WordPress malware - how to detect it and clean it out

Malicious code on a site can work quietly for months - sending spam, injecting links and swapping bank details - before anyone notices. WordPress malware is nothing exotic: it is the most popular site engine in the world, so attackers’ bots scan it non-stop looking for out-of-date plugins. This piece is about the code itself: how to check whether a site is infected, where malware likes to hide and how to remove it. If the break-in has already gone further - foreign redirects, a red warning screen in Google, a suspension from your host - start with the broader recovery plan for a hacked site and come back here for the cleanup stage.

How to check whether a site has malware

From the fastest to the most thorough:

1. Online scanners - you enter the address and get a report. Google Safe Browsing shows whether the site is blacklisted; external scanners (something like Sucuri SiteCheck) check the visible part of the site against known signatures. The limitation: they only see what a visitor sees - malware hidden in files on the server can pass unnoticed
2. A security plugin with a scanner - installed in WordPress, it compares core and plugin files against the originals from the official repository and flags every difference. That is the best effort-to-result ratio for a non-technical owner
3. A scan on the hosting side - many control panels have a built-in file antivirus; sometimes the host itself emails a report listing infected files (take it seriously, it is not spam)
4. Search Console - the “Security issues” tab shows whether Google has already found something. Worth having connected before you need it

On top of that, three symptoms that show up with no tools at all: a sudden slowdown with no changes on your side, strange results when you search site:yourdomain.com in Google (pages you never created, often in foreign languages), and emails from customers saying “something odd came from your domain”.

Where malware hides

Knowing the hiding places saves hours of searching:

• Core and plugin files - injected lines at the beginning or end of PHP files. The easiest to detect (they differ from the original) and the easiest to fix: WordPress files and plugins from the repository can simply be overwritten with fresh copies from official sources
• The uploads folder - it should contain media only (images, PDFs). Any .php file in wp-content/uploads is almost certainly an intruder’s back door
• The theme - especially functions.php; modifications are often disguised as innocent-looking functions
• The database - scripts injected into post content, unfamiliar administrator accounts, scheduled tasks (cron) that rebuild the infection after every cleanup
• wp-config.php and .htaccess - entries redirecting traffic or pulling in code from outside

This is why “I cleaned what the scanner found” so often ends with a relapse a week later: the tool finds the injections in files, but the back door in uploads or the task in the database survives and rebuilds the whole thing.

Removal - the order that works

1. Back up the current state (yes, the infected one) - a reference point and material for analysis if something goes wrong
2. Change every password - WordPress admin, FTP, hosting, database. Without this, cleaning is bailing out a boat without patching the hole
3. Overwrite core and plugins with fresh copies - WordPress from wordpress.org (without the wp-content folder), plugins again from the repository. Do not overwrite plugins bought outside the repository with anything found “on the internet” - only from your account with their vendor; pirated copies of premium plugins are, incidentally, one of the more common routes of infection
4. Manual review of the hiding places - uploads for PHP files, the theme’s functions.php, user accounts, scheduled tasks. Here a tool is not enough, and this is usually the point at which the job is worth handing to someone who does it regularly
5. Update everything and delete unused plugins and themes - the hole they came through is almost certainly sitting in something out of date. How to set a safe update rhythm I lay out in the checklist: a staging copy, updates in small batches and a check of the key pages after each one
6. Rescan and submit for review in Search Console if Google has already flagged the site - the warning usually disappears a few days after a clean scan

What helps: after the cleanup, leave a scanner running with email alerts plus file change monitoring. A relapse in the first few weeks is a classic - better to hear about it from an email an hour later than from Google a month later. For clients on ongoing support that monitoring runs around the clock.

Frequently asked questions

Is a free scanner enough? For detection - often yes. For removal - only halfway: tools clean injections in core files well, but handle back doors in uploads, the theme and the database badly. Treat a scan as a diagnosis, not a full course of treatment.

Does malware on my site put my customers at risk? It can - some infections target visitors specifically (redirects to fake sites, scripts injected into forms). That is why you do not leave an infected site running “because it works somehow” - every extra day increases both the risk to people and the damage in Google.

What does professional cleanup cost? It depends on the scale: a fresh infection with a good backup is a matter of hours, a neglected one a day or two. After reviewing the site I give a concrete figure in writing, before any work starts.

Would rather not watch over it every month yourself? I take sites and stores under ongoing care - backups, updates, monitoring, and priority when something breaks. Tell me what you run and I will send back scope and price.