Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsTo remove malware from a WordPress site, contain it first, preserve a backup, scan with two independent tools, replace compromised code with clean copies, clean malicious database content, remove unauthorized administrators, rotate every credential and WordPress salts, then rescan and harden the installation. Cleaning files on the live site without a recoverable copy can destroy evidence and leave a back door behind.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The procedure below is designed for a site owner or administrator working methodically. WordPress paths and labels can vary slightly by hosting provider and version, but the sequence matters: containment and evidence first, code replacement and content cleanup next, credential invalidation before verification, and hardening only after the site is demonstrably clean.
As an Amazon Associate I earn from qualifying purchases.
What to do immediately after discovering malware
1. Take the site out of public service
Enable your host’s maintenance mode or otherwise block normal visitors before investigating. A compromised page can deliver malicious scripts, redirect visitors, create spam pages, or expose data while you work. If your host offers a temporary site-level isolation switch, use it rather than deleting files or changing DNS in a panic. Tell your team that the site is under maintenance so nobody logs in and changes evidence during the cleanup.
Do not use the infected WordPress dashboard as your only control panel. Malware can alter what the dashboard displays, intercept passwords, or hide administrator accounts. Prefer your hosting control panel, an out-of-band file manager, or SFTP access for the first containment actions.
#1 Best Overall
2. Preserve the infected state before changing it
Create two separate backups before deleting or overwriting anything:
- A complete copy of the WordPress files, including
wp-content, the root files, andwp-config.php. - A database export containing posts, pages, comments, users, settings, widgets, and theme options.
Label these copies with the date and time and store at least one outside the server. This is not a clean backup; it is an evidence copy that lets you compare files, recover legitimate content, or give a professional responder the original state. Do not restore it to production unless it has been examined and cleaned.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Record symptoms and access details
Write down the first warning, the affected URLs, unexpected redirects, new users, altered posts, browser or hosting alerts, and the last known clean date. Note which people and systems can currently access the site. This inventory prevents a symptom from being mistaken for the entire infection and helps identify a stolen credential as the entry point.
Scan with two independent tools
Why one scan is not enough
Different scanners use different signatures and heuristics. A clean result from one tool therefore does not establish that every back door, injected option, or obfuscated file is gone. Run two materially different checks and compare their findings. Wordfence and Sucuri SiteCheck are commonly used examples; follow each service’s current instructions and treat their output as leads to verify manually, not as permission to skip the rest of the workflow.
Build an infection inventory
Before cleaning, copy the scanner findings into a simple table. Include the full file path or database location, the suspected infection type, the scanner that reported it, and whether the item is a WordPress core file, plugin, theme, upload, or user-generated record.
| Record | What to capture | Why it matters |
|---|---|---|
| File path | Exact path, including directories and filename | Lets you verify the replacement and detect related files in the same directory |
| Database location | Table, post or option identifier, and a short description of the injected text | Prevents legitimate content from being removed while the malicious fragment is deleted |
| Finding source | Which scanner reported it and the date of the scan | Shows disagreements that need manual review |
| Disposition | Replaced, deleted, edited, retained for investigation, or unresolved | Creates an audit trail for the final verification |
Do not edit a suspicious file merely to make a scanner turn green. First determine whether it belongs to a replaceable component, a legitimate customization, or an unknown object that should be removed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Replace WordPress code with clean copies
Replacing code is safer than trying to remove an unfamiliar line from an infected file. A back door may be split across several files, disguised with obfuscation, or hidden in code that looks harmless. Download fresh copies from wordpress.org for WordPress itself and from the original developer for each plugin and theme. Never treat files already on the server as trustworthy.
Replace the WordPress core
- Identify the installed WordPress version from a trusted hosting or deployment record, not solely from the infected dashboard.
- Obtain a clean package for that version, or a newer supported version if your update plan permits it.
- Overwrite the core directories and root files from the clean package.
- Keep the site’s
wp-content/directory andwp-config.phpout of a blanket overwrite. They contain site-specific content and settings that must be inspected separately.
Core replacement removes modifications to standard WordPress files, but it does not clean plugins, themes, uploads, database records, or configuration files. Those areas require their own checks.
Replace every plugin
List every installed plugin, including inactive ones. For each plugin you recognize, remove its existing directory and install a clean copy from wordpress.org or the original developer. Replacing rather than merging files prevents an extra malicious file from surviving inside the plugin directory. If you do not recognize a plugin or no longer need it, delete it instead of leaving it inactive.
Do not preserve an altered plugin file simply because it contains a local tweak. Record the change, install the clean release, and reapply only a documented customization after the site is verified. An undocumented modification is indistinguishable from a back door during incident response.
Replace the active theme and remove unused themes
Install a clean copy of the active theme from its original developer. Check child themes and any custom theme directories separately; malware is often hidden in a rarely viewed template or a theme that is no longer active. Delete themes you do not recognize or no longer use after confirming that the site does not depend on them.
If the site uses a custom theme, obtain a known-good deployment from version control or the developer. Do not assume that an attractive front end proves the theme files are safe.
Use this replacement map
| Component | Clean source | What to do with the server copy |
|---|---|---|
| WordPress core | wordpress.org | Overwrite core files and directories; exclude wp-content/ and wp-config.php |
| Recognized plugin | wordpress.org or its original developer | Remove the existing plugin directory and install a clean copy |
| Recognized theme | Its original developer | Replace the theme directory with a clean copy |
| Unknown plugin or theme | None required | Delete it after confirming it is not required by the site |
| Custom code | Known-good repository or developer archive | Compare against the trusted version; do not retain unexplained changes |
Inspect uploads and other file locations
Check wp-content/uploads for executable code
The uploads directory should contain media, not PHP programs. Walk through its subdirectories and look for PHP files or other scripts that do not belong with the site’s images, audio, video, or documents. A PHP file in uploads is a high-priority finding, but its presence alone is not proof of the entire infection; preserve the path in your inventory, then remove it if it is not a documented part of the site’s design.
Search suspicious files for obfuscated constructs such as eval( and base64 strings. Those patterns can occur in legitimate software, so use the file’s location, purpose, and comparison with a clean copy before deleting code. Do not rely on a single keyword search as a complete malware test.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Review writable directories and unexpected files
Compare the remaining file tree with a clean WordPress installation and your site’s documented plugins, themes, and media. Pay particular attention to recently modified files, root-level files that are not part of your deployment, and files in directories intended only for uploads or cache data. Keep a copy of anything uncertain outside the server until its purpose is established.
Clean malicious database content without deleting legitimate work
File replacement cannot remove injected HTML, JavaScript, redirects, or hidden users stored in the database. Work from your database backup and make one controlled change at a time. Search posts, widgets, theme options, and the wp_options table for:
- Unexpected iframes or script blocks
- Obfuscated
base64strings - Unexpected
eval(text - Domains that the site owner does not recognize
- New options, widgets, or content that appeared during the incident
Inspect the complete record around a match before editing it. A legitimate article can contain an iframe, a code example, or a domain that looks unfamiliar to a scanner. Remove only the injected fragment and preserve the surrounding title, body, formatting, and metadata. If an entire record is malicious, delete that record and note the action in your inventory.
Database cleanup may require serialized WordPress data to be handled carefully. If you are not certain how a setting is structured, export it, make a copy, and use a WordPress-aware method rather than blindly replacing strings. Broken serialization can disable the site even when the malicious text is gone.
Remove unauthorized administrator accounts
Open Users in the WordPress administration area and review every administrator, editor, and other privileged account. Compare the list with your access inventory and your team roster. Delete accounts no one can explain, and review unfamiliar email addresses, usernames, roles, and creation dates. An attacker can recreate an account after cleanup if a legitimate administrator’s password or session remains valid, so this step must be paired with credential rotation.
Do not delete the only legitimate administrator before confirming that another trusted account can manage the site. Preserve the account record in your incident notes before removal, especially if the site handles personal data or payments.
Rotate every credential and regenerate WordPress salts
Assume that credentials used on or near the compromised site may have been exposed. Change them from a clean device, beginning with the hosting account and then working through every path into the site:
- Hosting control-panel account
- All WordPress administrator and privileged user passwords
- FTP and SFTP accounts
- Database user passwords
- Any deployment, backup, monitoring, API, or email credentials stored in the site configuration
Use a different strong password for each account and remove accounts that are no longer required. If your host supports multi-factor authentication, enable it for the control panel and WordPress administrators after the password change.
Recommended Free Tools
Regenerate the WordPress salts
WordPress salts in wp-config.php help protect authentication cookies. Replace all existing salt and authentication-key values with newly generated values from a trusted source, preserving the PHP syntax and the setting names. Regenerating salts invalidates existing WordPress sessions, including an attacker’s stolen login cookie, so every user will need to sign in again.
Changing salts does not replace a password change. It invalidates sessions, while password rotation prevents the same stolen password from being used to create a new session.
Verify that the cleanup worked
Run a fresh two-tool scan
After code replacement, database cleanup, account removal, password changes, and salt regeneration, repeat scans with the same two independent tools. Compare the new results with your infection inventory. A clean result should be accompanied by a manual review of every previously flagged path, not just a green badge.
Test the site as a visitor and administrator
- Load the home page, representative posts, search, category pages, media, forms, and any commerce or membership paths.
- Check several URLs in a private browser window for redirects, pop-ups, injected links, or unexpected downloads.
- Sign in with a newly rotated administrator account and confirm that unknown users, plugins, themes, and settings are gone.
- Review server and hosting logs for fresh requests to deleted files or repeated login attempts.
If any malicious behavior returns, take the site offline again and compare the new file and database changes with your preserved evidence. A recurring change after a clean replacement usually indicates an unrotated credential, a surviving back door, or another compromised system that still has write access.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Handle search-engine warnings
If Google or another search engine flagged the site, wait until the cleanup and verification are complete, then use that service’s review or reconsideration process. Describe the corrective actions accurately and monitor the site after the warning is lifted. Submitting a review before removing the infection can prolong the warning and expose visitors again.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Harden the site after it is clean
Hardening is the final phase, not a substitute for eradication. Once the rescan is clean:
- Update WordPress, PHP, and every retained plugin and theme.
- Remove unused plugins and themes rather than leaving them inactive.
- Install and configure a firewall or security plugin appropriate to the site’s hosting environment.
- Limit administrator access to people who need it and review the list regularly.
- Keep automated, tested backups separate from the web server.
- Document the clean baseline: WordPress version, plugin and theme list, administrator accounts, and deployment date.
Updates close known weaknesses, but they do not prove that an old infection has been removed. Likewise, a firewall can reduce future attacks while a stolen hosting password continues to give an attacker direct access. Keep both software maintenance and access control in your routine.
Common failure modes and their fixes
Cleaning only the homepage
Symptom: The visible page looks normal, but scanners continue to find malware or visitors are redirected from other URLs.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFix: Treat the whole installation as potentially exposed. Replace core, plugins, and themes; inspect uploads; search the database; and review users and credentials.
Deleting a flagged file without replacing the component
Symptom: The same file or a nearby back door reappears.
Fix: Remove and reinstall the entire affected plugin or theme from a clean source. A single edited file can leave companion files or altered code behind.
Skipping the database
Symptom: The site still shows spam links, hidden redirects, or unfamiliar domains after all visible files were replaced.
Fix: Search posts, widgets, theme options, and wp_options; remove only confirmed injected fragments and preserve legitimate content.
Changing only the WordPress password
Symptom: The site is clean briefly, then an attacker returns or a new administrator appears.
Fix: Rotate hosting, FTP/SFTP, database, deployment, and other stored credentials, then regenerate the WordPress salts to invalidate stolen sessions.
Restoring an old backup blindly
Symptom: Malware returns immediately after restoration.
Fix: Treat every pre-incident backup as untrusted until its files, database, users, and credentials have been checked. A backup is useful for recovery, but age alone does not make it clean.
When professional incident response is the safer choice
Consider a qualified WordPress security professional when the site processes payments or personal data, the infection spans many sites on one hosting account, you cannot establish a known-good baseline, or the malware returns after the complete workflow. Preserve the infected files and database, list the actions already taken, and provide the timeline and scanner findings. Do not keep making undocumented edits while waiting for help; they can destroy evidence and make the entry point harder to identify.
For a small personal site, careful containment, backups, clean component replacement, database inspection, account review, credential rotation, and verification may be manageable in-house. The deciding factor is not the site’s size alone but whether you can prove what changed and confirm that no trusted access path remains compromised.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
