Practical, step-by-step WordPress security guides from the Silent Threads Security Team. Each one answers its question first, then shows you exactly how.
A WordPress malware scanner reliably catches known malware in files, many obfuscated variants, modified core files and injected scripts in the database. It can miss brand-new or heavily disguised code, malware outside the folders it scans, and attacks that don’t leave files at all, such as a stolen password. Scanning is one layer: pair it with file integrity checks, a firewall and alerts.
The reliable way to remove malware from WordPress is to replace rather than repair: back up the infected site as evidence, lock the attacker out by changing every password, replace WordPress core, plugins and themes with fresh copies, clean the database and uploads by hand, then close the hole they came in through. Scanning tells you where to look; replacing clean files is what actually removes the malware.
To find out whether your WordPress site is hacked, look for the eleven signs below, then confirm with five checks: the user list, core file checksums, PHP files in uploads, the database, and Google Search Console. Any single strong sign, such as an administrator you didn’t create, means you should treat the site as hacked until you have proved otherwise.
