Quick answer
To remove malware from WordPress: back up the site as-is, scan core files, themes, plugins and the database, remove all injected code and hidden backdoors, replace compromised files with clean copies, find and close the entry point, then harden the site and request a Google review if it was blacklisted.
Key takeaways
- Always back up the hacked site before you touch anything — you need the evidence.
- Cleaning the visible malware isn't enough; the backdoor and entry point must go too.
- Harden after cleanup, or you're just resetting the site to the state that got it hacked.
Finding malware on your WordPress site is stressful, but the removal process is methodical, not magic. Rushing it — deleting files at random and hoping — is how people turn a small infection into a week of downtime. Here's the process that actually works.
1. Back up the site as-is
Before you change anything, take a full snapshot of files and database. A compromised backup is still forensically useful, and it means nothing is lost while you work.
2. Scan everything, not just the obvious
Malware hides across WordPress core files, themes, plugins, the uploads folder, and the database. A proper scan maps every piece of malicious code, not just the one symptom you noticed.
3. Remove injected code and backdoors
Delete the malicious code and any hidden backdoor files — the small scripts attackers leave so they can walk back in. Replace WordPress core and plugin files with clean copies from official sources rather than editing infected ones by hand.
4. Find and close the entry point
This is the step most DIY cleanups skip, and it's why malware "keeps coming back." Identify how they got in — an outdated plugin, a weak password, a known vulnerability — and close it.
5. Harden and verify
Update everything, tighten logins, add a firewall, and set up backups and monitoring. Then verify the site is clean across devices and, if Google flagged it, request a review so the warning is lifted.
When to get help
If you're facing a reinfection loop, a Google blacklist, or you simply can't find the source, that's the moment to bring in someone who does this daily. A clean removal that closes the entry point costs far less than repeated reinfections.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
A simple, recent infection can sometimes be cleaned with a reputable scanner and careful manual review. If there are multiple backdoors, a reinfection loop, or a Google blacklist, a professional cleanup is usually faster and safer.
Keep reading
How to Detect and Remove a Credit-Card Skimmer in WooCommerce
A card skimmer quietly steals customer payment details at checkout. Here's how to detect and remove one from WooCommerce.
Website Suspended by Your Host? How to Get It Back Online
If your host suspended your account for malware, here's how to clean the site to their standard and get it reactivated.
How to Request a Google Security Review After a Hack
Cleaned the hack but Google still warns visitors? Here's how to request a security review and get the warning lifted — the right way.