A site that is clean for a few days and infected again almost always has one of a short list of causes. Reinfection is rarely bad luck. It means something from the original compromise survived, or the way in is still open.
1. A backdoor survived the cleanup
Attackers plant access that doesn't depend on the original vulnerability. If you remove the visible malware but not the access, they return. The common hiding places are covered in WordPress Backdoors: How Reinfection Happens and on the backdoor removal page.
2. The vulnerable plugin or theme is still there
If the site was entered through an outdated plugin and the plugin is still installed, an automated scan will find it again. Cleaning without updating or removing the vulnerable component is like mopping the floor with the tap running. Abandoned plugins that will never get a fix should be replaced.
3. Stolen credentials are still valid
Changing the WordPress admin password isn't enough. Hosting panel, SFTP/SSH, database and email credentials may all be known to the attacker, along with application passwords and active sessions. Rotate them all from a clean device, and replace the salts to kill existing sessions.
4. Another site on the same account is infected
On shared hosting, or when one hosting account holds several WordPress installs, an infected neighbour can reinfect the clean one. Old staging copies, abandoned test sites and forgotten subdomains are typical culprits. All sites in the account need to be cleaned together.
5. A scheduled task reinstalls the infection
WordPress cron can be used to re-download or re-create the malware at intervals. Review scheduled events for anything you don't recognise.
6. Malicious content in the database
Replacing files doesn't touch code stored in posts, options or widgets. A file-only cleanup leaves the database part running.
7. The site was restored from an infected backup
If the backup already contained the backdoor, restoring it reinstates the infection. See Why Restoring a Backup May Not Fix a Hacked WordPress Site.
8. Nulled or untrusted software
Pirated ("nulled") themes and plugins are a frequent source of built-in malware. Replace them with licensed or official copies.
How to break the loop
- Take a copy, then clean files, database, users and scheduled tasks. The WordPress Malware Cleanup Checklist lists what to check.
- Update or replace every vulnerable and abandoned component.
- Rotate all credentials and salts from a clean computer.
- Clean every site in the hosting account, not only the visible one.
- Harden afterwards. See How to Secure WordPress After Malware Removal.
- Monitor for a few weeks. Reinfection often shows within days.
If it keeps returning, we investigate the root cause as part of malware removal, from $199.
Further reading
Dealing with this on a live site?
Send us the details and we'll tell you what we'd do and what it would cost.