WordPress Malware Removal Guide

Discovering that your WordPress site has been hacked is a stressful experience. You might see a red "Deceptive site ahead" warning from Google, find strange spam links in your footer, or notice a massive spike in server CPU usage due to crypto-mining malware.

This ultimate malware removal guide provides a precise, technical incident response plan. We will cover how to identify the infection, safely quarantine your environment, manually clean the database and core files, and implement post-incident hardening to ensure the hackers cannot return.

1. Incident Response: Containment

The moment you suspect a breach, you must act to contain the damage. A hacked site can actively spread malware to your visitors or be used to launch DDoS attacks against other servers.

Take the Site Offline (Maintenance Mode)

Do not allow visitors to access the infected site. You can force maintenance mode by creating a .maintenance file in your WordPress root directory containing the following PHP code:

<?php $upgrading = time(); ?>

Change ALL Passwords

Assume all credentials are compromised. Immediately change the passwords for:

• Your hosting control panel (cPanel, Plesk)
• SSH/SFTP accounts
• The MySQL database user
• All WordPress administrator accounts

2. Backing Up the Infected State

It sounds counterintuitive, but you must back up the hacked site before touching anything. If you make a mistake during the manual cleanup and break the site entirely, you need a restore point. A forensic backup also allows security professionals to analyze how the breach occurred later.

Use SSH or your hosting file manager to create a `.tar.gz` archive of the `public_html` directory and export the database via `mysqldump`.

3. Manual Core File Replacement

Hackers frequently modify WordPress core files (like wp-includes/functions.php or wp-settings.php) to hide their backdoors. Finding these modifications manually is nearly impossible.

The fastest and safest way to clean the core is to replace it entirely:

1. Download a fresh copy of WordPress from WordPress.org.
2. Delete the wp-admin and wp-includes directories from your server.
3. Upload the fresh wp-admin and wp-includes directories.
4. Upload the core files in the root directory (like wp-login.php), overwriting the old ones.
5. CRITICAL: Do not overwrite wp-config.php or the wp-content folder!

4. Cleaning the wp-content Directory

The wp-content directory contains your themes, plugins, and uploads. This is where 99% of malware resides.

Purging the Uploads Folder

The wp-content/uploads folder should only contain media (JPG, PNG, PDF, etc.). It should never contain PHP files. Hackers use vulnerable file upload forms to drop "web shells" (e.g., b374k.php or wso.php) here.

Run a search via SSH to find and delete all PHP files in the uploads directory:

find wp-content/uploads -type f -name "*.php" -delete

Reinstalling Plugins and Themes

Similar to the core files, do not try to manually clean infected plugins. Delete the plugin folder entirely via FTP/SSH and reinstall a fresh copy from the WordPress repository or the premium developer's website. If you manually modified a theme, you must compare it against a clean backup using a diff tool.

5. Cleaning the Database

Malware isn't just in files; it lives in the database. Attackers inject spam links, create rogue admin users, or insert malicious JavaScript into the wp_options or wp_posts tables (Stored XSS).

• Check Users: Go to the wp_users table in phpMyAdmin. Delete any administrators you do not recognize.
• Check Options: Hackers often change the siteurl or home options in wp_options to redirect your traffic. Verify these values are correct.
• Check Posts: Search the wp_posts table for common malware strings like <script src="http://evil... or base64 encoded payloads.

6. Automated Malware Cleanup with Nexura Security

Manual cleanup requires significant technical expertise and takes hours. Furthermore, if you miss a single backdoor, the hacker will reinfect the site the very next day.

Nexura Security Pro completely automates this process:

• Tokenizer-Based Scanner: Nexura uses PHP's AST engine to deeply analyze code structure, finding heavily obfuscated malware that regex scanners miss.
• One-Click Auto-Fix: If malware is found in a core file or recognized plugin, Nexura can automatically download a clean version and replace the infected file.
• AI Deep Scan: Suspicious files are sent to Cloudflare/OpenAI for deep AI analysis, generating instant patches for zero-day injections.

7. Post-Incident Hardening

Once the site is clean, you must ensure it stays clean. Implement these mandatory steps:

1. Regenerate your WordPress SALT keys in wp-config.php to force all users to log in again.
2. Update all plugins, themes, and WordPress core to their latest versions.
3. Install a Web Application Firewall (WAF) to block the vulnerability that caused the breach in the first place.
4. Submit your site to Google Search Console for a malware review to remove the "Deceptive site ahead" warning.