Before you start

Malware removal goes wrong in two ways: deleting evidence you later need, and cleaning the site while the attacker still has a way back in. These steps avoid both. Set aside a couple of hours, and do the password changes from a computer you trust.

  • You need access to your hosting control panel, SFTP or SSH, and the database (phpMyAdmin or WP-CLI).
  • Know your WordPress version and the list of plugins and themes you actually use.
  • If the site takes payments, tell your payment provider early. A skimmer on a checkout page is a reportable incident in many setups.

Restore a backup or clean the site?

If you have a backup from before the infection, restoring it is the fastest route, but only if you then fix the vulnerability, because the restored site is exactly as exposed as it was on the day it was hacked. The trouble is knowing when the infection started. Attackers often sit quietly for weeks, so “last night’s backup” may already contain the backdoor. If you can’t date the compromise, clean the site, and use old backups only as a reference for what the files should look like.

How to remove malware from WordPress in nine steps

1. Take a full backup of the infected site

Copy all files and export the database, and keep the copy off the server. This is your evidence: it shows how the attacker got in, and it lets you recover content if a clean-up step removes something real. On Pro and Agency plans, Silent Threads’s Forensic Evidence Bundle exports the relevant logs, files and differences in one step.

2. Put the site in maintenance mode

Stop visitors and customers from being redirected or skimmed while you work. A simple maintenance page from your host, or a temporary rule that only lets your own IP in, is enough.

3. Lock the attacker out

  • Change the passwords for hosting, SFTP/SSH and the database (then update DB_PASSWORD in wp-config.php).
  • Delete every WordPress account you don’t recognise, then reset the passwords of all administrators.
  • Replace the authentication keys and salts in wp-config.php with new ones from the official generator at api.wordpress.org/secret-key/1.1/salt/. This logs everybody out, including any attacker with a stolen session.
  • Revoke application passwords and API keys you didn’t create.

4. Replace WordPress core

Download the same version from WordPress.org and replace wp-admin and wp-includes completely, plus the root files except wp-config.php. With WP-CLI: wp core download --force --skip-content --version=X.Y.Z. Then run wp core verify-checksums; it should report no changes.

5. Reinstall plugins and themes from their source

Don’t try to spot the malicious lines in a plugin. Delete each plugin folder and install a fresh copy from WordPress.org or the vendor’s own site. Delete anything you don’t use, and every “nulled” premium plugin, because those are a common way infections arrive. Check wp-content/mu-plugins and the drop-in files directly inside wp-content (such as advanced-cache.php, object-cache.php and db.php) as well; they don’t show up in the normal plugin list.

6. Clean wp-content/uploads

Uploads should contain media and documents, nothing executable. Delete every .php file there (find wp-content/uploads -name "*.php"), along with any file whose content is code, whatever its extension. Then stop PHP from running in uploads at all with a server rule.

7. Clean the database

  • Check siteurl and home in wp_options.
  • Search wp_posts and wp_options for <script, eval(, base64_decode, atob( and domains you don’t recognise. Look at widget and theme options too.
  • Check the cron option, or run wp cron event list, for scheduled hooks you didn’t create.

Edit carefully: a lot of legitimate content contains scripts. When in doubt, compare with an older backup.

8. Scan again and compare

Now run a full scan. Silent Threads runs Malware, Database, Persistence and Core File Integrity scanners on every plan, using 74 built-in signatures plus live signatures. Pro adds Deep scans and the JS & Card-Skimmer Scanner. A clean scan after a replace-everything clean-up is much more meaningful than a clean scan on its own, because scanners can miss things (see what scanners can and can’t catch).

9. Close the hole, then reopen

Update everything and find the entry point: a plugin version with a known vulnerability, a weak or reused password, or a compromised hosting account. Your evidence backup and server access logs usually show the first malicious request. Then take the site out of maintenance mode and, if Google flagged it, request a review in Search Console.

After the clean-up

Re-infection within a few weeks is common, usually because one backdoor survived or the original vulnerability is still there. Watch the site closely for a month:

  • Turn on alerts for new administrator accounts (Silent Threads sends one on every plan).
  • Keep a firewall in front of WordPress to block the exploit attempts that follow a breach; ours has 356 built-in rules on every plan.
  • Turn on two-factor authentication for every administrator.
  • Work through the WordPress security checklist.

When to get professional help

Get hands-on help if the site processes payments or personal data, the infection keeps coming back after a full clean-up, or the server itself (not just WordPress) may be compromised. In the last case, files outside the WordPress folder, other sites on the same account and the server’s own configuration all need checking, and your host should be involved.

How we checked this guide

The commands are standard WP-CLI commands as documented by WordPress. The order of steps follows widely used incident-response practice: preserve evidence, contain, eradicate, recover. Plugin features are named only where Silent Threads includes them, with the plan.