the infection is complex or has spread across many files, if you’ve attempted cleanup and the malware keeps returning (which indicates a backdoor you haven’t found), if your site handles sensitive customer data, payments, or personal information, if you have no usable clean backup and the cleanup requires reconstructing parts of the site, or if your business depends on the site being operational and downtime is costing you real money.
Professional WordPress malware removal in the US typically costs $150 to $500 for a standard infection and $500 to $2,000 or more for complex or severe infections involving multiple backdoors, database compromise, Google blacklisting, and email blacklist removal.
When evaluating a professional service or specialist, ask what their cleanup process includes, whether they check for backdoors specifically, whether database cleaning is included, what post-cleanup support is offered, and whether they provide a cleanup report documenting what was found and removed.
Most US small business owners infected with malware had one thing in common: their site wasn’t being actively maintained. No scheduled updates. No regular scanning. No offsite backups. When the infection hit, they had no safety net.
WPDepend is a US-focused managed WordPress service built specifically to prevent exactly this situation for small businesses and agencies.
With over 10 years of experience in WordPress website management, WPDepend provides the proactive, ongoing care that keeps WordPress sites secure before a problem occurs — not just after one.
Every site on a WPDepend management plan receives daily offsite backups stored securely and independently from your server, so there is always a clean restore point available. WPDepend handles core, theme, and plugin updates on a regular schedule — tested before deployment so updates don’t break your site. Real-time security scanning monitors your site continuously for the malware signatures and behavioral patterns that indicate a compromise. Uptime monitoring alerts the WPDepend team immediately if your site goes down. A dedicated help desk means a real WordPress professional responds to your support tickets — not an automated system.
For US small businesses that have already been through a malware incident, WPDepend’s managed plans mean you won’t go through it again. And for businesses that haven’t experienced an infection yet — active management means the most common entry points (unpatched plugins, absent monitoring, no backups) are eliminated before an attacker can exploit them.
For agencies managing multiple client sites, WPDepend’s white-label maintenance service handles security management for your entire client portfolio under your own brand, giving your clients professional monthly reports while WPDepend’s team handles the technical work behind the scenes.
The math is straightforward: the cost of a WPDepend management plan is a fraction of the cost of a single malware cleanup — and it prevents the cleanup from being necessary in the first place.
The most obvious signs are visitors being redirected to other websites, your homepage being replaced with different content, Google showing a security warning in your search results, your hosting provider suspending your account, and browser warnings when visiting your site. Subtler signs include a sudden drop in organic search traffic, new admin user accounts you didn’t create, unfamiliar files in your file manager, and unusual server resource usage. To confirm, run a free scan at sitecheck.sucuri.net, install a security plugin like Wordfence and run a full scan, and check Google Search Console for security issues. Never rely on a single scan tool — malware that doesn’t appear on one scanner may appear on another.
Yes, if you’re comfortable working with FTP or a hosting file manager, can identify suspicious PHP and JavaScript code, know how to navigate phpMyAdmin, and are willing to work through a detailed multi-step process. For straightforward infections in a limited number of files, the manual process in this guide is effective. However, for complex infections with multiple backdoors, database compromise, or reinfection after initial cleanup, professional help is strongly recommended. An incomplete cleanup that misses a single backdoor will result in reinfection — often within 24 to 48 hours. If in doubt, hire a specialist for the cleanup and then invest in ongoing management to prevent it from recurring.
Recurring infections almost always mean one of three things: a backdoor was left behind that the attacker is using to re-enter, the vulnerability that caused the original infection was not patched (an outdated plugin or theme is still present), or a compromised admin account or stolen credential is being used to regain access. If your site has been reinfected more than once, stop trying to clean it yourself and engage a professional who will specifically look for and remove backdoors, audit all file permissions, rotate all credentials, and identify the original entry point.
Reinstalling WordPress core files (replacing wp-admin and wp-includes with clean versions) removes malware from core files — but it does not clean your wp-content folder (where themes, plugins, and uploads live), your database, or any backdoors that may be hidden in theme or plugin files. Many WordPress users reinstall core files, see the obvious symptoms disappear, and assume the site is clean — only to find the infection returns within days because the source in wp-content or the database was never addressed. A complete malware cleanup requires checking and cleaning files, database, and all themes and plugins.
After submitting a review request in Google Search Console, Google typically processes security issue reviews within 1 to 3 business days for straightforward cases. The Google Safe Browsing browser warning (the red “Deceptive Site Ahead” screen) may take up to 72 hours to disappear after your review is approved. If your site had a Manual Action applied by a Google reviewer, the reinstatement process can take longer — sometimes 1 to 2 weeks — particularly if the site had a history of previous violations. Ensure your site is completely clean before submitting — submitting a review before cleanup is complete will result in rejection and reset the waiting period.
Keep every plugin and theme updated without exception. The overwhelming majority of WordPress malware infections in 2026 exploit known vulnerabilities in outdated plugins and themes — vulnerabilities that had already been patched and the update was available but not applied. An automated update process combined with daily malware scanning and daily offsite backups eliminates the three most common reasons WordPress sites get infected and stay infected. If you cannot commit to managing this yourself, a managed WordPress service handles all of it on your behalf at a cost that is far lower than a single malware incident.
A WordPress malware infection is stressful, disruptive, and potentially damaging to your business — but it is recoverable. Work through the process in order, don’t rush or skip steps, verify your cleanup is complete before going public again, and use the incident as the motivation to put proper ongoing security in place.
The businesses that get hit by malware and never face it again are the ones that treat the aftermath as a turning point — investing in monitoring, updating, and backups that make future infections far less likely.
If you want that protection without managing it yourself, WPDepend is built for exactly that. Proactive management, real security monitoring, daily backups, and a US-focused team that takes care of your WordPress site so you can focus on running your business.
A seasoned technology writer and marketing consultant with over a decade of experience helping businesses grow online. I specialize in content marketing, SEO, web design, and e-commerce development. I am enthusiastic about using cutting-edge technology to acquire high-quality traffic, generate leads, and increase sales for my clients.
