Discovering your site has been hacked is stressful — but a WordPress site is almost always recoverable. The key is a methodical process: find the malware, remove it completely, and close the hole it came through so you don’t get reinfected. Random file-deleting usually makes things worse. Here’s how WordPress malware removal is done properly.
Signs your site is infected
- Browser or Google “this site may be harmful” warnings.
- Unexpected redirects, pop-ups, or spammy content and links.
- New admin users you didn’t create, or unfamiliar files.
- A sudden traffic drop, or your host suspending the account.
Step 1: Contain it
Put the site into maintenance mode or take it offline to protect visitors, and take a full backup of the current (infected) state for reference before you change anything. Change all passwords — WordPress admins, hosting, FTP/SFTP, and database.
Step 2: Identify the malware
Scan with a reputable malware scanner and review recently modified files, your .htaccess, and the database for injected code. Compare core files against clean WordPress originals — anything that doesn’t match is suspect.
Step 3: Clean it out
- Reinstall WordPress core with fresh, official files.
- Replace themes and plugins with clean copies from official sources; delete anything nulled or unused.
- Clean the database of injected scripts, spam, and rogue admin users.
- Check
.htaccess,wp-config.php, and the uploads folder for backdoors and malicious PHP.
Backdoors are the reason sites get reinfected — miss one and the attacker walks straight back in. If you’re not confident you’ve found them all, the safest route is a clean restore from a known-good backup, then re-apply only trusted plugins.
Step 4: Re-harden and recover
Once clean, apply WordPress security best practices so it doesn’t happen again: update everything, enforce 2FA, limit logins, and add a firewall. Then request a review from Google Search Console (and any blocklists) to clear warnings, and monitor closely for a few weeks.
Removing malware and, more importantly, keeping it out is exactly what ongoing WordPress maintenance & support is for — proactive scanning, hardening, and restore-tested backups mean a hack is a quick recovery, not a disaster.
Frequently asked questions
How do I remove malware from WordPress?
Contain the site and back up its current state, identify the infection by scanning and comparing against clean core files, then reinstall core, replace themes/plugins with clean copies, clean the database and config files of injected code and backdoors, re-harden security, and request a review to clear any warnings.
Why does my site keep getting reinfected?
Almost always because a backdoor was left behind, or the original vulnerability (usually an outdated plugin or weak password) was never fixed. Reinfection means the cleanup was incomplete — a clean backup restore plus thorough hardening is the reliable fix.
Should I hire someone to remove malware?
If the site is business-critical, you can’t find the source, or it keeps returning, yes. Professional removal ensures backdoors are found and the entry point is closed, and pairs the cleanup with hardening so it doesn’t recur. For simple cases, a careful restore-and-harden may be enough.