Last updated: October 23, 2026
WordPress malware removal is a recovery process: contain the incident, preserve evidence, identify what changed, restore trusted components and close the access route that allowed the intrusion. Deleting a suspicious file alone is not enough to establish that a website is clean.
If your site is redirecting visitors, showing unfamiliar pages or triggering malware warnings, contact your hosting provider and record what you see. This guide helps an owner organize that conversation. It is not a forensic diagnosis or a substitute for professional incident response.
First response: what to do before cleanup
| Priority | Action | Purpose |
|---|---|---|
| Contain | Ask the host to restrict the affected service appropriately | Limit continued harm |
| Preserve | Save logs, symptoms and a snapshot | Keep evidence for investigation |
| Investigate | Identify unauthorized changes and access | Understand scope and cause |
| Recover | Restore trusted content and components | Return a usable service |
| Verify | Review access, patching and recurrence | Check that the response is complete |
This ordering is an editorial response framework. Your responder may change the sequence depending on ongoing harm, available evidence and the hosting environment.
1. Confirm the symptoms without guessing the cause
Write down affected URLs, the first known time, screenshots of warnings and recent changes. Distinguish what you observed from what you suspect. “Visitors report a redirect from this page” is more useful than “the whole server has a virus.”
WordPress’s hacked-site documentation recommends documenting symptoms and working with the host. Ask whether the problem is limited to your installation or affects the account or server.
Do not assume an infection came through the October 2026 PHP flaws; our PHP2Shell vulnerability guide covers how to confirm your host has patched them.
2. Contain the incident with your host
Explain whether visitors are being redirected, malicious content is being served or accounts are changing without permission. Ask the provider to help contain the affected environment while preserving access for investigation.
WordPress maintenance mode is a presentation feature; do not assume a maintenance page isolates compromised server code. Ask what is actually restricted and how the responder can continue their work.
For an online store, record the business functions affected and decide who will communicate verified service information to customers. Avoid announcing a cause or a data breach before the investigation establishes it.
3. Preserve a recovery and investigation record
Keep a protected snapshot of the affected files and database, relevant server logs and a timeline of actions. Label an infected snapshot clearly so nobody restores it as a clean backup later.
Record who performed each action and when. If you use a cleanup service, ask what evidence it needs before changing the environment. This is especially useful when several people or providers are involved.
Do not post configuration files, database exports or complete logs publicly to ask for help. They can contain credentials and customer information. Share necessary evidence through the responder’s agreed secure channel.
4. Investigate files, accounts and the database
A file scan is one input. The investigation should also consider unauthorized accounts, content changes and the services that can alter the site. Ask the responder to identify what was found, what was reviewed and what remains uncertain.
Wordfence documents malware scanning among its tools. The Sucuri plugin listing describes remote scanning and file-integrity monitoring. Their coverage differs, so a clean result from one check should not be interpreted as a complete forensic clearance.
Preserve suspicious samples for the responder instead of executing them. Ask for a finding list that separates confirmed malicious changes from unfamiliar but legitimate application files.
5. Restore trusted components and content
Discuss two recovery routes: restoring a known-clean backup or rebuilding the affected environment from trusted sources. The right choice depends on the scope, backup history and data that changed after the recovery point.
For a store, identify orders or customer records created after the proposed backup. Plan how to preserve legitimate business data without carrying malicious changes into the recovered site.
Ask the developer to obtain replacement application components from their official source. Custom code needs separate review. Removing one visible payload does not explain how the attacker entered or whether persistence remains elsewhere.
6. Close the access route and reset access
Ask for the likely entry point and the evidence behind that conclusion. Possible findings require different fixes; avoid a generic “cleaned” result with no explanation of the cause.
Coordinate account resets, session revocation and replacement of affected secrets with the responder. Include hosting and file-transfer access where relevant. WordPress’s recovery documentation covers access controls and logged-in sessions; the appropriate scope depends on what was exposed.
After recovery, use our WordPress security checklist to assign patching, account review and backup responsibilities. Prevention tasks need an owner after the cleanup contractor leaves.
7. Verify the recovered site before declaring completion
Test key pages, login, forms and checkout. Recheck the original symptom from the conditions in which it appeared. Ask the responder to review logs and explain what monitoring will continue.
Keep a completion record with the recovery point, components replaced, access changes and outstanding issues. A homepage that loads is not proof the cleanup is finished.
If Google reports a security issue, follow its Security Issues report guidance. Request review only after the reported problems have been addressed. Removing the warning does not by itself bring rankings back.
How to choose a WordPress malware removal service
Ask providers for their scope, evidence-preservation approach, cleanup deliverables, recovery support and recurrence policy. Confirm whether server-level investigation is included or whether the work stops at WordPress files.
Price alone is a poor comparison when one service only scans and another investigates and rebuilds. Ask what is excluded and who handles your host. Our security plugins comparison also distinguishes tools from hands-on response.
Frequently asked questions
Can I remove WordPress malware for free?
You may have useful free tools and host support, but the work still requires time and judgment. Establish the scope before deciding whether you can safely handle it.
Will updating WordPress remove malware?
Do not rely on an update as a complete cleanup. You still need to investigate unauthorized content, access and persistence.
Should I restore the latest backup?
First establish whether it predates the compromise. The newest backup may already include the infection.
Why does my site keep getting hacked?
Recurrence suggests an unresolved access route, remaining malicious changes or another compromised component. Ask for a root-cause investigation rather than repeated symptom removal.
Keep the recovery evidence
A useful outcome is a functioning site plus a written explanation of what changed and what was fixed. Keep that record with your maintenance plan so the next person responsible for the site can understand the incident.