WordPress malware removal: find it, remove it, and stop it coming back
If your WordPress site is infected, deleting the file a scanner flagged rarely ends it. We clean the whole compromise: malicious code, backdoors, rogue administrators and database injections, then work out how the attacker got in.
Malware removal starts from $199. The price depends on site size, plugin count, hosting setup and how deep the infection goes.
Signs of an infected WordPress site
No single sign proves malware, but any of these deserves a proper look. For a longer diagnostic, see how to tell if your WordPress site has been hacked.
Redirects and popups
Visitors sent to other sites, often only on mobile or only from Google. Ads or popups you didn't add.
Spam content in search
Pages or titles in Google for pharmacy, casino or foreign-language keywords that you never published.
Warnings and suspensions
A browser warning, a Google security label or a message from your host about malware.
Unknown users and files
Administrators you didn't create, or PHP files in the uploads folder and recently changed core files.
Unexplained load
Sudden CPU spikes, slow pages, or outgoing spam email from the account.
It came back
You cleaned something and the same symptoms returned. That usually means a backdoor was left behind.
Why deleting the visible malware isn't enough
Malware that shows up on the front end is often the least important part. Attackers usually plant ways to come back, which is called persistence.
| What you see | What may be behind it |
|---|---|
| A flagged file, removed | A second copy elsewhere, or a small script that rewrites it |
| Redirects stop after a cleanup | A conditional rule or injected script that only fires for some visitors |
| Passwords changed | A hidden administrator, or a stolen session or application password still valid |
| Plugin reinstalled | The vulnerable plugin is still there, or the attacker's copy sits in mu-plugins |
| Files look clean | Malicious content stored in the database, such as options, posts or widgets |
| Site clean for a week | A scheduled task that quietly reinstalls the infection |
The same entry point that let the attacker in once is usually still open. That is why we treat root cause and hardening as part of the cleanup, not an extra. See backdoor removal for how hidden access is found.
How we investigate and clean an infected site
Scope and preserve
We note the symptoms, hosting setup and plugins in use, and take a copy of files and database before touching anything. It is the record of what was there, and it's what we investigate.
Investigate
WordPress core files are compared against the official release. Plugins and themes are checked for unexpected changes. We review the uploads folder,
mu-plugins,.htaccess,wp-config.php, the database, users and scheduled tasks, plus any host logs available.Remove malicious code
Injected code, spam content and malicious files are removed. Modified core, plugin and theme files are replaced with clean copies where possible instead of patched by hand.
Review accounts and credentials
We look at every administrator and privileged user, application passwords and keys, then rotate what has to be rotated, including the salts that invalidate existing sessions.
Detect backdoors
We look specifically for persistence: hidden users, planted PHP files, modified plugins, scheduled tasks and database-resident code, because a missed backdoor is the main reason for reinfection.
Find the root cause and fix it
We look for the likely entry point, such as an outdated or abandoned plugin, a weak or stolen password, or another site on the same hosting account, and remediate what we can.
Harden
Once the site is clean, the obvious weak points are closed: updates, user roles, login protection and file settings. See WordPress security hardening.
Verify and report
We re-check the site after cleanup, then send a written summary: what we found, what we removed, and what we recommend to prevent a repeat.
WordPress malware removal pricing
The final price varies with site size, plugin count, hosting setup and how deep the infection goes. Send us the details and we'll come back with a quote for your site. This is the same service as our hacked-site recovery.
Included
- Malware and suspicious code review
- Cleanup of common infection traces
- Admin access review
- Post-cleanup recommendations
What we'll need from you
To do a proper cleanup we need to see the whole site, not just the admin screen. Please never send passwords through the contact form; we'll tell you how to share access once we've replied.
- A temporary WordPress administrator account, which you remove afterwards
- File access: SFTP, SSH or your hosting panel's file manager
- Database access through your hosting tools, such as phpMyAdmin
- Any message your host or Google sent you about the problem
Warnings, rankings and staying clean
- If Google or a browser flagged the site, request a review once it is clean. See flagged and blacklisted sites.
- Remove spam pages that were indexed. See removing spam pages from Google.
- Keep core, plugins and themes updated and delete what you don't use. See securing WordPress after malware removal.
- For ongoing protection, managed WordPress security covers update oversight, security checks and backup verification from $79/mo.
WordPress malware removal FAQ
Can't I just run a security plugin to remove the malware?
Plugins are useful for spotting known patterns. After a compromise they have limits: they flag what they recognise, they rarely look at users, scheduled tasks and database content, and they can't tell you how the attacker got in.
Will I lose my content?
The aim is to keep your content and design and remove only what doesn't belong. That's why a full copy is taken before anything is changed.
How long does a cleanup take?
It depends on the size of the site and how deep the infection goes. We'll give you a realistic expectation once we've seen what's involved.
Do I need to take the site offline?
Not always. If the site is serving malware or redirecting visitors, a short outage protects your customers. We'll advise on your case.
My host already deleted some files. Is the site clean?
Not necessarily. Hosts usually delete only the files their scanner flags, which often leaves backdoors, database spam and rogue users behind.
Can you prevent it from happening again?
We can close the entry point we find and recommend what to change. Hardening and ongoing maintenance lower the risk; nobody can promise it drops to zero.
Tell us about your site
Send a short message: your website, what you're seeing, and who hosts it. We'll get back to you with next steps.