How to find WordPress malware beyond the obvious infected file

Start with known-good baselines

WordPress core and repository/vendor plugin packages give you trusted reference points. Compare rather than judging every PHP function by appearance; legitimate plugins can use code that looks suspicious in isolation.

Prioritize unexpected executable files

PHP files in uploads, cache, image or temporary directories deserve attention because those locations are commonly writable and often should not contain custom executable code.

Review MU plugins and early-loading code

wp-content/mu-plugins loads automatically and can be overlooked in ordinary plugin screens. Also review wp-config.php, active theme functions.php and early bootstrap files for unauthorized loaders.

Search the database for site-wide injections

Inspect relevant wp_options/autoloaded data, widgets, headers/footers and content for scripts or remote domains. Database malware can affect every page without changing a template file.

Review users and scheduled tasks

Unexpected administrators, application passwords and cron hooks can be both indicators and persistence mechanisms.

Use access logs to connect behavior to files

Direct requests to obscure PHP files, repeated exploitation of a plugin endpoint or suspicious admin-ajax actions can identify how malicious code is being used.

Avoid signature-only conclusions

base64, eval, shell functions and encoded data can be malicious, but context matters. False positives are common in minified, licensed or framework code. Verify against a trusted source and behavior.

If the site is currently redirecting visitors, serving malicious downloads, showing fake verification pages or affecting checkout, prioritize visitor safety and preserve evidence before aggressive cleanup.

Related WP•FIX resources

FAQ