WordPress Malware Removal: What a Proper Cleanup Actually Includes

Treat a hacked site as an incident, not a cleanup task

The instinct when you find malicious code is to delete it immediately. Resist that for an hour. The moment you start deleting, you destroy the evidence that tells you how the attacker got in, what else they touched, and whether they still have access. A cleanup that skips this step is a cleanup you will repeat.

Three things happen first. Take a full copy of the site as it currently is, infected, including the database, and store it somewhere the live site cannot reach. Note the timestamps of every suspicious file you have already found. Then pull whatever access logs your host retains, because the request that dropped the first payload is usually still in them.

Contain before you investigate

If the site is actively serving malware to visitors, redirecting traffic, or sending spam, containment comes before investigation. Putting the site into maintenance mode, disabling outbound mail, or placing it behind an access rule stops the ongoing damage while you work. On a site handling payments, containment is not optional.

Assume the credentials are gone

If an attacker had file write access, treat every credential reachable from that server as compromised: WordPress administrator accounts, database user, FTP and SFTP, hosting panel, and any API keys sitting in wp-config.php or a plugin settings table. Rotating these later, after the cleanup, is a common reason sites get reinfected during the cleanup itself.

Hunt persistence before you call it clean

An attacker who has been on a site for more than a few hours has usually left more than one way back in. Persistence is the reason a site gets reinfected within a week of a cleanup that looked complete.

The mechanisms worth checking every time:

• Extra administrator accounts, sometimes with plausible names and a recent registration date.
• Scheduled tasks, both WordPress cron entries and server crontab, which can re-download a payload minutes after you delete it.
• Must-use plugins in wp-content/mu-plugins, which load automatically and never appear in the plugin list.
• Modified .htaccess rules that conditionally redirect based on user agent or referrer, so the site looks fine to you and redirects the visitor arriving from Google.
• Injected code in the active theme, particularly functions.php and header or footer templates.
• Rogue SSH keys or hosting panel accounts where the compromise reached the server rather than just the application.

Match the timeline

Use the timestamp of the earliest known malicious file as your anchor, then look at everything modified in the same window. Attackers frequently reset timestamps on the obvious payload and forget the helper file they wrote three minutes earlier.

Prove the site is clean instead of assuming it

Verification is a separate step with its own checklist, not a feeling that you got everything.

• Re-run file integrity checks against a fresh core and plugin baseline and confirm zero unexpected differences.
• Fetch the homepage and several inner pages while spoofing Googlebot as the user agent, then compare against a normal browser request. Cloaked spam only appears under the crawler.
• Check a Google site: search for indexed spam URLs that need removal.
• Confirm no unexpected outbound connections or mail queue activity.
• Review Search Console for security issues and manual actions, and request review only after everything above passes.
• Watch the site for at least a week. Reinfection usually shows within days, and it tells you the persistence hunt missed something.

Full detail on the detection side of this is in the WordPress malware scanning guide.

Signs the cleanup is beyond a plugin scan

Handle it yourself when the infection is recent, the entry point is obvious, you have a clean backup and the site is not handling payments or sensitive data. Bring in a specialist when any of the following are true:

• The site has been reinfected after a previous cleanup.
• Multiple sites on the same hosting account are affected.
• The site is flagged by Google Safe Browsing or blocklisted by a security vendor.
• Customer data, payments or login credentials may have been exposed.
• There is no reliable backup from before the compromise.
• You cannot determine when or how the compromise started.

The cost of a second failed cleanup is usually higher than doing the first one properly, because by then the site has also lost rankings and, on an ecommerce store, orders.

WordPress malware removal questions