How to Scan WordPress for Malware and Clean a Hacked Website

A WordPress website can run normally for months and then suddenly start behaving strangely. You might notice spam pages appearing in Google, redirects to suspicious websites, new admin users you did not create, hosting warnings, or a sudden drop in traffic. In many cases, these are signs that malware has been added to the site.

This is one of the more stressful problems website owners deal with because it affects SEO, trust, and sometimes even email delivery. I have also seen situations where the site still looked normal on the front end while hidden malware was quietly sending spam or creating backdoor access in the background — most hacked sites are infected through outdated plugins, weak passwords, or abandoned themes rather than a flaw in WordPress itself, and the good news is that most infections can be identified and cleaned if you work through the process carefully rather than taking shortcuts that leave infected files behind.

The Short Version

To scan WordPress for malware: back up the website first, then scan files and the database using a security plugin or hosting malware scanner. Once you’ve identified infected files, remove the malicious code, replace compromised core files, themes, or plugins with clean copies, reset every password connected to the site, and update everything. Once it’s clean, tighten security settings to prevent reinfection — a partial cleanup that only removes the visible symptoms is the single biggest reason malware comes back.

Signs Your Website May Be Infected

Some warning signs are obvious — unexpected redirects, browser security warnings, a hosting suspension notice. Others are easy to miss: spam pages quietly indexed in Google that you never created, a new admin account you don’t recognise, unfamiliar files sitting in your uploads folder, files modified without explanation, or a website that’s simply grown noticeably slower for no clear reason. Google Search Console is worth checking directly too — a security warning there, or pages you never wrote suddenly showing up as indexed, is a strong sign the site has already been compromised.

Left unaddressed, an infection doesn’t just sit there quietly. It can damage search rankings, trigger Google’s own security warnings on your listing, redirect visitors to scam pages, send spam email from your domain, slow the site down, create hidden admin accounts, and — if you’re not careful — get baked into every backup you take afterward.

Back Up Before Touching Anything

Create a full backup — files, database, uploads, themes, and plugins — before you change anything. If you don’t have one already, follow the guide on how to back up a WordPress website before starting cleanup. Even an infected backup is worth having: it gives you a way to recover important content if something breaks during the cleanup itself. If your host offers backups on its own dashboard, download a copy locally before you continue, rather than relying only on their retention window.

If the infection is actively affecting visitors — redirecting them, or serving spam content — putting the site into maintenance mode temporarily limits the damage: it stops further visitor redirects, further spam activity, further unwanted file modifications, and search engines indexing more infected pages while you work. A simple maintenance plugin is enough for this.

Scanning for the Infection

For most site owners, a WordPress security plugin is the easiest way to scan. Wordfence, Sucuri Security, Solid Security, and MalCare are the common options, and a good one checks core WordPress files, plugins, themes, malware signatures, unexpected file modifications, and backdoors. When I set this up on client sites, I usually start with Wordfence, since it highlights modified files clearly and makes it easy to spot what actually changed. Run a full scan rather than a quick scan — a quick scan trades thoroughness for speed in exactly the situation where thoroughness matters most.

Replace Core Files Rather Than Editing Them

A common mistake is trying to manually clean individual infected core files one at a time. It’s faster and far more reliable to download a fresh copy of WordPress from WordPress.org, delete every core folder except /wp-content/ and wp-config.php, and upload the clean copy in its place. This removes many infections hiding inside core directories in one pass — just don’t overwrite anything without a backup already in hand first.

Inspecting Plugins and Themes

Outdated or nulled (pirated) plugins are one of the single most common infection sources, so this step deserves real scrutiny: look for plugins you no longer use, themes you don’t recognise, disabled plugins left installed anyway, and anything abandoned by its developer. Delete anything unnecessary outright. If you suspect a specific plugin or theme is actually infected, delete it completely, download a genuinely fresh copy from the official source, and reinstall — I generally recommend removing inactive plugins entirely rather than leaving them sitting on the server unused.

Checking Uploads and the Database

The /wp-content/uploads/ folder should contain media files and essentially nothing else. Hackers often plant malicious PHP files inside it specifically because most site owners never think to look there — watch for .php or .phtml files, randomly named files, or folder structures that don’t match a normal media library, since a genuine image folder has no business containing executable scripts.

Some malware injects directly into the database instead of the file system — hidden spam links, injected JavaScript, redirect scripts, and SEO spam pages are the common patterns. You can inspect the database via phpMyAdmin, your host’s own database tools, or a security plugin’s built-in scanner, watching specifically for eval(, base64, unexplained iframe tags, and any admin user account you don’t recognise. Editing database entries directly carries real risk, so proceed carefully and lean on your backup if something goes wrong.

Closing the Door After Cleanup

Once the site is clean, reset every credential connected to it immediately — WordPress admin accounts, hosting account, FTP/SFTP, database password, and any email account tied to the domain. A hacked admin account left untouched can quietly reinfect the site even after every file has been cleaned. While you’re in there, remove unused user accounts, review who actually holds administrator access, enforce strong passwords, and enable two-factor authentication if your setup supports it.

Outdated software is one of the main paths back to reinfection, so update WordPress core, every theme, every plugin, and your hosting’s PHP version. If a plugin hasn’t been updated in a long time, replacing it outright is often the safer call than continuing to run it. Finally, if Google flagged the site as unsafe in Search Console, confirm the infection is genuinely gone before requesting a security review — Google can take several days to clear the warning even after a clean bill of health.

Practical Tips

Restoring a clean backup is sometimes genuinely faster than a full manual cleanup — but always scan an old backup before restoring it, since older infections can already be sitting inside it undetected. Avoid nulled plugins and themes entirely; the short-term savings routinely turn into a much larger security problem down the line. Good hosting providers add a real extra layer here too — malware scanning, firewall protection, file monitoring, and automatic backups beyond whatever WordPress plugins you’re already running. And once you’re past the immediate cleanup, a security plugin that monitors file changes going forward means the next infection, if there ever is one, gets caught in hours rather than months.

Common Mistakes

Cleaning only the visible symptoms. Removing spam pages without finding the actual backdoor that let the attacker in almost always leads to reinfection within weeks.

Leaving old, inactive plugins installed. An inactive plugin can still be exploited directly if a known vulnerability exists in its code — deactivating it doesn’t remove the risk, only deleting it does.

Ignoring user accounts. An unfamiliar administrator account is one of the clearest warning signs of a compromise, and it’s often the first thing to check, not the last.

Skipping password resets. Even a genuinely clean site can be compromised again immediately if the attacker still holds valid login credentials from the original breach.

Restoring an infected backup. More common than most people realise — always scan a backup before restoring it, rather than assuming an older copy is automatically safe.

Security Plugin vs Professional Cleanup

For smaller, contained infections, a security plugin and the process above is usually enough. Professional cleanup is worth the cost when the site keeps getting reinfected despite a proper cleanup, when hosting access itself may be compromised, when multiple sites on the same server are infected simultaneously, when a search engine has blacklisted the domain outright, or when you genuinely can’t pin down the infection source after a real attempt. On a business site carrying SEO traffic or ecommerce revenue, professional cleanup can save far more time and money than it costs.

If you need direct file access to remove infected files yourself, having FTP already configured matters — how to upload files to WordPress via FTP covers connecting FileZilla to your hosting account and navigating the WordPress file structure.

Conclusion

Scanning WordPress for malware comes down to identifying infected files, replacing compromised components with clean copies, resetting every credential connected to the site, and improving security so the same door doesn’t stay open. The part most cleanups get wrong is stopping at the visible symptoms rather than tracing the actual source. In most WordPress sites I build, regular updates, reliable hosting, real backups, and disciplined plugin management prevent the vast majority of these problems before they ever start — and a WordPress firewall adds one more layer, blocking malicious requests before they ever reach the site at all.