Discovering malware on your site is one of the worst experiences in running a website. The site you have spent years building has been compromised. Your visitors might be at risk. Your search rankings are about to drop. Your hosting account might get suspended.
The good news is that malware infections are recoverable. The work is messy and stressful, but the path back to a clean site is well-known. This piece covers how to detect malware, how to clean it, how to recover, and how to prevent reinfection.
Recognizing a Malware Infection
The first challenge is knowing you have a problem. Many infections are designed to be invisible.
Direct Signs
Sometimes the infection is obvious. The site has been defaced. Strange ads appear. Visitors get redirected to other sites. Browser warnings appear when people visit.
These are the easiest infections to recognize because they affect what users see.
Indirect Signs
More commonly, the signs are subtle. Performance has degraded for no apparent reason. Strange files appear in your hosting account. Unfamiliar admin accounts show up. Search rankings drop suddenly. Outgoing traffic spikes without explanation.
Each of these can indicate infection.
Reports From Others
Sometimes you find out about an infection from outside sources. Google flags your site in search results. Your host notifies you. A customer reports getting strange behavior. Your antivirus software warns about your site.
These external reports often catch infections that you would not have noticed otherwise.
Scan Results
Active scanning catches many infections. Wordfence, Sucuri, MalCare, and similar tools scan for malware patterns. When they find something, they alert you.
How Sites Get Infected
The most common infection vectors come up repeatedly.
Outdated Software
Plugins, themes, or WordPress core with known vulnerabilities get exploited. Attackers run automated scans for sites running vulnerable versions.
This is the most common infection vector.
Weak Credentials
Brute force attacks against weak passwords succeed. Once attackers have admin access, they install malware.
Compromised Hosting Account
If credentials for hosting control panel, FTP, or SSH get stolen, attackers can upload malware directly.
Malicious Plugins or Themes
Software downloaded from unofficial sources sometimes contains malware. Nulled plugins (pirated versions of premium plugins) are common sources of malware.
Shared Hosting Cross-Contamination
On shared hosting, sometimes a compromise on one site spreads to others on the same server. Hosts with poor isolation are vulnerable.
Server-Level Compromise
Less commonly, attackers compromise the hosting infrastructure itself. This affects multiple sites on the same servers.
Initial Response to Detection
When you discover malware, the response matters.
Confirm the Infection
Before declaring an emergency, confirm the issue is actually malware. False positives happen. Run multiple scanners. Check the specific files or behavior that triggered the alert.
A real infection deserves urgent response. A false positive does not.
Document What You Know
Note when the issue was first detected. What did the warnings say? Which files are affected? What behavior was observed?
This documentation helps with the cleanup and any necessary notifications later.
Take the Site Offline If Necessary
If the malware is actively serving harmful content to visitors, take the site down. A maintenance page is better than infecting customers.
Some hosts will do this automatically when they detect malware.
Change Credentials Immediately
Assume the attacker has stolen credentials. Change all passwords. Hosting account, WordPress admin, FTP, database, anything connected.
Use a different secure device to change passwords, since the compromised machine might be infected too.
Backup the Compromised State
Before cleanup, take a backup of the current compromised state. This sounds counterintuitive, but it preserves evidence in case you need it later.
The backup also protects you if cleanup goes wrong.
The Cleanup Process
Cleaning malware is methodical work.
Restore From a Clean Backup
If you have a backup from before the infection, restoring is usually the fastest path to recovery. The backup is clean. Restoring brings the site back to that clean state.
The challenge is knowing when the infection started. Restore from too recent a backup and the malware comes back. Restore from too old a backup and you lose legitimate content changes.
Manual Cleanup If No Backup
Without a clean backup, you have to clean the infection manually. Find and remove all malicious files. Find and remove malicious database content. Find and remove backdoors that maintain access.
This is detailed work and easy to miss things.
Use Specialized Tools
Wordfence, Sucuri, MalCare, and similar tools can identify and sometimes automatically remove malware. They are more reliable than manual cleanup.
For WordPress sites, these tools are usually the right starting point.
Consider Professional Cleanup
If the infection is severe or persistent, professional cleanup services like Sucuri, MalCare’s premium service, or Wordfence Care handle the work for you.
Cost is usually a few hundred dollars. Worth it for confirmed compromises where you need to know it is fully clean.
Hosting Account Cleanup
Beyond the site, the hosting account may need cleanup. Files outside the WordPress installation. Email accounts that may have been compromised. Database tables that should not exist.
A full account audit catches things that focus on just the site might miss.
What to Look For
Specific patterns appear in infected sites.
Unfamiliar Files
Files in directories where they should not be. Files with random names. Files modified recently when nothing should have changed.
For WordPress, common malicious file locations include /wp-content/uploads/, /wp-includes/, and the root directory.
Modified Legitimate Files
Sometimes malware modifies legitimate WordPress core files rather than adding new files. The file looks like a normal WordPress file but contains malicious code.
Tools like Wordfence compare your files against the WordPress source to identify modifications.
Database Modifications
Malware sometimes lives in the database. Modified wp_options entries. Malicious widget content. Spam comments containing scripts.
Database cleanup is part of full malware removal.
Backdoor Accounts
Attackers often create admin accounts for themselves. Check all admin accounts. Remove any you do not recognize.
Scheduled Tasks
Some malware uses scheduled tasks to maintain access. Check WordPress cron jobs. Look for unfamiliar entries.
Modified .htaccess
The .htaccess file sometimes gets modified to redirect visitors or block legitimate traffic. Compare to a clean backup or default version.
After Cleanup
The work continues after the immediate cleanup.
Verify Complete Removal
Run multiple scanners after cleanup. Confirm nothing remains. Check the site manually. Browse it as a visitor. Look for anything unusual.
Partial cleanup is worse than no cleanup because you think you are safe when you are not.
Update Everything
After cleanup, update WordPress core, all plugins, and themes. The infection likely came in through outdated software. Updating closes that door.
Reset All Credentials Again
Even though you changed credentials during initial response, change them again after cleanup. Attackers with backdoor access might have observed the new credentials.
Add Security Layers
Implement the security measures that would have prevented the infection. WAF, 2FA, security monitoring, regular updates. The pieces in this series cover each of these.
Check Search Console
Google may have flagged your site or removed it from search results. Submit a reconsideration request through Search Console after cleanup is complete.
The process takes days to weeks. Be patient.
Submit to Blacklist Removal Services
If your site got blacklisted, request removal from the relevant services. Google Safe Browsing, Norton Safe Web, McAfee SiteAdvisor, and others have removal request processes.
Notify Affected Parties
Depending on what the malware did, you may have notification obligations. Customer data exposed? Payment information accessed? Consult legal counsel about requirements in your jurisdiction.
Preventing Reinfection
Sites that get infected once often get infected again if the underlying issues are not addressed.
Identify How It Happened
Investigate how the infection got in. Was it outdated software? Compromised credentials? Vulnerable plugin? Knowing the entry point lets you close it.
Strengthen the Weak Point
If it was outdated software, set up automatic updates. If it was weak credentials, enforce strong passwords and 2FA. If it was a specific plugin, remove or replace it.
Implement Active Monitoring
Active scanning catches future infections fast. Set up Wordfence, Sucuri, or similar tools with real-time monitoring.
Regular Audits
Periodic security audits catch issues before they become breaches. The earlier piece in this series covered security audits.
Backup Discipline
Reliable backups limit damage from future incidents. Daily backups, off-site storage, tested restores.
Common Cleanup Mistakes
People stumble in predictable ways.
Incomplete Cleanup
Removing the obvious malware but missing backdoors. The attacker returns through the backdoor and reinfects.
Use professional tools or services to ensure complete removal.
Not Updating Software
Cleaning the malware but leaving the vulnerability that let it in. Reinfection within days or weeks.
Not Changing All Credentials
Assuming only some credentials were compromised. The attacker still has access through others.
Ignoring Hosting Account
Cleaning the site but not the hosting account. Malware in places outside the site stays.
Not Adding Defenses
Cleaning and reset without adding new defenses. The same attack succeeds again.
Hiding the Issue
Not telling customers when you should. The damage compounds when discovered later.
Closing Thoughts on Malware Recovery
Malware infections are stressful but recoverable. The work is methodical and well-understood. Sites recover and run successfully for years after thorough cleanup.
For most infections, professional cleanup is worth the cost. The few hundred dollars for a Sucuri or similar service is small compared to the cost of an incomplete cleanup leading to reinfection.
After cleanup, the security improvements that prevent the next infection are the most important investment. The cleanup addresses the symptoms. The security work addresses the cause.
Sites that get infected and respond well end up more secure than they were before the infection. The incident forces attention that leads to better practices. The sites that ignore the underlying issues get infected repeatedly.
If you discover malware on your site, do not panic but do act. Take the site offline if needed. Change credentials. Get professional help for the cleanup if your skills are limited. After cleanup, implement the security measures that would have prevented the infection. The path back to a clean site is real. The path forward to a more secure site starts with the lessons of the incident. Sites that take both seriously end up in good shape. The recovery is uncomfortable but the destination is worth the work.
