WordPress malware removal: what a full cleanup covers

WordPress malware removal means finding every piece of malicious code on the site, in the files and in the database, deleting it, and then closing the hole the attacker used to get in. A full cleanup has four parts: a backup before anything changes, a scan of files, database and user accounts, a clean reinstall of WordPress core, plugins and theme from official sources, and hardening so the same attack can't simply repeat. If you skip the last step, the malware usually comes back within days, because the door is still open. A security plugin can find a lot of it. It often misses hidden backdoors, and it can't tell you how the attacker got in.

This guide covers the signs, what each stage of a cleanup involves, how to fix a spam redirect, how to get Google's warning removed, and when it makes sense to pay someone.

Signs your WordPress site has malware

Most owners find out from someone else: a customer, Google or the host. The common signs are:

• Visitors get sent to spam, pharmacy or scam pages, often only on phones or only when they arrive from Google.
• Google shows "This site may be hacked" under your listing, or Chrome shows a red warning screen.
• A site:yourdomain.com search turns up pages in other languages or for products you don't sell.
• Your host suspends the account or emails you about malware, outgoing spam or unusual server load.
• Administrator accounts appear that nobody on your team created.
• PHP files show up in the uploads folder, or plugins change without anyone updating them.

WordPress.org's own FAQ on hacked sites lists similar indicators and suggests writing down what you saw and when before you start. That note helps you, your host and anyone you hire.

If you have just noticed the problem and need the first hour sorted, read our notes on how PHP malware gets into WordPress for the usual entry points.

Back up before you touch anything

Take a full backup of the files and the database before deleting anything, even though the backup contains the infection. There are three reasons. A cleanup sometimes removes something the site needs, and you want a way back. The infected copy is evidence of how the attack worked. And if your host's own backups are old or also infected, this snapshot may be the most complete copy of your content you have.

Download the backup to your own computer or offsite storage. Don't keep the only copy on the hacked server.

What a full cleanup covers

A thorough WordPress malware removal works through the site in a fixed order.

1. Compare files against clean copies. WordPress core, plugins from the official directory and many themes can be checked against the original versions. Anything changed or added is suspect.
2. Search the database. Attackers inject scripts and hidden links into posts, widgets and the wp_options table, and they add users directly to wp_users.
3. Remove what doesn't belong. Delete backdoors, injected code, spam pages and rogue admin accounts.
4. Reinstall from clean sources. Replace WordPress core, every plugin and the theme with fresh copies, keeping your settings and content.
5. Reset every secret. New passwords for WordPress, hosting, the database and SFTP, plus new WordPress keys and salts so old login cookies stop working.
6. Find the entry point. Server logs, where the host keeps them, and file dates usually point to an outdated plugin, a reused password or a stolen login.

Your posts, pages and media stay where they are, because the cleanup only touches code that doesn't belong.

Why plugin scans miss things

Free and paid security plugins are useful, and WordPress.org's FAQ names several. Their limit is that a scanner running inside an infected site can be fooled by it, and many scanners look for known signatures. Owners on Reddit describe running a plugin cleanup, seeing a clean report and finding the redirect back a week later.

The places scans most often miss:

• Must-use plugins in wp-content/mu-plugins, which load on every page and don't appear in the normal plugin list.
• PHP files in wp-content/uploads, a folder that should only hold images and documents.
• Scheduled tasks (WordPress cron or server cron) that download the malware again.
• Code stored in the database, which file scanners don't read.
• Extra copies of the site, such as an old staging folder on the same hosting account.

A plugin scan is a good first look. A full cleanup also checks those places by hand.

Fixing a spam redirect

Redirects are the most common symptom, and they are designed to hide. Many only fire for visitors on phones, for people arriving from Google, or once per visitor, so the owner who types the address directly sees a normal site.

Check these places:

Clear any caching plugin and your host's cache after the fix, then test from a phone on mobile data and from a Google search result.

Closing the way in

Removing malware without closing the entry point is the main reason infections return. After the cleanup:

• Update or replace any plugin or theme that was out of date, and delete the ones you don't use.
• Give each person the lowest role their work needs and keep as few administrators as possible.
• Turn on two-factor sign-in for every admin account.
• Turn off file editing in the WordPress dashboard and tighten file permissions.
• Keep automatic backups stored away from your server.

None of these guarantee the site won't be hacked again. They reduce the risk a lot, and ongoing updates keep it low. Our guide to what website maintenance includes covers that routine.

Getting Google's warning removed

Once the site is clean, open Google Search Console and check the Security issues report. If Google has flagged the site, it lists the problem there, and after you fix it you can request a review from the same report. Remove spam URLs from Google's index with the Removals tool, and make sure your real pages can still be crawled.

Google decides when the warning comes off and how pages rank afterward. Nobody can promise a date.

Doing it yourself or paying for a cleanup

You can handle it yourself if you're comfortable with SFTP, a database tool like phpMyAdmin and reading PHP well enough to spot code that doesn't belong. Small sites with a single, obvious infection are the best candidates.

Paying for a cleanup makes sense when the infection keeps coming back, the host has suspended the account, the site handles customer data or payments, or you can't afford days of trial and error. A professional cleanup should end with a report you can hand to your host.

What a cleanup should cost and include

Prices vary with the size of the site and how deep the infection goes. Whoever you hire, get a fixed price and a written scope before work starts, and check that it includes:

• A full backup first
• Files and database cleaned, with clean reinstalls of core, plugins and theme
• Rogue users removed, every password reset and new keys and salts set
• The likely entry point identified and addressed
• A Search Console review requested
• A written report of what was found and fixed

Our WordPress malware cleanup covers each of those. It starts from $249, paid in full before work starts, and usually takes one to three days. A Care plan from $79 a month adds updates, weekly backups and checks afterward. Both prices are on our pricing page.

If you're looking at a warning right now and aren't sure what you're dealing with, send us the site address and what you've seen, and we'll tell you what we'd check first.

FAQ

How do I remove malware from my WordPress site?

Back up the files and database, compare files against clean copies, search the database for injected code and unknown users, reinstall core, plugins and theme from official sources, reset every password along with the WordPress keys and salts, and fix the entry point. Then request a review in Google Search Console if Google flagged the site.

Can a free plugin remove WordPress malware?

Sometimes, for simple infections. Free scanners often miss backdoors in the uploads folder, must-use plugins, cron jobs and the database, and they don't find the entry point. If the malware returns after a plugin cleanup, something was missed.

Why does WordPress malware keep coming back?

Usually a backdoor survived the cleanup, or the way in is still open: an outdated plugin, a reused password or an unknown admin account. A scheduled task that downloads the code again is another common cause.

Will I lose content during a cleanup?

You shouldn't. A proper cleanup starts with a full backup and removes malicious code while leaving posts, pages and media in place. Infected plugins or themes are replaced with clean copies, keeping settings where possible.

How much does WordPress malware removal cost?

It depends on the site's size and how deep the infection goes. Ortha's WordPress cleanup starts from $249, paid in full before work starts, with a fixed price and written scope agreed first.