How to Remove Malware and Viruses from WordPress in 2026 (Step-by-Step)

Discovering that your WordPress website has been hacked is one of the most stressful experiences a site owner can endure.

One day your site is driving steady customer leads; the next morning, Google flags your domain with a red "Deceptive site ahead" interstitial, your web host suspends your cPanel for excessive resource usage, or mobile visitors are abruptly redirected to spam gaming portals.

Automated botnets scan millions of WordPress websites every hour, probing for outdated plugins, unpatched vulnerabilities, and compromised database credentials.

If your site has fallen victim to a script infection, do not panic. Paying an expensive security consultancy $1,500 is often unnecessary if you follow a methodical disinfection procedure.

This guide provides a comprehensive, field-tested technical roadmap to detect, quarantine, clean, and harden an infected WordPress installation in 2026.

---

The 5-Phase Disinfection Workflow

---

Immediate Emergency Actions: Contain the Breach

Before modifying code, take immediate steps to isolate your server and prevent automated scripts from overwriting your recovery files.

Step 1: Export a Forensic Snapshot

Even though your current state is infected, create a complete cPanel backup of your files and export a .sql dump of your database. If a manual cleanup step inadvertently breaks a database relationship, having the raw files ensures you do not lose original customer order logs or post revisions.

Step 2: Put the Site in Maintenance Mode

Prevent search engines from indexing spam pages and protect visitors by adding a basic maintenance index file or blocking external IP access in your .htaccess:

---

1. Replacing Corrupted WordPress Core Files

Hackers frequently inject malicious functions directly into standard WordPress files like index.php, wp-login.php, or files inside wp-includes.

Rather than manually reading thousands of lines of core code, replace the core files entirely from official source repositories.

The Step-by-Step Core Replacement:

1. Log into your hosting account via SSH or SFTP (FileZilla/Cyberduck).
2. Download a fresh .zip archive of the latest WordPress release from the official repository at https://wordpress.org/download/.
3. Unzip the fresh package on your local computer.
4. On your live server, delete the /wp-admin/ and /wp-includes/ folders completely.
5. Upload the fresh /wp-admin/ and /wp-includes/ folders from your local machine.
6. Replace all loose root files (such as wp-blog-header.php, wp-settings.php, wp-mail.php) with clean versions from the zip.

---

2. Auditing wp-config.php and Resetting Security Salts

Your wp-config.php file contains your raw database passwords and unique authentication salts.

1. Open wp-config.php in a code editor.
2. Verify that only legitimate database credentials and official configuration constants exist. If you see long strings of base64_decode, eval(gzinflate()), or random character blocks at the top, delete those strings immediately.
3. Visit the official WordPress Salt Generator at https://api.wordpress.org/secret-key/1.1/salt/.
4. Copy the freshly generated cryptographic keys and replace the existing AUTH_KEY, SECURE_AUTH_KEY, and LOGGED_IN_KEY constants in your wp-config.php.
5. Saving new salts automatically terminates all active browser sessions globally, locking out any hackers currently logged into your admin panel.

---

3. Disinfecting the /wp-content/ Directory

The /wp-content/ directory is where over 90% of WordPress malware hides because it cannot be blindly deleted without erasing site content.

Cleaning Plugins and Themes:

• Delete and Reinstall Plugins: Do not attempt to clean individual plugin files. Make a written list of active plugins, delete the entire /wp-content/plugins/ directory, and reinstall clean copies directly from the official WordPress plugin directory.
• Inspect Active Theme: If you built a custom child theme, compare your files against your local git repository. Look specifically for unauthorized files named cache.php, autoload.php, or modified code at the bottom of functions.php.

Scanning /wp-content/uploads/ for Rogue PHP Scripts:

Your uploads directory should contain only static media assets: images (.jpg, .png, .webp), videos, and documents (.pdf). There is zero legitimate reason for a .php file to exist inside the uploads folder.

Run the following SSH command to identify and delete any rogue PHP files disguised inside your media folders:

If any .php files appear in the terminal output, examine them and delete them immediately.

---

4. Database Sanitation and Cleaning Rogue Administrators

Malware scripts often register rogue administrative user accounts with hidden privileges.

1. Log into your hosting control panel and open phpMyAdmin.
2. Navigate to your WordPress database and open the wp_users table.
3. Review all rows. If you see unrecognized accounts (e.g., wp_admin_backup, system_admin, or randomized alphanumeric usernames), delete those records.
4. Check the wp_usermeta table to ensure no unauthorized users have administrator serialized roles assigned under wp_capabilities.
5. Search the wp_posts table for malicious external redirect scripts:

---

5. Hardening and Permanent Immunity

Once your site is completely clean, execute these security hardening configurations to prevent reinfection:

1. Disable PHP Execution in Uploads

Create a blank .htaccess file inside /wp-content/uploads/ and insert this code:

This blocks Apache or LiteSpeed from executing any future scripts uploaded via compromised media forms.

2. Enforce Two-Factor Authentication (2FA)

Install a reputable security plugin like Wordfence or Two-Factor and require mandatory time-based one-time password (TOTP) codes for all administrator and editor logins.

3. Deploy Cloudflare Web Application Firewall (WAF)

Proxy your DNS records through Cloudflare’s free WAF to automatically filter malicious bot traffic, block known SQL injection patterns, and throttle aggressive brute-force login attempts at the edge before they ever touch your server.

---

Useful SSH Grep Commands for Hunting Obfuscated Backdoors

If you have SSH terminal access, use these commands to locate hidden backdoors across your server filesystem:

Review the output of these commands carefully. While some legitimate plugins use base64_decode for data transport, occurrences inside theme folders or standalone PHP files in uploads are almost always malicious.

---

File and Folder Permission Standards

Incorrect server file permissions invite automated script injections. Ensure your files adhere to standard WordPress security permissions:

• Directories: Set to 755 (drwxr-xr-x)
• Files: Set to 644 (-rw-r--r--)
• wp-config.php: Restrict to 600 or 640 to prevent unauthorized local users from reading raw database credentials.

Execute this command via SSH from your WordPress root directory:

---

Auditing WordPress Crons for Hidden Scheduled Tasks

Hackers often schedule automated crons that pull new malware scripts every 24 hours, reinfecting your site even after manual cleanups.

Install the free WP Crontrol plugin:

1. Navigate to Tools > Cron Events in your WordPress admin.
2. Review all scheduled cron hooks.
3. Look for unfamiliar hook names that execute external PHP scripts or ping unrecognized foreign domains.
4. Delete any suspicious cron events immediately.

---

Summary: Requesting Review in Google Search Console

After your scans return 100% clean:

1. Open Google Search Console.
2. Go to Security & Manual Actions > Security Issues.
3. Click Request Review, providing a concise summary: "Replaced core WordPress files from source, purged and reinstalled all plugins, removed unauthorized PHP scripts in uploads, rotated database passwords and salts, and enforced 2FA."

Google typically reviews and lifts blacklisting warnings within 24 to 72 hours.