The reliable way to check a WordPress site for malware is to use several layers of evidence: inspect what visitors and search engines see, run a WordPress-aware application scan, use an external remote scan, and—when the signs warrant it—review the database and server files. One clean-looking homepage is not proof that the installation is clean.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
If any warning sign appears, preserve the current site before deleting or restoring anything. Then clean from known-good files or a verified clean backup, rotate every relevant credential, harden the installation, and request blocklist or search-engine review only after remediation is complete.
As an Amazon Associate I earn from qualifying purchases.
What a WordPress malware check must establish
A malware check is not a single button or a single scanner result. It should answer four separate questions:
- Has the public site or its search listings been altered?
- Are WordPress core, theme, plugin, upload, and other files different from clean originals?
- Does the database contain injected content, users, options, or scheduled tasks that a file-only scan cannot see?
- Is the hosting account or server still capable of reinfecting a cleaned installation?
Wordfence founder and CTO Mark Maunder states the first principle plainly: “If you suspect you have been hacked, first make sure that you have actually been hacked.” That means documenting symptoms and confirming them with more than one layer before making destructive changes. A scanner flag is actionable, but it still needs review so a legitimate custom file is not deleted as malware.
#1 Best Overall
Warning signs that justify an investigation
Treat any one of these signals as a possible compromise, especially when several occur together:
- Visitors are redirected to an unfamiliar domain, an unexpected product page, or a download.
- Google displays a warning such as “This site may be hacked” beside your result.
- An administrator account, editor, API key, or other privileged user appears that nobody on your team created.
- Core, theme, plugin, or upload files have unfamiliar names, recent modification times, or code that is not present in the vendor release.
- Spam pages, pharmaceutical terms, gambling links, injected JavaScript, or unsolicited posts appear in the site or search index.
- Your site sends spam email, creates new content, or changes settings without an authorized action.
- The site becomes unexpectedly slow, crashes, consumes unusual CPU or memory, or generates repeated server errors.
- Legitimate users can no longer log in, passwords change unexpectedly, or sessions behave strangely.
- A WordPress security scanner, hosting scanner, antivirus service, or blocklist reports malicious code.
Do not wait for every symptom. The longer a compromised site remains infected, the greater the chance of data loss, search penalties, credential theft, and spread to other sites in the same account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use multiple inspection layers
Each method sees a different part of the installation. Use the following sequence rather than treating a remote scan or a plugin scan as a complete verdict.
| Layer | How to inspect | What it can reveal | Important limitation |
|---|---|---|---|
| Rendered site and search results | Open the site in a private browser window, test several pages and forms, and search for the domain and suspicious snippets. | Redirects, defacements, spam pages, injected links, browser warnings, and search-engine notices. | Hidden backdoors and dormant code may not execute for your browser or crawler. |
| WordPress-aware application scan | Run a scanner that understands WordPress core, themes, plugins, users, and common malware patterns. | Modified core files, known malicious signatures, unexpected users, vulnerable components, and suspicious extensions. | Coverage depends on configuration and access; a file-focused scan may miss database-only infections. |
| External remote scan | Scan the public URL from outside the hosting account. | What an ordinary visitor, crawler, or blocklist service can fetch: redirects, malicious scripts, visible payloads, and reputation warnings. | It cannot read private files, protected admin areas, or database records that are not rendered publicly. |
| Filesystem and server review | Inspect hosting files, logs, scheduled jobs, and account-level processes, or have the host perform a server-side scan. | Backdoors, altered configuration, malicious cron jobs, web shells, and reinfection mechanisms outside the normal WordPress view. | Requires hosting access or technical help; a WordPress plugin cannot always see the whole server. |
| Database review | Review users, posts, options, metadata, widgets, and other tables for unauthorized values or injected markup. | Stored scripts, spam content, rogue administrator records, malicious redirects, and persistence in options or scheduled actions. | A clean file scan does not establish that database records are clean. |
Wordfence, Sucuri, and other services describe these layers differently, but the underlying distinction is the same: remote, application, server, and database checks are complementary, not interchangeable. No neutral study establishes that one product detects every infection more accurately than another, and the available evidence does not support a universal speed or price ranking.
Prepare without destroying evidence
Cleaning too early can erase the clues needed to identify the entry point or leave a backdoor behind. Before deleting files, changing timestamps, or restoring a backup:
- Record the symptoms. Save affected URLs, screenshots of redirects or warnings, the approximate first-seen time, suspicious usernames, scanner findings, and relevant error messages.
- Capture the current state. Ask your host for a full copy of the files, database, and useful access logs. Keep it isolated and clearly labeled as potentially infected; do not treat it as a clean backup.
- Check backup provenance. Identify when each backup was created and whether the same symptoms were present then. Do not restore an old backup until it has been checked for infection.
- Limit unnecessary changes. Avoid repeatedly logging in from an untrusted computer, mass-deleting files, or installing many new plugins while investigating. Use a known-clean device and network when possible.
- Decide who will handle server evidence. If the site is business-critical, hosts multiple installations, or shows signs of a web shell, involve the hosting provider or a qualified incident-response professional before attempting a partial cleanup.
Step-by-step: check the site for malware
1. Inspect the public site and search listings
Open the homepage and representative internal pages in a private window while logged out. Test a page with a form, a search result, a media URL, and any page visitors have reported. Use a second browser or mobile connection if the redirect appears conditional. Look for unexpected destinations, pop-ups, new downloads, altered titles, foreign-language text, and checkout or login changes.
Free tools Windows power users keep installed
One-click scans. No signup required.
Search the domain by name and inspect indexed pages. A search-engine warning or spam result is evidence that the public response or reputation has been affected, but the absence of a warning does not prove the site is clean. Search crawlers may not have visited a hidden payload yet.
2. Check accounts, content, and settings inside WordPress
In the dashboard, review the user list, roles, recent posts, pages, media, comments, menus, widgets, and site settings. Pay particular attention to administrator accounts, unfamiliar email addresses, modified home or site URLs, custom code fields, scheduled actions, and newly published or trashed content. Export or record suspicious records before removing them so they can be correlated with access logs.
If you cannot log in, do not keep guessing passwords. A failed login can be a symptom of changed credentials, but repeated attempts can also trigger host defenses. Preserve the error and contact the host or an administrator who still has verified access.
3. Run a WordPress-aware application scan
Use a reputable scanner with permission to inspect the installation. Enable the deepest file and integrity checks available, and allow the scan to examine core, themes, plugins, uploads, users, and configuration rather than only the homepage.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →When a result is reported, read the context before deleting anything. Compare the flagged path, file owner, modification time, and code with the expected package. A custom plugin or theme may legitimately differ from an official release; an unfamiliar executable file in an uploads directory is harder to explain. Record each finding and its disposition.
Wordfence guidance emphasizes confirming a compromise and reviewing findings rather than blindly removing every match. A scanner can identify a known signature, but a false positive is possible and a novel backdoor may not match a signature.
4. Compare files with clean originals
For WordPress core, obtain the matching version from the official WordPress source and compare the files. For a theme or plugin, use the exact vendor release that corresponds to the installed version. Sucuri recommends replacing compromised core files with clean copies from the official WordPress source instead of trying to edit malicious code out line by line.
Replace, rather than hand-edit, files that should be identical to a vendor package. Preserve customizations separately so they can be reviewed and reapplied safely. Check for unexpected PHP files in uploads, cache, temporary, and image directories; attackers often choose writable locations that are not part of a normal package.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute5. Review the database and server when the evidence calls for it
A front end can look normal while malicious code waits in the database or executes only for search crawlers, logged-out visitors, or a particular referral source. Review posts, options, metadata, widgets, navigation fields, and user records for injected scripts, hidden links, rogue redirects, and new privileged accounts.
Ask the host to inspect server logs, account-level files, scheduled jobs, and neighboring installations when there is unexplained reinfection, a web-shell indicator, or more than one site affected. Server-side scanning or manual database review may be necessary because a WordPress file scan does not cover every persistence location.
6. Run an external remote scan
Scan the public URL from outside the account after recording the current state. A remote service can reveal what an ordinary visitor sees and may identify malicious scripts, redirects, or blocklist status that an authenticated application scan does not show. Run it after major cleanup as well, but interpret a clean result narrowly: it means the tested public responses looked clean, not that private files and database records are automatically safe.
7. Correlate results before deciding the scope
Build a short incident list with the path or URL, finding, evidence, and action. A redirect reported by a remote scan plus a modified template file and an unknown administrator is a coherent compromise. A single signature in a legitimate custom file needs code review and comparison with a known-good copy. If layers disagree, expand the investigation rather than choosing the most reassuring result.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat to do when a scanner finds malware
Contain the active problem
Restrict unnecessary access while preserving evidence. If the host provides a maintenance or isolation option, use it in a way that does not overwrite the captured state. Keep a clear record of who changed what and when. Do not advertise the suspected malicious URL or continue testing it from an ordinary personal account.
Remove malicious code, files, accounts, and content
Delete confirmed malicious files and database records, remove unauthorized users, and restore altered settings. Replace compromised WordPress core files with clean copies from the official source. Reinstall affected themes and plugins from trusted original packages, then reapply only reviewed custom changes. Do not simply hide a spam page or remove a redirect while leaving the access mechanism that created it.
Update every supported component
Update WordPress core, themes, and plugins after the site is under control. Remove unused plugins, themes, old installations, and abandoned copies. Unsupported software is both an entry point and a reason an otherwise successful cleanup can fail.
Verify the cleanup
Run the application scan again, repeat the external scan, retest representative pages while logged out, and check the database and server evidence that triggered the investigation. Watch logs and site behavior for renewed changes. A clean rescan is a verification step, not permission to skip credential rotation.
Rotate credentials and prevent reinfection
Cleanup is incomplete until an attacker can no longer use stolen access. Change credentials from a known-clean device for:
- Every WordPress administrator and other privileged account.
- The hosting control panel and server or SSH accounts.
- FTP or SFTP users.
- The database user.
- Domain registrar, DNS, email, payment, analytics, and deployment accounts connected to the site.
- Application passwords, API keys, salts, and tokens stored in configuration files or integrations.
Enable two-factor authentication for administrators and hosting access. Remove unfamiliar users and reduce legitimate accounts to the lowest role they need. Ask the host whether credentials, SSH keys, scheduled tasks, or other sites in the same account were affected.
Maintain regular backups that are stored separately from the live account, and test restoring them. Keep WordPress and extensions supported and patched, remove anything unused, and monitor file changes, logins, new users, and outbound email. A backup that has never been restored is an assumption, not a recovery plan.
How to remove a Google hacked-site warning
First fix the infection. Do not request a review while malicious files, spam, unknown accounts, or vulnerable persistence mechanisms remain. Google and other security authorities can return a warning after a superficial cleanup if crawlers still detect the payload.
- Complete the file, database, account, and server checks relevant to the incident.
- Update and harden the installation, then verify it with a new application scan and an external scan.
- Review the affected URLs and search appearance to ensure the malicious content is gone.
- In Google Search Console, open the Security Issues report and submit a review request after remediation. Describe what was found, what was removed, and what controls were added.
- If an antivirus provider or another blocklist operator also flags the domain, follow that operator’s review process separately after cleanup.
Sucuri notes that diagnostic tools can help check a site’s security status when Google or another authority has blocklisted it. A review is not a substitute for remediation, and approval does not protect against a reinfection caused by unchanged credentials or vulnerable software.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choosing a scanning approach
Choose tools based on the access and risk of this particular site, not on an unsupported claim that one scanner is universally most accurate. The practical comparison is:
| Need | Most relevant capability | Questions to ask before using it |
|---|---|---|
| Visible redirect or warning | External remote scan plus browser and search inspection | Does it fetch several URLs, follow redirects, and report blocklist status? |
| Modified core, theme, or plugin files | WordPress-aware integrity and malware scan | Can it compare the installed version with a clean vendor copy and let you review false positives? |
| Hidden persistence or repeat infection | Server-side review, logs, and database inspection | Do you or your host have access beyond the public web root? |
| Active business or high-risk site | Monitoring, incident response, and professional remediation | What support, response time, backup handling, and scope are actually included? |
| Ongoing protection | Scheduled scans, alerts, tested backups, updates, and access controls | Will alerts reach someone who can act, and have restores been tested? |
The cited vendor material establishes that these methods cover different layers. It does not provide a neutral accuracy benchmark, a current pricing table, or a universal recommendation. Cost and suitability depend on hosting access, database access, technical skill, site criticality, and whether professional remediation is required. Sucuri reported that 1.15% of 108,122,130 sites scanned in 2023 were affected in its vendor-reported SiteCheck results; that figure is a provider’s scan population, not a prevalence estimate for all WordPress sites.
Common mistakes and how to correct them
Relying on a clean homepage
Why it fails: Malware can target only search crawlers, logged-out users, mobile visitors, or a hidden URL.
Correction: Test multiple pages, search results, an external scan, and the application, database, or server layers indicated by the evidence.
Restoring the oldest backup immediately
Why it fails: The backup may already contain the backdoor, and restoration can erase evidence of the entry point.
Correction: Preserve the current state, date every backup, and verify a candidate backup before restoring it.
Deleting only the visible spam
Why it fails: The attacker may retain an administrator account, scheduled task, modified plugin, or database payload.
Recommended Free Tools
Correction: Remove the persistence mechanism, replace compromised files, rotate credentials, and rescan.
Trusting one scanner as a complete verdict
Why it fails: Remote tools cannot read private files, while file scans may not inspect database or server persistence.
Correction: Correlate rendered-site, application, remote, database, and server evidence.
Requesting a blocklist review before cleanup
Why it fails: Crawlers can detect the same payload again and prolong the warning.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Correction: Submit review only after remediation and verification.
A maintenance routine that reduces future risk
After recovery, make the checks repeatable:
- Apply WordPress, theme, plugin, and supported server updates promptly.
- Remove unused extensions, themes, old staging copies, and abandoned installations.
- Review privileged users and authentication logs on a schedule.
- Keep off-account backups and test a restoration at planned intervals.
- Run periodic application and external scans, with alerts assigned to a person who can respond.
- Monitor outbound email, file changes, new database content, and unexpected redirects.
- Document the host, registrar, DNS, database, FTP/SFTP, and recovery contacts so a future incident does not begin with a lost credential.
The goal is not merely to obtain one clean scan. It is to establish that the public site, WordPress files, database, server, and credentials are clean enough to trust—and to make a repeat compromise harder to hide.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
