---
title: "WordPress Malware Removal: Complete Guide"
slug: "wordpress-malware-removal-guide"
description: "How to find and remove malware from your WordPress site. Covers backdoors, web shells, SEO spam, redirects, and database injections with step-by-step instructions."
date: 2026-02-15
author: "WP Vanguard Team"
category: "Security"
tags: ["wordpress-malware-removal", "wordpress-security", "malware", "malware-removal", "backdoors"]
featured_image: "/images/blog/wordpress-malware-removal-guide.jpg"
---

Your WordPress site is infected. Maybe your host suspended your account, [visitors are getting redirected to scam pages](/blog/signs-wordpress-site-hacked), or your security scanner found malicious code. Whatever tipped you off, you need to act fast.

This guide walks through the full malware removal process, from identifying what you are dealing with to verifying the cleanup is complete.

## Before You Start

**Back up your site first.** Even a hacked backup is better than no backup. If something goes wrong during cleanup, you need a fallback. Use `wp db export` via WP-CLI or download a full backup from your hosting control panel.

**Do not just reinstall WordPress and hope for the best.** Malware typically lives in plugin files, theme files, the uploads directory, and the database. A fresh WordPress install only replaces core files and misses most infections.

## Step 1: Identify the Type of Infection

Different malware requires different cleanup approaches. Here are the most common types found in WordPress sites:

### Backdoors

[Hidden PHP files that give attackers remote access](/blog/php-backdoors-in-wordpress). They often look like legitimate WordPress files with names like `wp-xmlrpc.php`, `class-wp-cache.php`, or `sunrise.php`. Inside, you will find obfuscated code using functions like `base64_decode`, `gzinflate`, `str_rot13`, and `preg_replace` with the `/e` modifier to execute encoded payloads.

### Web Shells

Full-featured admin panels uploaded by attackers. They provide file management, database access, and command execution through a browser interface. Common filenames include `c99.php`, `r57.php`, `wso.php`, or random names like `cache_2f8a.php`.

### SEO Spam Injections

Thousands of spam pages injected into your database targeting pharmaceutical, gambling, or Japanese keywords. These pages are often invisible to logged-in admins but show up in Google search results.

### Malicious Redirects

Code that sends your visitors to scam sites, but only under certain conditions: mobile users, visitors from search engines, or first-time visitors. This makes it hard to reproduce when you check your own site.

### Cryptominers

JavaScript injected into your pages that uses your visitors' CPU to mine cryptocurrency. Your site slows down, visitors' fans spin up, and you get the blame.

## Step 2: Scan Everything

A thorough scan is the difference between a clean site and one that gets reinfected next week.

**External scan:** Run a [free surface scan at WP Vanguard](https://wpvanguard.com) to check for blacklisting, known vulnerabilities, and visible malware.

**Server-level scan:** The [$1 deep scan](https://wpvanguard.com/pricing) examines every file on your server via SSH. It checks:
- File integrity against known clean versions of WordPress core, plugins, and themes
- PHP files in uploads directories (these should never exist)
- Obfuscated code patterns across all directories
- Database injections in posts, pages, options, and user tables
- Suspicious user accounts and application passwords
- Modified .htaccess files and cron jobs

Keep the scan results open. You will reference them throughout the cleanup.

## Step 3: Clean the Files

Work through these in order:

### 3a. Reinstall WordPress Core

Download a fresh copy of your WordPress version and replace all core files. Do not touch wp-content or wp-config.php. Run `wp core download --force --skip-content` via WP-CLI to replace any modified core files with clean originals.

### 3b. Check wp-config.php

Open wp-config.php and look for anything that should not be there. Legitimate wp-config.php contains database credentials, salts, table prefix, debug settings, and `ABSPATH`. Anything else is suspicious.

Watch for:
- `require_once` or `include` statements loading unknown files
- Obfuscated function calls (encoded strings being decoded and executed)
- Unfamiliar `define()` constants
- Code before the opening `<?php` tag or after the closing section

### 3c. Clean wp-content

This is where most malware lives.

**Plugins:** Delete all plugins and reinstall them from wordpress.org or the vendor. Do not try to clean infected plugin files manually. A fresh copy is always safer. Use `wp plugin delete` followed by `wp plugin install` for each plugin.

**Themes:** Same approach. Delete and reinstall. If you have a custom theme, compare every file against your version control or a known clean backup.

**Uploads:** Scan wp-content/uploads/ for PHP files. There should never be PHP files in your uploads directory. Delete any PHP files found. Also check for files with double extensions like `image.jpg.php` or suspicious names like `wp-tmp.php`.

**mu-plugins:** Check wp-content/mu-plugins/. Must-use plugins load automatically on every page. Attackers use this directory because the plugins cannot be deactivated from the admin panel.

### 3d. Check for Hidden Files

Look for recently modified PHP files (last 7 days), hidden .htaccess files in subdirectories, and files with 777 permissions. All of these are common indicators of compromise.

All the shell commands and database queries for this guide are available in well-commented gists:
- [Shell commands for malware detection and cleanup](https://gist.github.com/vapvarun/a46df73ac5b71b37bc108dbc767b8858)
- [SQL queries to find database injections](https://gist.github.com/vapvarun/3982af5ccf68e0b61c95b023295714a5)

## Step 4: Clean the Database

File cleanup is not enough. Many infections store payloads in the database.

### 4a. Check wp_options

Look for encoded payloads, injected scripts, and iframes in the options table. Also verify that `siteurl` and `home` values are correct. Attackers sometimes change these to redirect your entire site.

### 4b. Check wp_posts

Search for injected scripts, iframes, and hidden elements in your post content. For SEO spam, look for published posts created by user accounts you did not create.

### 4c. Check wp_users

Look for user accounts created in the last 30 days that you do not recognize. Delete any admin accounts you did not create.

All the SQL queries for these checks are available with detailed comments in our [database inspection gist](https://gist.github.com/vapvarun/3982af5ccf68e0b61c95b023295714a5).

## Step 5: Reset Credentials

After cleanup, reset everything:

1. **All WordPress user passwords** - especially admins
2. **Database password** - update in wp-config.php
3. **FTP/SSH passwords and keys**
4. **Hosting control panel password**
5. **Security salts** - generate new ones at api.wordpress.org/secret-key/1.1/salt/

## Step 6: Verify the Cleanup

Run another scan to confirm the site is clean. The same scan that found the malware should now come back clean.

Check these manually:
- Visit your site as a logged-out user
- Visit from a mobile device (mobile-only redirects are common)
- Search `site:yourdomain.com` in Google and look for spam pages
- Check Google Search Console for security warnings

## When to Call for Help

DIY cleanup works for simple infections. But if you are dealing with:
- [Persistent reinfection](/blog/fluent-forms-ninja-tables-supply-chain-backdoor) (malware keeps coming back)
- Obfuscated code you cannot decipher
- Database injections mixed with legitimate content
- Multiple backdoors across many directories

The [WP Vanguard cleanup service](https://wpvanguard.com/pricing) handles the full process for $49. First cleanup is free. The team has cleaned thousands of WordPress sites and knows where attackers hide payloads that DIY methods miss.

## Preventing Reinfection

Cleanup means nothing if you do not close the door.

- **Update everything immediately** and keep it updated going forward
- **Remove unused plugins and themes** - every inactive plugin is still an attack surface
- **Use strong, unique passwords** with two-factor authentication
- **Scan regularly** - a monthly [free scan](https://wpvanguard.com) catches new vulnerabilities before attackers find them
- **Keep backups** - daily database backups and weekly full-site backups stored off-server

The majority of reinfections happen because the original entry point was never identified and closed. Know how you were hacked, fix that specific issue, and your risk drops dramatically.