So your WordPress site got hit. Maybe Google slapped a «This site may be hacked» warning on it, or visitors started complaining about weird redirects to sketchy casinos. Whatever the symptom, you need to disinfect WordPress from malware now, not tomorrow. Every hour it stays infected, Google deindexes more pages and your hosting provider starts sniffing around.
I’ve cleaned dozens of infected WordPress installs, from tiny blogs to WooCommerce stores pushing six figures a month. The truth nobody tells you: there’s no magic plugin button that fixes everything. You need a plan, patience, and a willingness to nuke things that look off even if you’re not 100% sure.
First, Figure Out If You’re Actually Infected
Before you start disinfecting anything, confirm the infection. Symptoms of WordPress malware include unexpected admin users you didn’t create, random eval(base64_decode(…)) strings in your theme files, sudden spikes in outgoing email, or a site that loads a completely different page for Googlebot than for you.
Run a quick check with VirusTotal on your homepage URL and use Sucuri SiteCheck (it’s free) to scan for known malware signatures. Neither is bulletproof, but they catch the lazy stuff fast.
If the scan comes back clean and you still see weird behavior, you’re likely dealing with a cloaked backdoor that only fires for specific user agents or IPs. That’s when manual inspection becomes mandatory.
Security Plugins Do the Heavy Lifting (But Not All of It)
The fastest way to disinfect WordPress from malware is still a reputable security plugin. Wordfence and Sucuri Security are the two I trust most in 2026. Wordfence’s free tier includes a solid malware scanner, and the paid version adds real-time firewall rules that block reinfection while you clean.
Sucuri’s plugin is lighter and pairs well with their server-side firewall if you pay for it. Both will flag modified core files, suspicious PHP in uploads, and known malicious signatures.
Here’s the catch: plugins only remove what they recognize. If the attacker used a custom obfuscated payload, the scanner might miss it. Always cross-check the results manually.
Manually Scanning Your WordPress Files for Backdoors
If you want to truly disinfect WordPress from malware, you need to look at the code yourself at some point. Connect via SFTP or SSH and start hunting.
Focus on these spots first, because they’re where 90% of infections hide:
- /wp-content/uploads/ — there should never be a .php file here. If you find one, delete it immediately.
- /wp-content/themes/your-theme/functions.php — look for base64, gzinflate, or eval strings.
- /wp-includes/ — compare against a fresh WordPress download; any extra file is suspicious.
- /wp-config.php — check for injected require statements at the top.
- .htaccess files — attackers love adding redirect rules here.
A quick trick: download a clean copy of WordPress core and your theme from the official repos, then diff the folders. Any file that doesn’t match is either modified or added — both bad signs.
When to Restore a Backup (And When Not To)
Restoring a backup is the nuclear option for how to disinfect WordPress from malware. It works, but only if you’re sure the backup predates the infection.
Here’s the trap: most people find out they’re hacked weeks after the fact. If you restore a backup from last month and the malware was already sitting there dormant, you’ve just wasted hours and lost content for nothing.
My rule: only restore if you have a backup from before the first suspicious activity in your logs. Otherwise, clean manually. And once you’re clean, take a fresh backup immediately — before you touch anything else.
Also, if the hack came through a compromised admin account, restoring won’t help. The attacker still has credentials. Change every password, rotate every API key, and enable two-factor authentication before you even think about restoring.
Why Malware Keeps Coming Back After You Clean It
Reinfection is the number one reason people give up and just rebuild the site. It happens because you removed the payload but missed the entry point. Common culprits:
- An outdated plugin with a known CVE that the attacker keeps exploiting.
- A rogue admin user hidden in the wp_users table.
- A scheduled cron job that re-downloads the malware every few hours.
- Compromised FTP or SSH credentials.
Audit your users table with phpMyAdmin or WP-CLI (wp user list). Look for admins with weird email domains or registration dates that match the infection window. Delete them without hesitation.
Then check wp_options for suspicious cron entries and wp_postmeta for injected shortcodes that pull remote content.
Hardening Your Site So This Never Happens Again
Cleaning WordPress malware is half the battle. The other half is making sure the same hole doesn’t get exploited twice. These steps aren’t optional if you run anything commercial.
- Force HTTPS everywhere and add HSTS headers. Plain HTTP leaks session cookies to anyone on the same Wi-Fi.
- Set file permissions correctly: 644 for files, 755 for folders, 600 for wp-config.php. Nothing should be 777.
- Disable file editing in the dashboard by adding define(‘DISALLOW_FILE_EDIT’, true); to wp-config.php.
- Only install plugins and themes from the official WordPress repository or from developers you actually trust. Nulled plugins are malware delivery vehicles, full stop.
- Use a password manager and stop reusing credentials. A single leaked password from another site is enough to compromise your entire install.
- Set up automatic daily backups stored off-server. If your host gets wiped, you still have a copy.
Real Talk: Sometimes You Just Rebuild
I’ll be blunt. If your site has been infected for months, has thousands of files, and you’re finding new backdoors every day, rebuilding from scratch is faster and safer than trying to disinfect WordPress from malware piece by piece.
Export your content, export your users, and rebuild on a fresh install with updated plugins and a hardened configuration. It feels like defeat, but it’s actually the professional move. I’ve seen agencies waste three weeks chasing backdoors that a rebuild would have solved in two days.
The one thing you can’t skip either way: tell Google. Use the Search Console security issues report and submit a reconsideration request once you’re clean. Otherwise the red warning stays up even after the malware is gone, and your traffic keeps bleeding.
