If malware returns after cleanup, assume the recovery missed either persistence or the access path. Repeated deletion of the same files is evidence, not a solution.
A hidden backdoor rewrites the payload
Attackers often separate the visible malware from the code that recreates it. A small PHP backdoor in a theme, uploads directory, MU plugin or web shell can regenerate deleted files.
A scheduled task runs later
WordPress cron or server-level cron jobs can recreate users, files or database options minutes or hours after cleanup, making the site appear clean temporarily.
The malicious loader is in the database
Injected wp_options values, widgets or post content can load remote scripts even after infected PHP files are replaced.
Credentials are still compromised
If an attacker still has WordPress admin, hosting, SFTP/SSH or API access, the site can simply be compromised again after each cleanup.
The vulnerable component is still exposed
Cleaning malware without patching/removing the plugin/theme vulnerability means the same exploit can be used again.
Another site under the same account is compromised
Shared hosting accounts may allow one infected application to rewrite another if they run under the same filesystem user or permissions.
The “clean backup” was already infected
Restoring a snapshot taken after the compromise can faithfully restore the backdoor together with the legitimate website.
If the site is currently redirecting visitors, serving malicious downloads, showing fake verification pages or affecting checkout, prioritize visitor safety and preserve evidence before aggressive cleanup.
Related WP•FIX resources
FAQ
How soon can reinfection happen?
Seconds, minutes or days depending on whether the persistence is request-driven, scheduled or controlled by an attacker returning manually.
Does malware returning prove the server is hacked?
No, but it widens the investigation. The persistence may still be inside WordPress, or it may exist at the hosting-account/server level.
Should I move hosting?
Sometimes. If the account boundary itself may be compromised or multiple sites under one account are reinfecting each other, a clean migration to a new environment can be safer.
How long should I monitor after cleanup?
Long enough to cover the relevant scheduled tasks and normal traffic patterns. Rechecks should include files, users, cron, redirects and external behavior.
Need help recovering a hacked WordPress site?
Send the URL, visible symptoms and any hosting or Google warning text.
Open an incident