Your antivirus flags your own site as dangerous, or a customer calls to say your page redirected them to a shady ad. The diagnosis is in: your WordPress site is infected with malware. The question that really matters is how to clean it up without breaking anything or leaving a trace of the problem behind.

This is a technical job, but it follows a logic that is accessible even without being a developer, as long as you work through it in order and do not skip steps in a panic. Rushing to delete files at random is often the worst response: it can break the site without even removing the infection.

This guide walks through the method to follow, from the first observation to safely going back online.

Cleaning WordPress malware means backing up the infected state, precisely identifying the malicious code in the files and the database, removing it or restoring clean versions, then changing every access credential to prevent immediate reinfection.

Confirming it really is malware

Before turning everything upside down, verify the problem is actually an infection. Free online tools like Sucuri SiteCheck scan your URL and give a first assessment. Alongside that, check Google Search Console: a "security issues" message there usually confirms an infection Google itself has detected. These symptoms, combined with unexpected redirects or unfamiliar indexed pages, form a reliable body of evidence.

Backing up the site before any intervention

Even while infected, your site should be backed up before any manipulation. This backup acts as a safety net: if the cleanup goes wrong, you can roll back and start over with a different approach. Back up both the files (via FTP or the hosting panel) and the full database.

Scanning the site with a specialized tool

Plugins like Wordfence, Sucuri, or MalCare scan your entire installation and compare it against known reference versions. They spot:

  • files that differ from the official WordPress version
  • "foreign" files that are not part of the core, the theme, or any legitimate plugin
  • encoded or obfuscated scripts, a classic signature of malicious code
  • backdoors that would let the attacker return even after a partial cleanup

This scan gives you a precise list of files to examine, rather than searching blindly through thousands of lines of code. Run more than one scanner when you can: no single tool catches every variant of malicious code, and a second opinion often surfaces something the first one missed.

Cleaning infected core, theme, and plugin files

For WordPress core files, the safest approach is to reinstall a clean, official copy, downloaded directly from WordPress.org, overwriting the existing files (except wp-config.php and the wp-content folder). Do the same for themes and plugins: reinstall the official version from its original source rather than trying to fix a file line by line. If an abandoned or outdated plugin turns out to be the entry point, replace it for good with a maintained alternative.

Checking and cleaning the database

Malware does not always hide in files: some infections inject code directly into the database, particularly in posts, widgets, or configuration options. Look for suspicious <script> tags, links to unknown domains, or administrator accounts created without your consent in the users table. A security plugin can automate part of this search, but a manual review of sensitive areas is still recommended.

Changing every password and regenerating security keys

Once the cleanup is done, change every password immediately: WordPress admin, hosting account, FTP, database, and linked email accounts. Also regenerate the security keys in the wp-config.php file using WordPress's official generator. This step stops an attacker who kept a foothold from returning with the old credentials.

Requesting a review from Google if needed

If Google displayed a security warning on your site, it does not disappear automatically after the cleanup. You need to submit a review request through Google Search Console, confirming the infection has been fixed. Processing time ranges from a few days to a few weeks. You can find more detail on this process in our article on recovering a hacked WordPress site.

When to call in a professional

A basic scan and a clean reinstall are enough for many simple infections. But some malware is built to resist cleanup, with backdoors hidden in seemingly harmless files or scripts that reinstall themselves automatically. If the infection persists after a first attempt, or if you lack the time or technical skills to see the process through, a WordPress security professional will identify and remove what the automated tools may have missed. Our guide to securing a WordPress site for good rounds out this process once the cleanup is complete.

Frequently asked questions

Is a free security plugin enough to clean up malware? For a simple, recent infection, often yes. For an older infection or one with multiple backdoors, additional manual or professional work is generally needed.

Can the cleanup break my site? If done poorly, yes: deleting a legitimate file by mistake can cause a blank page. That is why backing up beforehand and using a file-comparison tool are essential.

How long before the site looks clean to Google again? Once the review request is submitted and accepted, the warning usually disappears within a few days to a few weeks.

Does your WordPress site look infected? Relax by Yumea cleans your site, removes the malware, and secures your access. Describe your issue, the diagnosis is free.