Your site is redirecting visitors to unfamiliar online stores, your host is reporting an infection, or Chrome is displaying a red warning. Removing malware from WordPress involves five steps: isolating the site, scanning files and the database, replacing infected files with clean core and plugin versions, removing backdoors and hidden users, and fixing the root cause with updates and a firewall. To learn how to recognize a hack and what to do in the first hour, read WordPress website hacked, now what?. This is about the recovery itself.
What Malware Does and Why Restoring a Backup Isn't Enough
Malware is malicious code that an attacker has planted in your site’s files or database. You’ll usually notice this through redirects to spam, pages in Google that you never created yourself, or a backdoor that allows the attacker to return later without being detected. What makes it tricky is that a lot of malware hides from logged-in administrators. You see a normal site, while a visitor coming from Google is redirected.
Restoring a backup removes the malware, but not the vulnerability that allowed it to get in. That’s the biggest misconception I come across. Malware is often already on a site for weeks before anyone notices it, so the backup you restore could just as easily be infected. And even if it’s clean, the vulnerability will still be there after the restore. It’s like leaving the lock on your front door after a burglar has made a duplicate key. With an online store, you’ll also lose all orders and changes made since that date. A clean backup from before the infection is a great starting point, as long as you also follow steps 4 and 5 afterward. You can read about how the restore process works in Restore a backup.
Steps 1 and 2: Isolate the site and scan the files and database
The first step is to prevent the damage from getting worse. I always follow the same procedure when doing this.
- Put the site into maintenance mode or restrict access.
- Back up the infected state. Don't restore it, but keep it as evidence and a fallback.
- Change all passwords—including those for WordPress administrators, your hosting control panel, FTP/SFTP, and the database.
- Report the infection to your host, as they may have already quarantined some files.
- Scan the computers you use to log in. A keylogger on your laptop will immediately render your new passwords useless.
Don't reset the site, because that will erase the evidence you'll need later to find the cause. That backup of the infected state is especially important if you later use JetBackup 5 restore it in cPanel, because the current state is not automatically saved during that process.
Next, scanning. A malware scan using a plugin like Wordfence, Sucuri, or Jetpack Protect provides an initial overview, and your host can also perform server-side scans. Encrypted code with functions such as eval or base64_decode Sometimes things slip through the cracks, so be sure to compare the core files with the official version as well. If you're using WP-CLI, then wp core verify-checksums all at once. Don't forget the database. Search in wp_options and wp_posts Check for unknown scripts and links, and scan pages, posts, comments, and revisions for hidden spam links.
Steps 3 and 4: Replace infected files and remove backdoors
You shouldn’t try to repair infected files; instead, replace them with clean versions. Reinstall the WordPress core and remove plugins and themes, then download fresh copies from the official source. Simply updating over infected files isn’t enough, because any files the attacker added themselves will remain. Also check wp-content/uploads. That includes images and documents, but not PHP files, so any PHP files in that location can be removed. Finally, loop through .htaccess and wp-config.php ...look for lines you don't recognize.
Next, you'll go on the hunt for backdoors and hidden users, because that's what sets cleaning up apart from true recovery. Malware often creates an administrator account that you won't see under Users, so be sure to check the tables as well wp_users and wp_usermeta in the database. Look in the folder mu-plugins, because plugins in that directory always load and don't appear in your regular plugin list, and check to see if any unknown cron jobs are running. Then refresh the security keys and salts in wp-config.php. This will log everyone out, including an attacker with a stolen session. Then scan again.
Step 5: Find and fix the cause
I don't consider a recovery to be a recovery if the cause hasn't been identified. Without this step, you'll often see the same malware return within a few days, because the attacker will come back through the same door. Start with the logs and recent changes. On our shared hosting, you'll find the access logs in cPanel under Raw Access, and every night as a .gz file in the folder /logs. PHP errors are listed in a file error_log in the folder where the error occurs.
Use that information to find the entrance. Usually, it's a outdated plugin with a known vulnerability, a weak or leaked password, a "nulled" theme, or an old, forgotten installation on the same hosting account. You can read about how each of these attack vectors works in The Seven Most Common Causes of a Hack. Once you've identified the cause, update everything, enable two-factor authentication (2FA) for all administrators, and set up a firewall (WAF). A server-level firewall and malware scans are essential components of good Managed WordPress Hosting By default. After the recovery, also block PHP execution in the "uploads" folder so that an uploaded file can no longer run code there. For long-term solutions, read more in WordPress Security and Securing Your WordPress Login, or you can leave updates and monitoring to WordPress maintenance.
Do it yourself, put it back, or have someone else do it?
You can clean up a simple site with a single, obvious infection on your own, but for an online store that handles customer data or one with a recurring infection, I recommend outsourcing the task.
| Route | When appropriate | Risk | Required Knowledge |
|---|---|---|---|
| Clean it yourself | Simple website, one clear infection | Overlooking a backdoor | Files, database, hosting control panel |
| Restore a clean backup and fix the cause | Infection date known; few changes since then. On Surver shared hosting, free via JetBackup 5 in cPanel; available separately for files or databases | Backup Already Infected, Leak Remains Open | Roll back, preferably to a staging environment first if your host supports it |
| Outsourcing (Hack Recovery) | Online Store, Customer Data, or Recurring Infection | Costs | None |
If personal data may have been accessed, please also review the mandatory reporting of data breaches. After cleaning up, you need to go to Google Search Console under Security Issues Submit a review request and verify your domain in Google Safe Browsing. You can find instructions on how to do this in Remove the Google warning.
At Surver, our standard practice is to minimize the likelihood of such a recovery as much as possible. All shared hosting packages run on a ModSecurity firewall, and Imunify scans for every file change and locks suspicious files, in addition to performing a full server scan every night. If your site does become infected, you can leave the entire process to us with WordPress Hack Recovery. We remove malware, backdoors, and spam links, fix the root cause, reinstall the core, themes, and plugins, and reset the passwords. Then we check blacklists, submit a review request to Google, and send you a report.
Frequently Asked Questions
Can a security plugin remove malware on its own?
Partly. A scanner detects known patterns, but often misses database injections and backdoors, and malware can even disable the plugin. On Surver shared hosting, Imunify already performs server-side scanning. Therefore, use a plugin as a supplementary tool, not as your only line of defense.
How long does it take to remove malware?
That depends on how deep the infection runs, and a thorough cleanup—including addressing the root cause—takes more time than a quick scan. Most of the time is spent on steps 4 and 5, because backdoors and the root cause can only be found through manual work.
Can malware harm my rankings on Google?
Yes, through spam pages, redirects, and a warning in the search results. After cleaning up the site, things usually don't return to normal until Google has processed your review request.
