WordPress Malware Removal: A Developer’s Step-by-Step Guide to Fixing a Hacked Website

A practical incident-response checklist for WordPress developers, freelancers, and website owners dealing with malware, malicious redirects, backdoors, and recurring infections.

Imagine receiving this message from a client:

"My WordPress website is redirecting customers to another website. I've already installed a security plugin, but the problem keeps coming back. Can you fix it?"

This is the kind of situation where a structured recovery process matters.

A hacked WordPress website may contain more than one malicious file. Attackers can modify PHP scripts, inject content into the database, create unauthorized administrator accounts, or establish hidden persistence mechanisms.

Simply deleting the first suspicious file you discover may not resolve the underlying problem.

Effective WordPress malware removal requires investigation, containment, careful cleanup, and post-recovery verification.

In this tutorial, we'll walk through a practical approach to handling a compromised WordPress installation, including a few useful WP-CLI commands.

Disclosure: This article was drafted with AI assistance. Technical instructions should be reviewed and tested by the author before publication.

1. Identify the Signs of a WordPress Malware Infection

The first challenge is confirming that the website has actually been compromised.

Common symptoms include:

• Visitors unexpectedly redirecting to suspicious domains.
• Google displaying dangerous website warnings.
• Unknown administrator accounts appearing in WordPress.
• Unexplained PHP files appearing in upload directories.
• Malicious JavaScript being inserted into website pages.
• Spam pages appearing in Google search results.
• Hosting providers reporting malicious activity.
• The same infection returning after an earlier cleanup.

However, not every unusual website behavior indicates malware.

A broken redirect rule, outdated plugin, or server configuration error can produce similar symptoms.

The goal is to collect evidence before modifying the installation.

Developer tip: Record affected URLs, timestamps, recent deployments, and any relevant security alerts. These details can help distinguish a genuine compromise from an ordinary technical problem.

2. Contain the Incident Before Starting Malware Removal

If a compromised website is actively delivering phishing pages, malicious downloads, or redirects, protecting visitors should be the immediate priority.

Depending on the situation, you may need to:

1. Restrict public access to affected functionality.
2. Coordinate temporary isolation with the hosting provider.
3. Preserve relevant access and error logs.
4. Restrict compromised accounts.
5. Review any potentially exposed customer information.

Avoid making unrecorded changes to the production website.

Every modification can affect your ability to understand how the incident occurred.

For WooCommerce websites, also review the potential impact on checkout systems, payment integrations, and customer accounts.

Important: If sensitive information may have been compromised, incident response may require privacy, legal, and payment-provider involvement.

3. Preserve the WordPress Files and Database

Before beginning the cleanup, create a secure investigation copy when practical.

Preserve:

• WordPress application files.
• The WordPress database.
• Upload directories.
• Relevant server configuration.
• Access and error logs.
• The current list of installed themes and plugins.

Store the investigation copy somewhere isolated and restrict access.

Remember that a backup taken after the compromise may contain malware.

Do not automatically restore an unverified backup to production.

When an older clean backup is available, compare it with the compromised installation to identify unexpected changes.

For active business websites, also consider data created after the backup, such as orders, bookings, and contact enquiries.

4. Check WordPress Core File Integrity Using WP-CLI

WordPress core files are a useful place to begin technical investigation.

If WP-CLI is available in a controlled environment, you can verify core files against official WordPress checksums.

Run the command from the appropriate WordPress installation directory:

wp core verify-checksums

This compares WordPress core files against checksums supplied by WordPress.org.

If unexpected file modifications are detected, investigate them before taking corrective action.

Checksum verification can also identify certain missing or altered files.

However, a successful verification does not prove that the entire website is malware-free.

It does not comprehensively inspect custom plugins, database content, or every possible persistence mechanism.

You can find additional command options in the official WP-CLI checksum documentation.

5. Inspect Installed Plugins for Unexpected Modifications

Plugins are another important part of WordPress malware investigations.

First, review all installed plugins.

Look for unfamiliar extensions, plugins installed from untrusted sources, and components that are no longer maintained.

For plugins distributed through WordPress.org, WP-CLI provides a useful checksum verification command:

wp plugin verify-checksums --all

This attempts to verify installed plugin files against their official checksums.

Be aware that premium, custom, and privately distributed plugins may not have official WordPress.org checksums.

A checksum warning is not automatically proof of malware.

Likewise, successful verification of supported plugins does not rule out infection elsewhere.

For custom components, compare files against a trusted source repository or a known-clean release.

Investigate unexpected file changes before replacing anything.

6. Investigate Unknown Administrator Accounts

An attacker who gains sufficient access may create a new WordPress administrator account.

These accounts can allow continued access even after the original vulnerability has been addressed.

To review administrators using WP-CLI:

wp user list --role=administrator

This displays accounts assigned the administrator role.

Review the usernames, registration dates, and available account information.

If you encounter an unfamiliar account, confirm whether it belongs to an authorized employee, contractor, hosting provider, or development team.

Do not automatically delete it.

Security consideration: Many WP-CLI operations load WordPress code. On a compromised installation, plugins or other modified components may execute unexpectedly. Run investigative commands only in an appropriately isolated environment and understand the execution risks.

After confirming unauthorized access, document the account and coordinate its removal with credential rotation and other recovery steps.

Also inspect hosting, SSH, SFTP, and connected service accounts.

7. Investigate Backdoors and Malware Persistence

One of the biggest reasons WordPress malware returns is that the original cleanup did not remove the attacker's ability to regain access.

Common persistence locations include:

• Modified plugin or theme files.
• Unexpected executable files in media directories.
• Compromised WordPress configuration files.
• Malicious database entries.
• Unauthorized administrator accounts.
• Suspicious scheduled tasks.
• Modified server configuration.
• Must-use plugins or other automatically loaded components.

Attackers may attempt to hide malicious code inside otherwise legitimate-looking files.

But be careful: unfamiliar or obfuscated code is not always malicious.

Legitimate commercial plugins can contain minified or encoded components.

Before removing a suspicious file, establish what it does, whether it belongs to a legitimate application component, and whether a trusted original exists.

A complete malware removal investigation asks two questions: What was changed, and how did the attacker gain access?

Without answering the second question, reinfection remains a possibility.

8. Check for Malicious Redirects and SEO Spam

Malicious redirects are especially damaging to business websites because they directly affect visitors.

Some redirect infections behave differently depending on:

• The visitor's device.
• The referring website.
• Browser cookies.
• Whether the visitor is logged in.
• The specific page being requested.

This means the website may appear normal during an administrator's own tests.

When investigating redirects, inspect relevant application code, database content, server rules, and external scripts.

For SEO spam, review search results associated with the website.

A useful starting point is:

site:example.com

Replace example.com with the affected domain.

Look for unexpected pages or titles that the website owner did not create.

If suspicious URLs appear, investigate their origin before removing them.

An infected database or persistent backdoor can recreate spam content after a superficial cleanup.

Google Search Console's Security Issues report can also provide useful information about problems detected by Google.

9. Perform a Controlled WordPress Malware Cleanup

Once the affected components and likely entry points have been identified, prepare a cleanup plan.

A typical recovery may involve:

1. Replacing compromised WordPress core files using trusted distributions.
2. Reinstalling affected plugins and themes from verified sources.
3. Removing confirmed malicious files and database injections.
4. Eliminating identified backdoors and unauthorized persistence.
5. Removing unauthorized accounts and access permissions.
6. Addressing the exploited vulnerabilities or stolen credentials.
7. Updating affected software after compatibility testing.
8. Verifying that important website functionality still works.

Perform significant modifications in an isolated recovery environment when possible.

Always consider the impact on customized themes, plugins, and business-specific functionality.

Blindly deleting suspicious files can break legitimate features or remove evidence needed to understand the incident.

Successful WordPress malware removal is not just deleting malware. It means restoring the website to a trustworthy operational state.

10. Secure the Website Against Reinfection

After removing the identified compromise, strengthen access and configuration.

Review the following areas.

Authentication: Use unique passwords, enable multifactor authentication where supported, revoke unauthorized sessions, and rotate affected credentials.

WordPress updates: Keep core, plugins, and themes updated. Test compatibility before significant production changes.

Plugin management: Remove unnecessary extensions and use trusted, maintained software.

File permissions: Apply appropriate permissions and avoid unnecessary write access.

Backups: Maintain secure, tested backups stored separately from the website.

Monitoring: Configure suitable alerts for suspicious login activity, unexpected file changes, and other security indicators.

Hosting: Review the server environment and investigate any evidence of broader compromise.

No single plugin or firewall configuration can guarantee permanent security.

The objective is to reduce risk and improve detection and recovery.

11. Verify the Recovery Before Reopening the Website

Before concluding that cleanup is complete, test the website thoroughly.

Use a checklist:

• [ ] WordPress core integrity has been checked.
• [ ] Affected plugins and themes have been reviewed.
• [ ] Known malicious files and injections have been addressed.
• [ ] Unauthorized administrator access has been removed.
• [ ] Identified persistence mechanisms have been eliminated.
• [ ] Credentials and access permissions have been secured.
• [ ] Redirect behavior has been retested.
• [ ] Website forms and notifications function correctly.
• [ ] Important business pages load as expected.
• [ ] WooCommerce operations are tested where relevant.
• [ ] Relevant Google security warnings have been reviewed.
• [ ] Post-recovery monitoring is in place.

If Google previously flagged the website, review its Security Issues report and request reconsideration through the appropriate process after fixing the problems.

Remember that search-engine warnings and indexing decisions are controlled by the relevant search engine.

A technically successful cleanup cannot guarantee an immediate change in search visibility.

12. When Should You Escalate WordPress Malware Removal to a Specialist?

Some website infections can be investigated and resolved by experienced WordPress administrators.

Others require deeper analysis.

Consider specialist assistance when:

• Malware repeatedly returns after cleanup.
• The initial compromise cannot be identified.
• Unauthorized server access is suspected.
• The database contains extensive injected content.
• The website has complex custom development.
• Important WooCommerce functionality is affected.
• The hosting account has been suspended.
• Customer data or sensitive operations may be involved.

For agencies and freelancers, recognizing when an incident exceeds the available investigation resources is an important part of protecting clients.

Escalation can be especially useful when business-critical functionality must be restored while preserving evidence and minimizing additional damage.

Professional Recovery Resource

If you are investigating a compromised client website or need assistance with a complex WordPress recovery, I provide website security recovery services through NithuDev.

My work includes investigating identified malware, backdoors, malicious redirects, SEO spam, and related WordPress security issues. The investigation and recovery scope are agreed before work begins.

You can review the available options here:

NithuDev — WordPress Malware Removal & Hacked Website Recovery

This is my own commercial service. For an incident assessment, share the website URL and non-sensitive symptoms first; do not send passwords publicly.

Final Thoughts

WordPress malware removal is an incident-response process, not just a file-deletion task.

The most important stages are:

Detect → Contain → Preserve → Investigate → Clean → Harden → Verify

A reliable investigation considers website files, database content, administrator access, hosting configuration, and possible persistence mechanisms.

For developers and website owners, understanding these steps can improve recovery decisions and reduce the risk of repeating the same mistakes.

The objective is not simply to get a clean malware scan.

It is to restore a working website, understand the compromise, and strengthen the systems that support it.

Useful Technical References

• WordPress.org — FAQ: My Site Was Hacked
• WP-CLI — Core Checksum Verification
• WP-CLI — Plugin Checksum Verification
• Google Search Central — Preventing Malware Infection

About the author: Nithu / Suthakaran Nithursan is a WordPress developer and website security recovery specialist at NithuDev, working on website troubleshooting, hacked-site recovery, and security-related repairs.

AI disclosure: This article was prepared with AI writing assistance.