WordPress Malware Keeps Coming Back?
Find What Is Recreating It.
Deleting a malicious file doesn't always remove the mechanism that recreates it. Nexura Security analyzes file writers, scheduled tasks, MU-plugins, drop-ins and configuration paths to help identify the persistence source.
Why Does WordPress Malware Keep Coming Back After Deletion?
WordPress malware can return after deletion when another compromised component is still able to recreate it. The persistence mechanism may be a malicious PHP file, scheduled task, MU-plugin, drop-in, database-stored payload, compromised credential, or server configuration.
Deleting the visible malware removes the symptom, but the site can become reinfected if the mechanism that recreated it remains active. Attackers typically rely on 5 common persistence vectors:
A secondary script invoking file_put_contents(), fwrite(), or base64 decoding that writes fresh payloads to disk.
An orphaned or stealth cron event in the wp_options table or hosting crontab that triggers recurring writer scripts.
Scripts in wp-content/mu-plugins/ or rogue drop-ins (db.php, advanced-cache.php) executing before normal plugins.
Stealth auto_prepend_file instructions inside .user.ini, .htaccess, or wp-config.php executing code before WordPress boots.
Hidden administrator accounts, compromised database credentials, or external access keys allowing automated re-infection from outside.
Anatomy of the Self-Healing Malware Loop
Why file deletion alone leaves the site vulnerable to recurring reinfection.
The Hidden Anchor
Attacker plants an innocent-looking script in mu-plugins, a fake drop-in, or disguised inside .user.ini.
The Heartbeat
A scheduled wp_cron job or linux crontab executes periodically in the background every 10 to 60 minutes.
The File Writer
The anchor executes file_put_contents() or fetches a remote base64 payload to write cache.php.
The Illusion
Webmaster or antivirus spots cache.php and deletes it. The site appears clean for 5 minutes.
The Resurrector
The cron fires again. The anchor sees cache.php is missing and instantly regenerates it!
Select Your Reinfection Symptom
Click the exact issue you are facing to uncover the hidden mechanism behind it.
If Malware Comes Back, Follow This Order
A systematic, 12-step incident investigation sequence to locate the persistence source before wiping or restoring.
Document the exact file path and name that reappears (e.g. wp-content/uploads/cache.php).
Record how long after deletion the file reappears (minutes, hours, or during specific traffic/cron windows).
Premature deletion removes timestamps and execution relationships needed to trace the parent writer.
Inspect files modified around the same window to spot coordinated secondary payloads.
Examine recurring hooks in wp_options for orphaned or obfuscated scheduled triggers.
Check wp-content/mu-plugins/ and files like db.php or object-cache.php.
Analyze PHP code invoking file_put_contents(), touch(), or remote downloaders.
Audit configuration files for auto_prepend_file or rogue rewrite rules.
Change WordPress admin passwords, database user credentials, SFTP/SSH keys, and security salts.
Isolate the generator script rather than only the file it continually recreates.
Reinstall WordPress core and plugins with pristine checksum-verified copies from official sources.
Monitor file integrity and scheduled hooks over subsequent 24-to-72 hour operational cycles.
What Security Communities Commonly Recommend for Recurring WordPress Malware
Community discussions across forums like Reddit r/Wordpress and Stack Overflow often start with: “Restore from a clean backup or rebuild the site.” That advice can help, but it does not address every persistence mechanism on its own.
The Backup Challenge
Restoring a backup can fail when the backup snapshot already contains the dormant persistence mechanism or modified database hook planted weeks before spam symptoms became visible.
The Rebuild Complexity
Rebuilding a site from scratch can be time-consuming, particularly for complex WooCommerce, membership, or customized enterprise installations where data loss is unacceptable.
Effective Remediation Combines:
Sysadmin CLI Diagnostic Cheatsheet
If you have SSH / Terminal access to your server (Nginx, GridPane, RunCloud, cPanel), run these commands to manually inspect common persistence paths.
find wp-content/ -type f -name "*.php" -mtime -2
Useful for spotting newly regenerated files or hijacked legitimate plugin files.
grep -rnEi "(file_put_contents|fwrite|touch)\s*\(" wp-content/mu-plugins/ wp-content/themes/
Finds PHP code that uses common file-writing functions. Review the results in context because legitimate plugins may also use these functions.
wp cron event list --fields=hook,next_run_gmt,recurrence
Look for suspicious hook names with random characters or orphaned hooks from deleted plugins.
grep -Rni --exclude-dir=vendor --exclude-dir=node_modules "auto_prepend_file\|auto_append_file" .user.ini .htaccess wp-config.php 2>/dev/null
Checks user and directory configuration for pre-boot includes. On servers with CLI access, you can also run: php -i | grep -E "auto_prepend_file|auto_append_file"
Automate Persistence Investigation with Nexura
Nexura Security inspects these persistence layers systematically inside the WordPress environment, tracing likely writers and scheduled hooks without manual terminal digging.
How Nexura Investigates Recurring Malware
Nexura doesn't just scan static files. It conducts an evidence-based investigation starting from the returning file and inspects the 6 critical vectors commonly leveraged for persistence.
1. PHP Token-Based Writer Analysis
Scans your codebase using PHP token-based analysis (token_get_all) to identify scripts executing file_put_contents(), fwrite(), touch(), or remote downloading routines.
2. Stealth MU-Plugin Audit
Must-Use (wp-content/mu-plugins) load before standard plugins and never appear in the WordPress admin plugin list. Nexura deep-scans every MU-plugin for persistence hooks.
3. WP-Cron & Hook Persistence
Inspects scheduled cron jobs using dynamic reflection. Legitimate crons from active plugins are verified, while orphaned hooks or those invoking unverified files in uploads/ or root directories are flagged.
4. Disguised Drop-ins
Inspects db.php, object-cache.php, and advanced-cache.php. Verifies whether active caching plugins (LiteSpeed, Redis, WP Rocket) own them or if they are rogue hijackers.
5. Server Config Directives
Audits .user.ini, .htaccess, and wp-config.php for stealth auto_prepend_file or auto_append_file directives that execute malware before index.php.
6. Visual Relationship Graph
Renders an interactive canvas mapping the relationship between the returning file, candidate writer scripts, trigger cron events, and remote downloaders in clear visual context.
Inside the Reinfection Investigation Interface
The returning malware target being investigated (e.g., cache.php).
Detected persistence candidates, potential file writers, and cron hooks linked to the target.
Safely isolates and quarantines persistence scripts with encrypted backup and verification.
What Nexura Can and Cannot Detect
Clear boundaries of what is covered inside WordPress versus investigations that require hosting-level or credential intervention.
| Persistence Vector / Investigation Area | Detection Capability | Availability & Prerequisites |
|---|---|---|
| PHP File Writers & Downloaders Scripts calling file_put_contents, fwrite, touch, or remote downloaders. | Full Token Analysis | Included in Free Core |
| MU-Plugins & Disguised Drop-ins Code in wp-content/mu-plugins/ and drop-in files (db.php, advanced-cache.php). | Deep Inspection | Included in Free Core |
| WordPress Scheduled Cron (WP-Cron) Orphaned hooks, suspicious recurrences, and rogue cron schedules in database. | Hook Registry Audit | Included in Free Core |
| Pre-Boot Directives (.user.ini / .htaccess / wp-config) auto_prepend_file or auto_append_file directives executing before WordPress boots. | Config File Audit | Included in Free Core |
| Server-Level Linux Crontab (/etc/cron*) System crontabs executing external PHP CLI scripts outside WordPress. | Permission-Dependent | Pro (Requires server read access) |
| Nginx & PHP-FPM Vhost Directives Web server directives pointing fastcgi_param to malicious prepends. | Permission-Dependent | Pro (Requires vhost config read access) |
| Compromised Database / Hosting Accounts Attacker accessing phpMyAdmin, cPanel, or external database port directly. | External Investigation Required | Requires hosting credential rotation |
| Malware Outside WordPress Web Root Files placed in parent server directories above the open_basedir boundary. | Filesystem Boundary Dependent | Depends on PHP isolation rules |
Nexura Free vs. Nexura Pro
Nexura Free gives you full diagnostic visibility to discover why malware keeps returning. Nexura Pro gives you automated root-cause isolation and server-level investigation capabilities.
| Capability / Security Feature | Free Core | Pro Edition |
|---|---|---|
| Full-Site Persistence & Self-Healing Audit Scans all files, crons, and configurations for persistence vectors. | Included | Included |
PHP Token-Based File Writer Analysis
Detects file_put_contents, fwrite, and string obfuscation.
|
Included | Included |
| WP-Cron & Hook Reflector Dynamic reflection across active WordPress plugins and themes. | Included | Included |
| Interactive Relationship Network Graph Visual canvas mapping target and persistence vector relationships. | Included | Included |
| Exact Evidence & File Location Paths Reveals exact file paths and line numbers without masking. | Masked (•••••) | Fully Unmasked |
| 1-Click Root-Cause Neutralization Automatically isolates and quarantines the persistent scripts safely. | Manual Editing Required | 1-Click Automated |
| Runtime File-Change Monitoring Monitors WordPress filesystem events for unauthorized modifications. | — | WordPress-Level Monitoring |
| Server Crontab & Server Config Audit Server-level persistence checks. Available when the hosting environment grants required file access. | — | Pro & Agency |
| Priority Emergency Cleanup Assistance Direct hands-on triage from senior Nexura security engineers. | Community Support | Priority Support |
Why Upgrade to Nexura Pro?
Hunting down multiple cross-linked persistence scripts manually can be time-consuming and risks breaking legitimate site functionality. Nexura Pro isolates the persistence chain and moves quarantined files into an encrypted vault with 1-click restore.
Frequently Asked Questions
Technical answers to help you understand and defeat persistent WordPress infections.
Why does malware keep coming back after I delete it in WordPress?
Malware returns because deleting the malicious file (such as cache.php or an infected index.php) only removes the visible symptom. Attackers install persistence mechanisms—such as hidden file writer scripts, scheduled WP-Cron hooks, rogue MU-plugins, or server directives in .user.ini—that automatically recreate the deleted file shortly after.
What is WordPress self-healing malware?
Self-healing malware is an attack pattern where two or more malicious scripts or hooks monitor each other. If one file is deleted, a secondary process detects its absence and immediately generates a fresh copy using base64-encoded strings, remote servers, or file_put_contents. Standard file cleaners can struggle when they only evaluate files in isolation.
Why can malware return even after a security scan?
A file scan can identify and remove a malicious file without necessarily identifying every mechanism that could recreate it. Persistent infections may involve scheduled tasks, must-use plugins, modified configuration files, compromised credentials, or other execution paths. For recurring infections, the investigation needs to examine both the malicious file and the mechanism that recreated it.
Will restoring from a clean backup fix recurring malware?
Restoring a backup can fail when the backup already contains the persistence mechanism. In many persistent infections, dormant backdoors, rogue cron entries, or modified user roles were planted weeks before visible symptoms appeared. Restoring an older backup often restores the dormant backdoor, allowing reinfection to continue.
Does Nexura work on Nginx, Apache, LiteSpeed, and managed WordPress hosting?
Yes. Nexura is designed for WordPress sites running on Apache, Nginx, LiteSpeed, OpenLiteSpeed, and common managed hosting environments (including GridPane, RunCloud, Kinsta, and Cloudways). Core WordPress-layer checks operate in all environments, while server-level crontab and web server configuration audits require elevated hosting permissions.
What happens if I quarantine a file by mistake?
Nexura never deletes files permanently without an encrypted backup. Quarantined files are safely encrypted and moved into a protected vault. You can restore any quarantined file with 1 click from the Nexura dashboard at any time.
Stop the Reinfection Cycle Today
Don't waste another weekend manually deleting recurring files. Run Nexura Security right now to analyze persistence mechanisms and isolate the root cause.
100% Free Core on WordPress.org · Cancel Anytime · Instant License Activation