A Smart Guide To Remove Malware Safely in just 8 Easy Steps

Before you can fix the problem you need to confirm there actually is one. WordPress malware does not always announce itself loudly. Sometimes the signs are subtle and easy to miss until the damage is already serious.

Here are the most common warning signs that your WordPress site has been infected:

• Your site suddenly became very slow for no clear reason
• You notice new admin users in WordPress that you did not create
• Pages or posts appear in Google that you never published often in foreign languages
• Your server CPU and memory usage spiked without any increase in traffic
• You find strange files or folders in your WordPress directory that were not there before

If any of these sound familiar, your site very likely has a malware infection and you need to act quickly. The longer malware sits on your server, the more damage it does both to your site and to your SEO rankings.

The first thing most panicked site owners do is start deleting files or making random changes. This often makes the situation worse and can destroy evidence you need to diagnose the infection properly.

Here is what to do immediately:

Put your site in maintenance mode. This prevents visitors from landing on an infected page while you clean things up. You can use a plugin like WP Maintenance Mode or simply ask your host to temporarily take the site offline.

Change all passwords right now. Change your WordPress admin password, your hosting control panel password, your FTP/SFTP password, and your database password. Do this before anything else. If the hacker still has valid credentials, cleaning your site will be pointless because they will just re-infect it.

Notify your hosting company. Most good hosting providers have a security team that can help identify infected files. They may also have server-level logs that show exactly how the attacker got in.

Do not restore from a backup yet. Many people jump straight to restoring an old backup but if you do not know when the infection happened, you might restore a backup that is already infected

Important: If you are not comfortable handling this yourself, this is the right moment to hand it over to professionals. Our WordPress Malware Removal Service at WPAegis handles complete site cleanups with a guarantee so you can skip the stress entirely.

This sounds counterintuitive. Why would you back up a site that is already infected?

Because you need a snapshot of the current state of your files and database before you start making changes. If something goes wrong during the cleanup process, having that backup means you can always go back to where you started rather than ending up with a completely broken site.

Use your hosting control panel (cPanel, Plesk, or your host’s dashboard) to create a full backup files and database together. Store it somewhere safe and label it clearly as “infected backup — do not restore without scanning.”

If you are already a WPAegis client, your Daily Backup Service means we already have recent clean copies of your site stored securely so recovery becomes much faster and simpler.

If you are comfortable with FTP or your hosting file manager, you can manually look through your WordPress files for suspicious code. Common places malware hides include:

• The wp-content/uploads folder (malware often hides executable PHP files here)
• The wp-config.php file (hackers frequently inject code at the top or bottom)
• Your theme’s functions.php file
• Any recently modified files sort by “date modified” in your FTP client to find files changed around the time of infection

If Wordfence or another scanner has flagged specific files, most premium security plugins give you a one-click option to repair or delete infected files. Wordfence Premium, Sucuri, and MalCare all offer automatic malware removal as part of their paid plans.

This is the fastest and safest option for non-technical users.

For those comfortable working with files, here is the manual process:

Re-install WordPress core files. Go to WordPress.org and download a fresh copy of WordPress. Replace your wp-admin and wp-includes folders entirely these should never contain custom code, so replacing them is completely safe and removes any malware hiding in core files.

Re-install your theme and plugins from scratch. Delete your current theme and all plugins, then reinstall clean versions from WordPress.org or from the original developer. Never reinstall from the same source — always get a fresh download.

Manually clean functions.php and wp-config.php. Open these files in a text editor and look for anything suspicious long strings of encoded characters (often base64 encoded), eval() function calls, unusual iframe tags, or code that was not there when you originally set up the site. Remove anything that looks out of place.

Step 5 – Clean Your WordPress Database:

Step 6 – Remove Backdoors Hackers Left Behind:

This step is one that most DIY malware cleanups miss and it is the reason sites get re-infected within days or weeks of being cleaned.

A backdoor is a hidden piece of code that lets a hacker re-enter your site even after you have changed all your passwords and removed the obvious malware. Hackers deliberately design backdoors to be hard to find. They often disguise them as legitimate plugin or theme files

Common places backdoors hide:

• Inside image files in wp-content/uploads (PHP code injected into .jpg files)
• In fake plugin folders with names that look legitimate (for example “wordpress-support” or “wp-helper”)
• At the very top or bottom of legitimate plugin files
• In hidden files starting with a dot like .htaccess injections

Search your files for these common backdoor functions: eval(), base64_decode(), gzinflate(), str_rot13(), and preg_replace() with the /e modifier. Treat any file containing combinations of these — especially when obfuscated — with suspicion.

If this sounds overwhelming, this is exactly what our team handles with our WordPress Security Monitoring service ongoing scanning that catches backdoors and threats before they cause damage.

Step 7 – Restore and Harden Your WordPress Site:

With the malware removed and backdoors eliminated, now it is time to lock your site down so this does not happen again.

Update absolutely everything. WordPress core, every plugin, and your theme all of it needs to be on the latest version right now. The majority of WordPress hacks happen through known vulnerabilities in outdated software.

Delete themes and plugins you are not using. Inactive plugins still pose a security risk. If it is not active and you do not need it, delete it completely.

Install a security plugin and firewall. Wordfence, Sucuri, or iThemes Security all provide a web application firewall (WAF) that blocks malicious traffic before it reaches your WordPress site.

Change your secret keys in wp-config.php. Go to api.wordpress.org/secret-key/1.1/salt to generate a fresh set of secret keys and replace the old ones in your wp-config.php file. This immediately invalidates all existing login sessions including any the attacker may still have open.

Limit login attempts. By default WordPress allows unlimited login attempts. A brute force attack can try thousands of password combinations per minute. Install Limit Login Attempts Reloaded or enable this feature through your security plugin.

Set correct file permissions. Your WordPress files should be set to 644 and directories to 755. Your wp-config.php file should be 600. Incorrect permissions make it easier for attackers to write malicious files to your server.

If Google had already flagged your site in Search Console or shown a “Deceptive Site Ahead” browser warning, you need to formally request a review once your site is clean.

Here is how to do it:

1. Log into Google Search Console at search.google.com/search-console
2. Go to the Security Issues section in the left sidebar
3. Review the specific issues Google flagged
4. Once your site is fully clean, click “Request a Review”
5. Explain the steps you took to clean the site and prevent re-infection
6. Google typically completes the review within 1 to 3 days for straightforward cases

While you wait, monitor your site in Search Console daily. Once Google confirms your site is clean, the browser warning will be removed and any manual action penalty will be lifted.