WordPress Security and Malware Removal: Fix a Hacked Site

Getting hacked is one of the worst things that can happen to a WordPress site. One day everything looks fine. The next, Google flags your domain as dangerous, your host suspends your account, or a customer sends you a screenshot of something alarming. WordPress security malware removal is not glamorous work. But knowing exactly what to do makes the difference between a two-hour fix and weeks of damage control.

We have cleaned over 300 infected WordPress sites at Weboption. The patterns repeat. The mistakes repeat too. This guide covers what actually works, not what sounds good in theory.

How WordPress sites get infected

Most hacks follow predictable paths. Outdated plugins are the single biggest culprit. A plugin running a version from six months ago may carry a publicly documented vulnerability that automated bots scan for around the clock. These bots do not target you specifically. They crawl millions of sites per day and exploit whatever they find. According to Sucuri’s annual hacked site report, 61% of infected WordPress sites had at least one outdated plugin or theme at the time of compromise.

Weak credentials are the second most common entry point. Using “admin” as a username with a short password is not paranoia territory. It is a pattern we see in real compromised sites, constantly. Shared hosting adds more risk: if one site on the server gets infected, others can be reached through the shared file system depending on how the host has configured account isolation.

Nulled themes and plugins deserve a dedicated warning. A “free” copy of a $60 plugin downloaded from a random site almost always contains a backdoor. We have cleaned sites where the infection source was a nulled Elementor Pro or WPML install. The math does not work in your favor: you save $60 and spend five times that in cleanup time, assuming you catch it quickly.

Signs your WordPress site has been hacked

Not all infections are obvious. Some attackers want to stay hidden for months, using your server to send spam or host phishing pages you never see. These are the indicators that should trigger an immediate investigation:

• Google Search Console showing manual actions or security issues
• Your hosting provider sending abuse emails or suspending your account
• Unusual spikes in CPU or bandwidth usage
• New admin accounts you did not create
• Visitors being redirected to unrelated sites
• PHP files appearing inside your uploads folder
• Google search results showing strange content for your domain

The redirect hack is particularly hard to catch. Mobile visitors get sent to a spam site, desktop visitors see nothing wrong, and it can take days before someone reports it. Check your own site through a mobile browser in incognito mode if you suspect anything.

The malware removal process, step by step

Before touching anything, make a full backup. Even a hacked site backup is worth keeping because you may need to compare files later. Most hosts provide cPanel or file manager backups. Download everything: files and database both.

Then change every password immediately. WordPress admin passwords, database credentials, FTP access, and your hosting control panel. All of them. An attacker who still holds your FTP password will re-infect the site within hours after you clean it.

Install Wordfence Security and run a complete scan. The free tier works for most cases. Wordfence Premium costs $119 per year and adds real-time firewall rules updated as new threats emerge. The scanner compares your WordPress core files, themes, and plugins against the official repository checksums. Anything that does not match gets flagged. Pay close attention to files marked as “Unknown” inside the uploads folder. PHP files have no business being there.

For deeper wordpress security malware removal, run MalCare or Sucuri SiteCheck alongside Wordfence. MalCare starts at $99 per year and catches obfuscated code that Wordfence sometimes misses because it scans server-side rather than just matching signatures. Sucuri offers a full cleanup service at $199.99 per year with unlimited incidents and a WAF included. For any site generating real revenue, the Sucuri plan pays for itself on the first cleanup.

After the scanners finish, check these locations manually regardless of what the tools reported:

• wp-config.php for injected code at the top or bottom of the file
• .htaccess for redirect rules you did not write
• functions.php in your active theme
• The entire uploads directory for any.php files
• wp-includes and wp-admin for files not present in a default WordPress install

Compare your wp-includes and wp-admin folders against a clean download of the same WordPress version from wordpress.org. Delete anything extra. There should be an exact match.

The most common mistake in DIY cleanup

Most DIY cleanups fail at this point. People remove the infected files, declare success, and get re-hacked within 48 hours. Attackers plant multiple backdoors deliberately. You remove one, they use another to reinstall everything overnight.

A complete cleanup means finding and closing the original vulnerability that let the hack in. If an outdated plugin was the entry point, removing the malware but leaving that plugin at the same version means you cleaned the wound and left it open. We have seen this exact scenario play out more times than we can count, including one client who went through three “cleanups” with different vendors before anyone thought to check the plugin versions.

After cleaning, harden the installation. Change the authentication keys in wp-config.php using the generator at api.wordpress.org/secret-key/1.1/salt/. Disable XML-RPC if you do not use Jetpack or mobile apps. Limit login attempts. Move the login page away from the default wp-login.php URL. These steps do not take long and they significantly raise the cost for the next automated attack.

Also audit the database. Attackers inject malicious JavaScript into post content, widget settings, or theme customizer data stored in wp_options. Search for suspicious base64-encoded strings or JavaScript beginning with eval(. phpMyAdmin works for this. The WP-Optimize plugin also has a database inspection view. Do not skip this step. Scanner tools frequently miss database-level infections.

Preventing reinfection

A cleaned site is not a protected site by default. You have to build in defenses.

A web application firewall at the DNS level is the most effective single change you can make. Cloudflare’s free tier blocks a meaningful portion of malicious traffic before it reaches your server. Cloudflare Pro at $20 per month adds more aggressive bot filtering. Sucuri’s WAF is another strong option, especially for sites that have already been targeted once.

File integrity monitoring catches new infections early. Wordfence does this with email alerts when core files change. Configure it and actually read the alerts. Most site owners set up monitoring and then ignore the notifications, which defeats the purpose entirely.

Keep everything updated. This sounds basic. It matters more than any security plugin. Enable automatic updates for minor WordPress releases. Review and update plugins weekly. Remove any plugin or theme you are not actively using. An inactive plugin sitting at version 1.8 is an open attack surface with zero benefit.

Two-factor authentication on all admin accounts is not optional. The WP 2FA plugin makes this straightforward and costs nothing. There is no reasonable argument against enabling it.

When to call a professional

Some infections are beyond DIY cleanup. If you are seeing database corruption, if the infection has spread across multiple sites on the same server, or if your host has already quarantined the account, you need someone who does this professionally.

Professional WordPress security malware removal runs between $150 and $500 for a single site, depending on complexity. That price covers identifying the infection source, cleaning files and database, removing backdoors, and implementing basic hardening. An experienced WordPress agency recognizes specific malware families on sight and resolves them faster than a general IT contractor working from scratch.

The cost of cleanup is almost always less than the cost of a compromised site running unchecked. Lost revenue from downtime, ranking drops from a Google security flag, and customer trust damage add up fast. We had a client who waited three weeks before addressing a hacked site. The SEO recovery took four months. Address it immediately.

Frequently asked questions

How do I know if my WordPress site has malware?

The most reliable method is running a scan with Wordfence or MalCare while simultaneously checking Google Search Console for security alerts. Redirects affecting mobile users only, new admin accounts you did not create, and PHP files inside your uploads folder are strong indicators. Some infections are invisible to the site owner, so scheduled scans are the only way to catch them early.

Can I remove WordPress malware myself without a plugin?

Yes, but it requires direct server access via FTP or SSH and the ability to compare your files against a clean WordPress install. You need to check wp-config.php,.htaccess, all theme files, and the database for injected code. Automated scanner plugins handle most of this faster and more accurately than manual inspection alone, so combining both approaches gives the best result.

How long does WordPress malware removal take?

A straightforward infection on a small site takes two to four hours from start to finish: backup, scan, clean, harden, verify. More complex cases involving database infections, multiple backdoors, or server-wide compromise take one to two full days. Starting immediately after discovery reduces the scope significantly because some malware spreads to additional files over time.

Will cleaning the malware remove the Google warning?

Not automatically. After cleaning the site, you need to submit a review request through Google Search Console under the Security Issues section. Google typically re-crawls within 24 to 72 hours. If the site is clean, the warning is removed. If any malware remains, the review fails and you start the process again, so complete the cleanup thoroughly before requesting review.

What causes WordPress sites to get hacked repeatedly?

Repeat infections almost always trace back to one of three things: the original vulnerability was not closed (outdated plugin left in place), a backdoor was missed during cleanup and used to reinstall the malware, or stolen credentials were not rotated after the initial compromise. Changing all passwords and updating every plugin immediately after a cleanup breaks two of those three vectors at once.

Get your site cleaned and protected

If your WordPress site has been hacked or you suspect an infection, do not wait. The longer malware runs on a site, the more damage it causes and the harder it becomes to remove completely.

Weboption handles WordPress security malware removal for sites of all sizes. We identify the source, clean the infection, close the vulnerability, harden the installation, and set up monitoring so you get alerts before the next incident becomes a crisis. Contact us at weboption.com.br/contato to get started.

For related reading, see our posts on WordPress maintenance plans and choosing hosting with security-focused infrastructure.