WORDPRESS SECURITY SERVICE
wp-vcd Malware Removal
wp-vcd is a self-replicating WordPress malware that hides in your themes and keeps coming back. I remove wp-vcd.php and its variants, clean the injected code everywhere it lives, remove the loader that reinfects the site, and replace the source so it stays gone.
SIGNS OF wp-vcd
The infection that reinstalls itself
wp-vcd is built to survive. It copies itself into every theme and drops loader files that bring it back the moment your site loads, which is why deleting a single suspicious file never fixes it.
- Files named wp-vcd.php, wp-tmp.php, or wp-feed.php in your WordPress folders
- Malicious code injected into the functions.php of every installed theme
- Spam links or hidden ads appearing in your page source
- New administrator accounts you didn't create
- The infection reappears shortly after you delete the files
- It started after installing a nulled (pirated) theme or plugin
THE SERVICE
What wp-vcd removal includes
HOW IT WORKS
A structured approach to removing wp-vcd
1. Map the spread
wp-vcd is self-replicating — it injects itself into every theme and drops loader files that restore it. I map every location it lives in first, because deleting one file while the loader survives just brings it back.
2. Remove the loader
The core of the fix is removing the self-replicating loader and all its dropped files together, so nothing is left to regenerate the infection.
3. Clean themes & database
Injected code is stripped from each theme's functions.php, rogue admins are removed, and the database and core files are checked for remaining payloads.
4. Replace & harden
Any nulled theme or plugin that carried the infection is replaced with a legitimate version — the usual source of wp-vcd — and the site is hardened so it doesn't return.
FAQ
wp-vcd Malware FAQs
What is wp-vcd malware?
wp-vcd is one of the most common WordPress malware families. It usually arrives inside nulled (pirated) themes or plugins, then injects itself into every theme's functions.php, drops files like wp-vcd.php and wp-tmp.php, creates hidden admin accounts, and injects spam links or ads. It's self-replicating, which is why it keeps coming back if it isn't fully removed.
Why does wp-vcd keep coming back after I delete the files?
Because it installs a loader that recreates itself. wp-vcd injects code into your themes and drops helper files that restore the infection whenever the site loads. Deleting wp-vcd.php alone leaves the loader in place, so it regenerates. The fix has to remove every piece at once and replace the source.
How did I get wp-vcd?
The overwhelming majority of wp-vcd infections come from nulled — pirated — themes or plugins downloaded from unofficial sites. The cracked software has the malware bundled in. Removing the infection includes replacing that nulled software with a legitimate version, or the site just gets reinfected.
Can you clean it without me losing my site?
In most cases, yes. The injected code can be removed from your themes and the malicious files deleted while keeping your legitimate content and design. Where a nulled theme is the source, I'll help you move to a safe version of it.
How do I stop it happening again?
The single biggest step is to stop using nulled themes and plugins — that's how wp-vcd almost always gets in. Beyond that, keeping everything updated, using strong credentials, and adding basic hardening closes the doors that let reinfection happen.
GUIDES
Read more on this topic
RELATED SERVICES
Explore related WordPress security services
WooCommerce Malware Removal
Store-aware cleanup incl. checkout/card-skimming review, without breaking sales.
Website Suspended by Host — Recovery
Clean to the host's standard and get a suspended account reactivated.
WordPress Security Hardening
Close the doors before anyone finds them — access, firewall, backups, monitoring.
WordPress Security Audit
A practical review of vulnerabilities, users, plugins, configuration and malware indicators.
NEED HELP?
wp-vcd keeps coming back no matter what you delete?
That's exactly how wp-vcd is designed to behave. Removing it properly means taking out the loader and the source together — not chasing the files one by one.