What this problem looks like
Malware hides in uploads as fake images, in mu-plugins, in theme functions.php, and in wp_options as rogue admin users or redirect URLs. Automated scanners help but manual review catches custom backdoors.
Cleanup without closing the entry point leads to reinfection. Update everything, remove unused plugins, and harden wp-config after files are clean.
Step 1: Backup and enable maintenance mode
Download the full site and database export. Use a maintenance plugin or simple index.html holding page so visitors are not exposed to malicious redirects during cleanup.
Step 2: Find suspicious files in wp-content
Search for PHP inside uploads, unknown files in mu-plugins, and recently modified theme files. Common malware patterns use eval, gzinflate, str_rot13, or long base64 strings.
find wp-content/uploads -name "*.php"
grep -r "eval(" wp-content --include="*.php"
grep -r "base64_decode" wp-content --include="*.php"Step 3: Inspect .htaccess for injected redirects
Open root .htaccess and look for unfamiliar RewriteRule lines sending traffic to external domains. Compare with a clean WordPress .htaccess and remove unknown blocks.
Step 4: Clean the database
In phpMyAdmin, search wp_options for spam domains in option_value. Check wp_users for unknown administrator accounts. Search wp_posts for iframe and script injections in post_content.
wp user list --role=administrator
wp option list --search="*spam-domain*"Step 5: Harden after cleanup
Update WordPress core, themes, and plugins. Remove unused extensions. Rotate salts, passwords, and SFTP keys. Install two-factor authentication and disable XML-RPC if not needed.
When to stop DIY and hire help
Manual malware removal is slow and easy to get wrong on shops with customer data. BugShield cleans hacked WordPress sites from £99.99 with confirmed pricing and reinfection checks.