WordPress Malware Cleanup Checklist

A technical checklist for the person doing the cleanup. It covers the layers a thorough cleanup has to check, in a sensible order. For the first response in a panic, use the emergency checklist instead.

Prepare

• Take a full copy of files and the databaseKeep it untouched. It's your evidence and your fallback.
• Put the site in maintenance mode or offline if it harms visitorsShort outage beats infecting customers.
• Record symptoms, dates and what the host reportedYou'll verify against these afterwards.

Core, plugins and themes

• Verify core files against the official releasewp core verify-checksums
• Verify plugin files where possiblewp plugin verify-checksums --all (wordpress.org plugins)
• Replace modified core, plugin and theme files with clean copiesReinstall rather than hand-edit.
• Delete unused and nulled plugins and themesIncluding inactive ones.
• Update everything that remainsA known-vulnerable component is the likely way in.

Files and folders

• No PHP files in wp-content/uploadsfind wp-content/uploads -type f -name "*.php"
• Review mu-plugins and drop-in filesAnything you didn't add.
• Review recently modified filesfind . -type f -mtime -14, then explain each.
• Check .htaccess and the site root for unknown files and rulesRewrite rules that reference referrers or user agents.
• Check wp-config.phpSee Hacked wp-config.php.

Database

• Search posts, widgets and options for script tags and unknown domainsContent, not just files, can carry malware.
• Check siteurl and home optionswp option get siteurl, wp option get home
• Review spam posts and pagesRemove them only after you've removed whatever creates them.

Users and credentials

• Review every administrator and privileged userwp user list --role=administrator. See unknown admin users.
• Revoke unknown application passwordsUnder each user's profile.
• Rotate WordPress, hosting, SFTP/SSH, database and email credentialsFrom a clean computer.
• Replace salts and keys in wp-config.phpEnds existing sessions.

Scheduled tasks and persistence

• List and review WordPress cron eventswp cron event list
• Check for hidden or generated usersCompare the dashboard list with the database table.
• Look at other sites on the same hosting accountCross-infection restores the malware.

Verify

• Re-test the original symptom under the same conditionsMobile, search-referred and first-time visits for redirects.
• Re-run the integrity checksCore, plugins, uploads.
• Check what search engines seeURL Inspection in Search Console.
• Confirm backups work and don't contain the infectionTake a new clean backup.

After

• Fix the likely entry pointPlugin, password or host-level cause.
• HardenSee securing WordPress after malware removal.
• Monitor for at least a few weeksReinfection often shows in days.

Doing this on a live business site is easier with a second pair of eyes. Malware removal follows this process and starts from $199. For the end-to-end picture, see the The Complete WordPress Hacked Site Recovery Guide.