Disinfecting WordPress is not just running a scanner and deleting whatever looks strange. Useful cleanup should reveal how the malware entered, remove persistent changes, close access and verify that the site does not behave abnormally again.
The priority is to work methodically. Remove what you can show is malicious, preserve enough evidence to investigate and avoid replacing legitimate components without understanding the impact.
1. Build an inventory before cleaning
Record the domain, hosting, WordPress version, plugins, themes, administrator users, integrations and observed symptoms. Save a copy of the current files and database, even if the site is infected.
Note redirects, affected URLs, browser messages, provider alerts, content changes and the date of discovery. This timeline helps connect the incident with an update, credential or specific access.
2. Review the places where the problem can persist
The review must cover more than the homepage. Check:
- Recently modified files and new files that do not belong to the project.
- Plugins and themes from unknown sources or no longer maintained.
- Users, sessions, passwords and administrator permissions.
- Database content, injected code, options and unauthorised redirects.
- Scheduled tasks and server configuration.
.htaccess, configuration files and folders that allow uploads.- Forms, email, payments and connections to external services.
The official WordPress guidance for hacked sites recommends documenting symptoms, reviewing backups, scanning the site and understanding the entry point before closing the response.
3. Separate cleanup from restoration
A backup can return the site to an earlier state, but it does not guarantee that the server, passwords or administrator device are secure. Cleanup may require replacing known components, reviewing custom code and recovering legitimate content from a trusted copy.
Do not overwrite everything without preserving the affected state. If a file, query or user is unclear, record the finding and get advice before deleting it. On a store, a quick decision can remove orders, configuration or data the operation needs.
4. Remove persistence and fix the cause
Remove users, files, rules and access that should not exist. Update WordPress, plugins, themes and the server environment from legitimate sources. Disable or remove components that are no longer needed.
Then change credentials from a trusted device: WordPress, hosting, SFTP or SSH, database, email and connected services. Review accounts that could reset passwords or modify the domain too.
The WordPress hardening guide gathers measures for improving passwords, permissions, updates, backups and environment controls after recovery.
5. Verify that the site is actually clean
Test the site on desktop and mobile, logged out and in a private window. Check for redirects, browser warnings, injected pages, pop-ups, unexpected users or forms sending information to unknown destinations.
Review the pages that matter to the business, not just the homepage. For a store, include cart, checkout, payments, transactional emails and orders. For a corporate site, include forms, contact email, service pages and analytics.
Keep stronger monitoring for the following days. If the same symptom returns, the cause may still be active or another access may be open.
6. Close the work with a reviewable report
A final report should state what was found, what was cleaned, which backups were reviewed, which credentials changed, which updates were applied, which tests ran and which risks remain.
If hosting blocked the site, customer data is involved or the infection returns, request WordPress malware cleanup. To organise the response before cleaning, read what to do in the first 30 minutes and, if you need to restore the site, how to recover a hacked WordPress website.