How to Secure WordPress After Malware Removal

A cleanup removes the infection but not the reason it happened. The weeks after matter most. Closing the way in and cutting the site's attack surface decide whether you're back here in six months.

1. Close the way in

Identify the likely entry point, from logs, plugin versions and update history. Typical findings: an outdated or abandoned plugin, a nulled theme, a weak or reused administrator password, or an infected neighbour on the same hosting account. Whatever it was, fix it explicitly, not as a side effect of "updating everything".

2. Update and prune

• Update WordPress core, plugins and themes.
• Delete everything unused, including inactive plugins and default themes you don't need.
• Replace abandoned plugins (no updates for a long time) with maintained alternatives.
• Never install pirated or "nulled" components.

3. Fix accounts

• Keep the number of administrators as small as possible and give everyone else the least role they need.
• Unique, strong passwords from a password manager, and two-factor authentication for administrators.
• Remove accounts for former staff, agencies and tools.

4. Rotate credentials and keys

If you haven't already: WordPress, hosting, SFTP/SSH, database and email passwords, plus the salts in wp-config.php. See Hacked wp-config.php: What Site Owners Should Check.

5. Harden files and configuration

• Turn off the dashboard file editor with define( 'DISALLOW_FILE_EDIT', true );.
• Stop PHP from executing inside wp-content/uploads where your server allows.
• Use restrictive file permissions as your host recommends.
• Serve the site over HTTPS and review basic security headers.
• Run a current, supported PHP version.

6. Backups you can trust

Take a new backup of the clean site, store backups off the server and test a restore. Keep one copy that predates nothing suspicious. See Why Restoring a Backup May Not Fix a Hacked WordPress Site.

7. Monitor

• Get alerts for new administrators and unexpected file changes.
• Re-run integrity checks (wp core verify-checksums) after updates.
• Watch Search Console's Security issues report and your host's notices.
• Check the site under the original symptom conditions weekly for a month.

8. Decide who maintains it

Most reinfections happen because updates and checks lapse again. If nobody on your team owns that, ongoing WordPress security covers update oversight, regular security checks and backup verification from $79/month. A one-off review of the points above is security hardening. A longer baseline for businesses: WordPress Security Checklist for Small Businesses.