A reliable WordPress cleanup is not “run a scanner and delete red files.” Start by containing risk and preserving a recovery point, then identify malicious changes, persistence and the likely entry point before returning the site to normal traffic.
1. Confirm what is actually happening
Document the visible symptoms before changing the site. Record redirects, fake CAPTCHA pages, Google warnings, unknown users, spam URLs, modified files and the approximate time the incident started. Test from a clean browser/session because conditional malware may hide from administrators.
2. Create a safe recovery point
Back up the current filesystem and database before destructive cleanup. A compromised backup is not a clean restore source, but it preserves evidence and gives you a rollback point if a legitimate file or database record is removed by mistake.
3. Protect visitors first
If the site is actively redirecting visitors, serving malicious downloads, showing phishing content or risking checkout data, business safety is more important than uptime. Restrict the dangerous path or use a controlled maintenance response while recovery is prepared.
4. Compare WordPress core and components with trusted sources
Verify WordPress core integrity and compare plugins/themes with known-good vendor packages or version control. Look for PHP files in unusual writable directories, unexpected MU plugins, modified theme files and recently changed files that do not match a legitimate deployment.
5. Inspect the database and privileged access
WordPress malware is not limited to files. Review administrators, application passwords, wp_options/autoloaded values, injected scripts, scheduled events and spam content. A clean filesystem can still reload malware from a database payload.
6. Find persistence, not just the visible payload
Recurring infections often involve a backdoor, scheduled task, hidden administrator, web shell, modified functions.php/wp-config.php, MU plugin or hosting-level access. If malware returns, treat that as evidence that the original cleanup was incomplete.
7. Identify and close the entry point
Patch or remove the vulnerable component, remove nulled software, rotate compromised credentials and review hosting/CDN/admin access. If several sites share one hosting account or filesystem user, check whether the scope extends beyond one WordPress install.
8. Verify from the outside
After cleanup, retest the site from clean browser profiles, mobile and search-referrer conditions when relevant. Check HTTP responses, page source, scheduled tasks, administrators and file changes over time rather than assuming the first clean page load proves recovery.
9. Handle search/security warnings
If Google Safe Browsing or Search Console flagged the site, request review only after the malicious behavior is genuinely removed. Search warnings are a symptom of the compromise; they are not fixed by submitting a review before cleanup is complete.
If the site is currently redirecting visitors, serving malicious downloads, showing fake verification pages or affecting checkout, prioritize visitor safety and preserve evidence before aggressive cleanup.
Related WP•FIX resources
FAQ
Should I restore a backup immediately?
A verified clean backup can be useful, but restoring without fixing the original entry point can lead to reinfection. You can also overwrite legitimate newer content or orders.
Can Wordfence or another scanner clean everything?
Scanners are useful evidence sources, but sophisticated or persistent incidents can require manual review of files, database, users, cron, access logs and hosting scope.
Why does malware return after I delete it?
A persistence mechanism or vulnerable entry point is still active, or another compromised site/account is rewriting the files.
Should I change every password?
Credentials that may have been exposed should be rotated after the malicious access path is controlled, including WordPress, hosting, SFTP/SSH, database/API keys where relevant.
How do I know the site is clean?
There is no single magic signal. Confidence comes from clean file/component comparisons, database/user review, closed entry point, clean external behavior and monitoring after recovery.
Need help recovering a hacked WordPress site?
Send the URL, visible symptoms and any hosting or Google warning text.
Open an incident