How to Remove Malware From WordPress in: The Step-by-Step

How to Remove Malware From WordPress in 2026: The Step-by-Step Cleanup

A hacked WordPress site is a bad day, but it is rarely the end of the site. The panic comes from not knowing the order of operations. This guide gives you the cleanup sequence used in practice: find the infection, clean the files, clean the database, close the hole, and rebuild your defenses.

Note: this page names paid tools. If you subscribe through the links here, RemoGrid may earn a commission at no extra cost to you.

Website Optimization and Security Best Practices

Choosing a reliable web host is the first step, but maintaining optimal website performance requires ongoing attention to configuration, caching, and security essentials. A fast, secure site improves user experience and supports higher search engine rankings.

Implement server-level or plugin-based caching, configure a content delivery network (CDN) like Cloudflare, and compress all images before uploading them to your server. Keeping your themes, plugins, and core CMS software updated protects your site against common vulnerabilities and ensures compatibility with modern PHP and database standards.

Always maintain automated off-site backups. Whether using an automated host backup tool or an independent cloud backup solution, having a recent restore point ensures you can recover quickly from unexpected technical errors or server issues.

The Short Answer

Take a backup first. Then replace WordPress core files with fresh copies, remove unknown plugins and themes, scan for suspicious code in the database, change every password, and update everything to the latest versions. If the site still redirects after a clean install, the infection lives at the host level and you should get professional help.

Step Zero: Confirm It Is Malware

Not every bad thing on a site is malware. Before you panic, check the actual symptoms:

• A browser warning like "Deceptive site ahead" from Google Safe Browsing
• Redirects to unfamiliar pages, especially on mobile visitors
• Spam content - hidden links, injected posts, unknown admin users
• Host alerts about outgoing spam or resource abuse
• Search Console notices of hacked content

Install a security plugin's scanner or use your host's malware scanner to confirm before you start deleting things.

Step One: Take a Backup

You cannot clean what you cannot restore. Download a full backup - files and database - and store it somewhere away from the server, like your computer or cloud storage. A backup from before the infection is ideal because it is clean. A backup from after the infection still helps you recover your content, but treat its files as possibly infected.

Step Two: Put the Site in Maintenance Mode

Tell visitors the site is down for maintenance while you work. Plugins can do this in one click, or your host can serve a maintenance page. This stops visitors from spreading the infection or seeing broken pages, and it stops bots from indexing the damage.

Step Three: Clean the Files

The file cleanup order matters:

1. Replace the WordPress core - download a fresh copy from wordpress.org and replace all core files and folders except wp-content and wp-config.php. This instantly removes any malware hiding in core files
2. Remove unknown plugins and themes - any plugin or theme you did not install yourself is suspect. Delete them
3. Update everything that stays - every plugin and theme to its latest version
4. Scan wp-content - look for suspicious uploads, strange PHP files in folders that should hold images, and base64-encoded code. A security scanner helps here

Step Four: Clean the Database

Malware often lives in the database - injected links in post content, spam admin users, rogue options. Use phpMyAdmin or a security plugin to:

• Search for injected links in wp_posts and wp_options
• Delete unknown users with admin roles and change all real passwords
• Check active plugins and themes in the options table for anything unfamiliar
• Look for eval() and base64 strings in content

Back up the database again before editing it, so a mistake is reversible.

Step Five: Close the Door

Cleaning without fixing the entry point means you repeat this whole process next month. Common entry points: outdated plugins, weak passwords, and admin logins left unprotected. Change every password - admin, database, hosting, FTP - enable two-factor authentication on the admin login, and remove any user accounts you do not recognize.

Step Six: Get the All-Clear

After cleaning, submit the site to Google Search Console for review if it was flagged. Ask your host to confirm the account is clean and any blocks are lifted. Keep monitoring for a few weeks: re-scan weekly, watch login attempts, and check that no new unknown users appear.

When to Pay Someone

Some infections are worth outsourcing. If the site redirects on a brand-new clean install, the malware is in the host account, the server or the network - beyond normal plugin cleaning. If you have no backup and the database is badly corrupted, a professional recovery may save months of content. Hosts with managed WordPress plans often include malware removal in the monthly price, which is the cheapest insurance.

The Prevention List

The cleanup ends where the prevention begins:

• Update everything every week - WordPress, plugins, themes
• Delete unused plugins and themes - old code is a common door
• Strong unique passwords plus two-factor login
• Limit login attempts to slow brute force
• Daily backups stored off-site
• A security plugin with file scanning and firewall

What I'd Actually Do

I would back up first, replace the core files, delete anything unfamiliar, clean the database with a scanner, change every password, and enable two-factor login - full sequence above in one evening. If the site was still redirecting after that, I would move it to a fresh install and restore only the content, or call in a professional before touching the host account further.

Final Takeaway

A hacked WordPress site is recoverable, and the recovery follows a fixed sequence: backup, confirm, clean files, clean database, close the door, rebuild defenses. The expensive version is the one where you skip steps and get re-infected. The cheap version is the one where you follow the order and keep backups so the next attack is an inconvenience instead of a disaster.

Also read: WordPress security checklist for beginners, how to back up a WordPress site for free, how to fix the WordPress white screen.