How to remove malware from a hacked WordPress site

A hacked site pushes you to do something at once. WordPress's own advice starts in the opposite place: stay calm, and write down what you are seeing. The work has an order. Lock the site down, clean it, then find the way in. A site that is cleaned while the way in stays open can be broken into again the same way.

If you have a backup from before the break-in, read "Restore from a clean backup instead" further down before you clean anything by hand.

Confirm that the site was hacked

These are the signs WordPress's documentation treats as clear:

• A search engine or a browser shows a warning in place of your site.
• Your host has disabled the site, or tells you it is sending spam or attacking other sites.
• Visitors say their antivirus flags your pages.
• Something happened that nobody on your side did, such as a new user appearing.
• You can see it: pages show content you did not put there, or send visitors somewhere else.

Not every broken site is a hacked one. A blank page straight after an update points to a plugin conflict, not to a break-in.

Write down what you see, when you first saw it, and what changed on the site recently: a new plugin, an edit to the theme, a new user. Then ask your host. They may be able to confirm whether it is a hack at all, and whether other sites on the same account are affected.

A scanner shows more of the extent. One that reads the site from outside sees what visitors see, and a scanner plugin reads the files on the server. Neither finds everything. WordPress security plugins compared covers the plugin kind.

Lock the site down

Replace everything that has a clean original

Do not try to repair infected files. Anything that has an original gets deleted and put back from the original. Delete first, because copying fresh files over the top replaces the files that were changed and leaves the files that were added.

Restore from a clean backup instead

If you have a backup from before the break-in, restoring it is usually the better route. A restore puts back every file and the database as they were, so you do not have to find each thing the attacker changed. It replaces the file-by-file work above. Locking the site down and finding the way in still apply.

• The backup has to be older than the break-in, not older than the day you noticed. The first sign can come well after the first change. If you are unsure, go further back, and run the checksum commands above on what you restored.
• Restore into an empty folder. Delete the site's files first. You have the copy. Restoring over the top leaves planted files where they are.
• Whatever was added since the backup is gone. That means orders, comments, form entries and new posts. Content can be copied across by hand from the hacked copy. Files should not be, apart from media you have looked at.
• The hole is restored too. The backup holds the same out-of-date plugin, the old passwords and the old keys. Straight after restoring, change the passwords and the keys again and update everything.

Find how they got in

Look for the way in before the site goes back online.

• Out-of-date software. Once a fix for a hole is released, the hole is public, which leaves old versions more open to attack. Look in each plugin's changelog for a security fix you had not installed, then update everything. How to safely update WordPress has the order.
• A stolen or guessed password. Malware on your own computer can capture what you type. Scan every computer used to manage the site, and turn on two-factor authentication for every administrator.
• A plugin or theme from an untrusted source. A copy of a paid plugin that did not come from its author is not to be trusted. Remove it and get the plugin from the author.
• Another site on the same hosting account. A cleaned site beside an infected one may not stay clean. Every site on the account needs the same work.
• The access logs. Around the time of the first change, look for requests to files that should not exist.

If you cannot find it, the way in may still be open. Watch the site and scan it again over the following weeks.

When the site is clean, change every password and the secret keys once more, because the first change was made while the attacker may still have had access. Then put the site back online. The WordPress security guide covers what to tighten next.

Ask search engines to review the site

If Google has flagged the site, visitors see a warning in search results or a full-page warning in the browser. Cleaning the site does not remove it. You have to ask for a review.

In Google Search Console, open the Security issues report. If the site is not in Search Console yet, add it first. The report lists what Google found, with sample addresses. Fix the problem across the whole site, not only on the samples, then select "Request Review" and describe what you fixed. Google decides whether to lift the warning, and when.

Bing and the antivirus companies keep their own lists, each with its own request form. If your host suspended the account, ask which files they flagged, and when the site is clean send them the same description.

What a cleanup you do yourself can miss

The checks above show that WordPress and the plugins from WordPress.org match their originals. They show nothing about:

• the database, where injected scripts and spam links can sit inside posts and settings;
• a custom theme or plugin, when you have no original to compare it with;
• paid plugins, which WordPress.org holds no checksums for;
• the uploads folder, beyond the PHP files you looked for;
• anything on the hosting account outside WordPress, including other sites.

A backdoor can be one file, or a few lines inside a real one. Miss it and the attacker comes back without needing the original hole.

Stop and get help when:

• the infection returns after you have cleaned the site;
• you find code you cannot read and have no clean original to replace it with;
• you have no backup from before the break-in and the site runs custom code;
• the site holds customer accounts, orders or payment details;
• you cannot find how they got in.

Our malware removal service is a one-time clean-up with hardening, a blacklist removal request and a written report, and if the infection comes back within 30 days we clean the site again. Scanning, updates and backups from then on are what a care plan does, described under WordPress security.