How to remove WordPress malware manually

What this problem looks like

Malware hides in uploads as fake images, in mu-plugins, in theme functions.php, and in wp_options as rogue admin users or redirect URLs. Automated scanners help but manual review catches custom backdoors.

Cleanup without closing the entry point leads to reinfection. Update everything, remove unused plugins, and harden wp-config.php after files are clean.

Step 1: Backup and enable maintenance mode

Download the full site and database export. Use a maintenance plugin or simple index.html holding page so visitors are not exposed to malicious redirects during cleanup.

Step 2: Find suspicious files in wp-content

Search for PHP inside wp-content/uploads, unknown files in mu-plugins, and recently modified theme files. Common malware patterns use eval, gzinflate, str_rot13, or long base64 strings.

Only run the commands below if you have SSH access to the server.

bash

find wp-content/uploads -name "*.php"
grep -r "eval(" wp-content --include="*.php"
grep -r "base64_decode" wp-content --include="*.php"

Step 3: Inspect .htaccess for injected redirects

Find .htaccess in your site root, next to wp-admin and wp-content. Open it and look for unfamiliar RewriteRule lines sending traffic to external domains. Compare with a clean WordPress .htaccess and remove unknown blocks.

Step 4: Clean the database

In phpMyAdmin, search wp_options for spam domains in option_value. Check wp_users for unknown administrator accounts. Search wp_posts for iframe and script injections in post_content.

If your host offers SSH access, you can also list admin users and search options with WP-CLI from the WordPress root:

bash

wp user list --role=administrator
wp option list --search="*spam-domain*"

Step 5: Harden after cleanup

Update WordPress core, themes, and plugins. Remove unused extensions. Rotate salts, passwords, and SFTP keys. Install two-factor authentication and disable XML-RPC if not needed.

When to stop DIY and hire help

Manual malware removal is slow and easy to get wrong on shops with customer data. BugShield cleans hacked WordPress sites at a confirmed fixed price with reinfection checks.

Questions answered

Manual WordPress malware removal FAQs

Answers about finding malicious files, cleaning backdoors, protecting evidence, resetting access, and preventing reinfection.

Will reinstalling WordPress remove malware?

Reinstalling core helps wp-admin and wp-includes but ignores infected plugins, themes, uploads, and database rows.

How did attackers get in?

Weak passwords, outdated plugins, nulled themes, and stolen FTP credentials are common. Fix the entry point after cleanup.

Should I use a malware scanner plugin?

Scanners help find known signatures but miss custom backdoors. Combine scans with manual file review.

When is manual cleanup not enough?

When reinfection happens within 24 hours, rootkits exist outside WordPress, or you need Google blacklist removal. Hire professional cleanup.

What are common signs of WordPress malware?

Unexpected redirects, new administrators, search spam, changed files, disabled security tools, unfamiliar scheduled tasks, outbound email spikes, and browser or Google warnings all need investigation.

Should I take a backup before removing WordPress malware?

Yes. Preserve a private evidence copy before cleaning, even if it is infected. Keep it separate from restore points you would use to return the site to service.

Should I put a hacked WordPress site into maintenance mode?

Restrict public access when the site redirects visitors, steals information, sends malware, or exposes customer data. Keep a secure route available for the cleanup team.

How do I find hidden WordPress malware and backdoors?

Compare core with official checksums, inspect recent file changes, search uploads for PHP, review mu-plugins and scheduled tasks, and examine unfamiliar administrator and application-password records.

Which passwords should I change after WordPress malware removal?

Change WordPress, hosting, database, SFTP, SSH, email, CDN, registrar, and API credentials that could have been exposed, then rotate salts and revoke active sessions.

Why does WordPress malware return after cleanup?

A backdoor, vulnerable extension, stolen credential, malicious scheduled task, infected neighbouring site, or compromised hosting account may still provide access.

Keep troubleshooting

Learn how to remove WordPress malware manually.