Guide

Removing WordPress malware properly — beyond running a plugin.

by Ken Armitt, Founder · updated 31 July 2026

Proper WordPress malware removal is find-everything-then-close-the-door: replace core, plugin and theme files from known-good copies, clean database injections and the uploads folder, and — critically — find the backdoors and the entry point, whether an outdated plugin, a nulled theme, or stolen credentials. Cleanup that skips the entry point is why hacked WordPress sites reinfect within days.

Where WordPress malware hides

Rarely in just one place. Common homes are modified core files, injected code in theme functions.php or header/footer, fake plugins in wp-content/plugins, PHP files hidden in wp-content/uploads (which should contain no PHP at all), rows in the wp_options and wp_posts tables, and scheduled tasks (wp-cron) that re-inject everything after you clean it.

The removal sequence

1. Take a forensic copy before changing anything.
2. Replace, don't hand-clean, the known parts: reinstall WordPress core and every plugin/theme from official sources, so anything modified is overwritten.
3. Clean what can't be reinstalled: the database, the uploads folder, and wp-config.php. Remove PHP from uploads entirely.
4. Kill persistence: rogue admin users, malicious scheduled tasks, and every backdoor — a single leftover reinfects the lot.

Why it comes back — and how to stop that

Reinfection almost always means the entry point survived: an outdated plugin with a known exploit, a "nulled" premium plugin that shipped with a backdoor, or a password reused somewhere that leaked. Update everything, remove nulled software, rotate all credentials, and then verify from outside with independent re-scans. "It looks fine in my browser" is not verification — cloaked malware is built to look fine to you.