WordPress Malware Removal: The Complete 2026 Guide

WordPress malware is malicious code injected into your site’s files or database, usually through a vulnerable plugin or theme. It doesn’t announce itself. Most infections are designed to keep your site running normally so the attacker can use it for as long as possible.

That last point is the one people find hardest to accept. Attackers usually don’t want to break your site. A broken site gets fixed. A site that looks fine but quietly serves spam, sends phishing emails, or mines cryptocurrency can stay compromised for months.

Most WordPress hacks go undetected for weeks for exactly this reason.

The scale, briefly

Security researchers recorded 11,334 new vulnerabilities across the WordPress ecosystem in 2025 — a 42% jump over the previous year. Roughly 13,000 WordPress sites are compromised every day. WordPress accounts for over 90% of all infected CMS websites that cleanup firms handle.

But here’s the number that should shape how you think about this: 91% of those vulnerabilities were in plugins. WordPress core itself had six.

The software everyone worries about updating is the safest part of the stack. The parts people install and forget are where the problem lives. (The exception was the wp2shell core vulnerability patched in July 2026 — genuinely rare, and notable precisely because core flaws almost never happen at that severity.)

How to Tell If Your WordPress Site Is Infected

Run these checks in order. Each takes a couple of minutes.

1. Search your own site in Google. Type site:yourdomain.com and page through. Foreign-language pages, pharmacy listings, casino spam, or URLs you never created are conclusive evidence.

2. Compare your indexed page count against reality. In Search Console → Indexing → Pages. A 40-page site showing 4,000 indexed URLs has 3,960 pages you didn’t make.

3. Check Search Console Security Issues. Useful when it fires — but be careful with a clean result. Plenty of SEO spam infections never trigger a warning at all.

4. Visit your site logged out, from a phone, via a Google search. Not by typing the address while logged in on desktop. Conditional malware skips that exact profile on purpose.

5. Check your users. Users → All Users, filtered to Administrator. Look at registration dates. Anything you didn’t create is a backdoor.

6. Check Search Console property owners. Settings → Users and permissions. Attackers add themselves as verified owners to monitor their spam and keep access after cleanup. Almost nobody looks here.

7. Look for files that shouldn’t exist. PHP files in wp-content/uploads/. Unfamiliar plugin folders. Anything in mu-plugins you didn’t put there. Sort by modification date — files changed around the time trouble started are your shortlist.

8. Check whether your domain is blacklisted. Run it through MXToolbox or a Spamhaus lookup. If your site is being used as a spam relay, your legitimate emails will start bouncing — and that’s often the first symptom a business actually notices.

9. Read your .htaccess and wp-config.php. Unexpected RewriteRule lines pointing to external domains, or long base64-encoded strings near the top of wp-config.php, are both red flags.

One important warning about scanners

Security plugins are useful. They are not conclusive.

Sucuri documented malware built specifically to defeat Wordfence — and in 14% of infected sites, the malware had tampered with Wordfence’s own files to stay hidden. Meanwhile, infections that live entirely in the database, or on the server outside WordPress, are invisible to file-based scanning by design.

A clean scan means “no known malware found in the places I looked.” It does not mean your site is clean. If your scanner and Google disagree, Google is almost always the one that’s right.

The Main Types of WordPress Malware

SEO spam injection

The most common category by a wide margin. Your site gets used to rank pages for keywords the attacker cares about — pharmaceuticals, counterfeit goods, gambling.

The defining feature is cloaking: the malware serves spam to Googlebot and normal content to you. That’s why site owners insist nothing is wrong while their search listings fill up with junk.

Main variants: Japanese keyword hack, pharma hack, casino spam. Same attack, different merchandise.

Backdoors

The most dangerous type, because a backdoor is what makes an infection survive your cleanup.

Backdoors hide in files with legitimate-sounding names, in obfuscated code that mimics normal WordPress functions, in the database, or in scheduled cron jobs that rewrite deleted files on a timer. Some create hidden admin accounts. Some don’t need to.

If you clean a site and it reinfects within hours, you left a backdoor. If it reinfects within weeks, you probably left the entry point open. Different problems, different fixes.

Malicious redirects

Visitors get sent to spam, phishing, or fake browser-update pages. Modern versions are conditional — they check whether you’re logged in, what device you’re on, and where you came from before deciding whether to fire.

Credit card skimmers

On WooCommerce and other stores, JavaScript injected into the checkout page copies card details as customers type them. The order still completes normally. Nothing looks wrong.

This is the infection with legal consequences attached, and it’s the strongest argument for treating an ecommerce compromise as an incident rather than a chore.

Cryptominers

Your server’s CPU gets used to mine cryptocurrency. Symptoms are performance-based — sudden slowdowns, resource spikes, hosting complaints about CPU usage.

Spam relays and phishing hosts

Your site sends thousands of spam emails, or hosts phishing pages in a subdirectory. Usually discovered when your host suspends the account or your domain lands on an email blacklist.

What’s new in 2026

Two developments worth knowing about.

AI-generated malware. Attackers now use language models to write code that mimics legitimate WordPress patterns — innocuous variable names, conventional structure, nothing that looks obviously wrong. Signature-based scanners rate it as clean because it genuinely looks like normal plugin code.

Database-resident infections. Malware that leaves no file-system trace at all, writing temporary files only during a request and deleting them immediately afterward. A scanner running hourly will essentially never catch it in the act.

Both trends point the same direction: file scanning alone is no longer sufficient, and “the scan was clean” is a weaker signal than it used to be.

How Malware Gets In

Five entry points cover nearly everything.

Outdated plugins and themes. The dominant cause. Around 250 new plugin vulnerabilities are disclosed weekly, and attackers begin scanning for vulnerable installs within hours of disclosure — long before most site owners apply the patch.

Abandoned plugins. Roughly a third of plugins in the WordPress.org repository haven’t been updated in over a year. An abandoned plugin doesn’t stop working; it stops getting fixed. Any vulnerability found after the developer walked away stays open permanently.

Nulled themes and plugins. Cracked premium software from unofficial sources. Whoever removed the license check had full file access and no reason to be nice. Backdoors in nulled software are the norm, not the exception.

Weak or reused credentials. Brute-force attacks against wp-login.php remain constant. Two-factor authentication ends this category entirely.

Shared hosting neighbors. On shared accounts, an infection on one site can spread to others in the same account. Including the test install you forgot about in a subdirectory.

The WordPress Malware Removal Process

This is the general process. Specific infections have specific extra steps — follow the linked guide for your symptom alongside this.

Stage 1: Contain

Take a full backup, files and database, even infected. You need a rollback point and forensic evidence. Label it clearly so nobody restores it by accident later.

Put the site in maintenance mode. Stop serving malware to visitors and stop the damage compounding.

Rotate credentials now, not later. WordPress admins, database, hosting panel, SFTP, and the security salts in wp-config.php. Changing salts forces every session to log out, including the attacker’s.

Remove unauthorized Search Console owners before you start cleaning, or the attacker watches the whole process.

Stage 2: Clean the files

Replace WordPress core. Download fresh from wordpress.org and replace everything except wp-content and wp-config.php. This eliminates any core-file modifications in one move.

Delete and reinstall every plugin and theme from official sources. Delete, then reinstall — don’t try to clean in place. Anything nulled gets removed and replaced with a legitimate copy or dropped entirely.

Hunt for backdoors in the places scanners skip:

• PHP files anywhere in wp-content/uploads/
• Unfamiliar files in mu-plugins, which load automatically and never appear in your plugins list
• Files with a leading dot (.somefile.php), hidden by default in most FTP clients — enable hidden files to see them
• Core filenames in wrong directories, like a wp-blog-header.php sitting somewhere it doesn’t belong
• Random-looking filenames in cache folders

Check .htaccess and wp-config.php and reset .htaccess to the WordPress default if anything looks injected.

Stage 3: Clean the database

This is the stage people skip, and it’s why infections come back.

• wp_options: confirm siteurl and home match your real domain. Look for oversized encoded entries.
• Scheduled tasks: cron jobs that rewrite files on a timer are the single most common reinfection mechanism. Review and remove anything you don’t recognize.
• wp_posts and wp_postmeta: spam content and injected links.
• wp_users: administrator accounts you didn’t create.

A serious warning: bulk DELETE queries based on keyword matching are genuinely dangerous. A slightly wrong query destroys legitimate content permanently, and your only backup is infected. Test on staging first. If that prospect makes you uneasy, that’s the correct instinct — stop here rather than experimenting on a live database.

Stage 4: Clean Google’s index

Your site can be spotless while Google still lists thousands of spam URLs. Google doesn’t know they’re gone until it recrawls them.

• Return 410 Gone for spam URLs, not 404. Both work; 410 means “permanently gone” and Google acts on it faster.
• Do not block them in robots.txt. This is the most common mistake in SEO spam recovery and it backfires completely: Google must crawl a URL to see the 410. Block it, and Google never learns the page died, so it stays indexed indefinitely.
• Don’t redirect spam URLs to your homepage. That transfers spam signals to your best page.
• Delete fake sitemaps and submit a clean one.
• Use Search Console → Removals for the worst offenders. This hides URLs within about a day, but it’s temporary — roughly six months. The 410s do the permanent work.
• Request a review under Security Issues if you were flagged. Explain what was wrong, what you did, and the result.

Stage 5: Harden

Cleaning fixes today. Hardening is what stops next month.

• Update core, all plugins, all themes
• Delete every plugin and theme you don’t actively use
• Two-factor authentication on all admin accounts
• Limit login attempts
• File permissions: 644 for files, 755 for directories, 600 for wp-config.php. Never 777.
• Disable file editing: add define('DISALLOW_FILE_EDIT', true); to wp-config.php
• Disable PHP execution in the uploads directory
• Install a firewall with virtual patching, so newly disclosed vulnerabilities are blocked before the developer ships a fix
• Set up file integrity monitoring so you learn about changes from a monitor rather than a customer