Redirects to sites you've never heard of. An admin user you didn't create. Google showing a red warning page. Your host emailing about suspicious activity.
The instinct is to start deleting things. Don't — not yet. The order matters here more than in almost any other WordPress problem, because the wrong first move destroys the evidence you need to stop it happening again.
Six phases. Work them in sequence.
The short version
- Contain — stop the damage spreading
- Preserve evidence — before you clean anything
- Find the entry point — or you'll be back here in a fortnight
- Clean or restore — the honest comparison
- Close the door — change every credential
- Get delisted — request a Google review
The rule that governs all of it: cleaning without finding the entry point means being reinfected. That's the mistake that turns one bad week into three.
Phase 1 — Contain
Fast, before anything else.
Take the site offline if it's actively redirecting visitors or serving malware. Maintenance mode, or a holding page at the server level. You're protecting your visitors and your reputation, and a site that's serving malware to customers is a bigger problem than a site that's briefly down.
Change your hosting and FTP passwords immediately, from a machine you trust.
Tell your host. Most have a security team, some will scan for free, and if a neighbouring account on shared hosting was the source, they need to know. They may also have logs you can't see.
Don't change your WordPress admin password yet — that comes in phase 5, after cleaning. Changing it now while an attacker still has file access achieves nothing.
Phase 2 — Preserve the evidence
The step everyone skips, and the one that determines whether this happens again.
Take a full backup of the compromised site — files and database. Yes, including the malware.
Two reasons. If cleaning goes wrong, you can start again rather than having destroyed the only copy. And the compromised files contain timestamps and code that tell you how they got in.
Download your logs while they exist. Access logs and error logs, from your hosting control panel. Hosts rotate these — often within days — and once they're gone, so is your ability to trace the entry point.
Note the timeline. When did you first notice? When did traffic change? When did your host or Google flag it? File modification timestamps compared against that window narrows things quickly.
Phase 3 — Find the entry point
If you skip this, you will be reinfected. That's not a warning, it's just what happens.
Check file modification dates. Via FTP or SSH, sort by date modified. Files changed at a time you weren't working are your starting point. Malware often clusters in /wp-content/uploads/, in theme files, or in plugin directories.
Check for unfamiliar admin users. Users → All Users, and also check the wp_users table directly via phpMyAdmin — some compromises create users hidden from the admin interface.
Check for vulnerable plugins. Look up every installed plugin against the WPScan Vulnerability Database or Patchstack's database. You're looking for a known vulnerability in the version you were running, disclosed before your compromise.
This is the most common answer by a distance. Patchstack's 2026 report found 91% of WordPress vulnerabilities are in plugins, with a weighted median of five hours from disclosure to mass exploitation — so an unpatched plugin is very often the door.
Check for abandoned plugins and themes. Anything not updated in years, including inactive themes still sitting in your install.
Check your logs for requests around the modification timestamps — repeated POST requests to a specific plugin path, or unusual activity from one IP.
Check whether it was credentials. Successful logins in your access logs from unfamiliar locations point at stolen or reused passwords rather than a vulnerability.
Phase 4 — Clean or restore?
The genuine decision point, and it depends on two things: when the compromise started, and how confident you are in your backups.
Restore from backup — when it works
Good when: you have a backup from before the compromise, you know roughly when it started, and you can afford to lose content added since.
The catch: if the compromise went undetected for three weeks, a three-day-old backup contains it. This is why keeping a rolling series of backups matters rather than just the most recent.
And restoring alone doesn't fix anything if the entry point was a vulnerable plugin — you've restored the vulnerable plugin too. Patch or remove it before or immediately after restoring.
Clean manually — when restoring isn't an option
Reinstall WordPress core from a fresh copy. Replace all core files except wp-config.php and /wp-content/.
Reinstall every plugin and theme from official sources rather than trying to disinfect them. Delete the folders and install fresh copies. Anything you can't reinstall cleanly — an abandoned plugin, a nulled theme — should be removed entirely.
Clean /wp-content/uploads/. No PHP file belongs in your uploads directory. Any .php file there is almost certainly malicious.
Check wp-config.php and .htaccess for injected code, usually at the top or bottom.
Check the database for injected content — spam links in posts, unfamiliar entries in wp_options, unexpected admin users.
Regenerate your security keys in wp-config.php, which invalidates every existing session.
Or hire someone
Worth saying plainly: professional malware removal is a legitimate expense. Sucuri, Wordfence, and Patchstack all offer paid cleanup, and a business site losing revenue while you learn malware forensics is a false economy.
When to hire rather than DIY: the site is commercial, the compromise is extensive, you can't find the entry point, or it's been reinfected after a previous cleanup.
Phase 5 — Close every door
After cleaning, before going live.
Change every password: WordPress admins, hosting, FTP/SFTP, database (updating wp-config.php), and any connected service.
Regenerate security keys in wp-config.php if you haven't.
Delete unfamiliar users, and audit legitimate ones — downgrade anyone who doesn't need Administrator.
Patch or remove whatever let them in. The actual fix.
Enable 2FA on every admin account. How.
Scan again to confirm you're clean. A second scan after cleaning catches what the first missed.
Phase 6 — Get delisted by Google
If Google flagged your site, cleaning doesn't automatically clear the warning.
Open Search Console → Security Issues. It reports what Google detected — often naming affected URLs, which is genuinely useful for confirming you cleaned everything.
Once you're confident the site is clean, click Request Review. You'll write a short description of what happened and what you fixed.
What to write: be specific and honest. What the compromise was, how it got in, what you did to clean it, and what you changed to prevent recurrence. "A vulnerability in [plugin] version X allowed file injection; the plugin has been updated, all core and plugin files reinstalled, malicious files removed, credentials rotated, and 2FA enabled" is the kind of thing that gets processed.
Timing: reviews typically take a few days. If it fails, you missed something — go back to Search Console's report for the URLs still flagged.
Also check your host hasn't blocklisted you, and run your domain through a blocklist checker in case the compromise sent spam and damaged your email reputation too. Delisting.
Afterwards
Watch closely for a month. Reinfection usually shows up quickly if you missed the entry point.
Set up monitoring — file change detection, uptime monitoring, and a security plugin that alerts you.
Fix the thing that made you vulnerable, which is usually plugin count and update discipline rather than any single failure.
Test your backups properly. If this incident revealed your backups were incomplete or too infrequent, that's the lesson worth acting on. Doing them properly.
Frequently asked questions
Should I restore from backup or clean it?
Restore if you have a backup from before the compromise started and can afford to lose content added since — it's faster and more reliable than manual cleaning. The catch is that compromises often go undetected for weeks, so a recent backup may already contain the infection. Either way, restoring alone doesn't help if the entry point was a vulnerable plugin, since you've restored the vulnerable plugin too. Patch it before going live.
How do I get delisted by Google?
Clean the site completely, then open Search Console → Security Issues and click Request Review. Write a specific description of what the compromise was, how it got in, what you cleaned, and what you changed to prevent recurrence. Reviews typically take a few days. If it fails, Search Console will show which URLs are still flagged — that's where you missed something.
How did they get in?
Most likely a vulnerable plugin — Patchstack's 2026 report found 91% of WordPress vulnerabilities are in plugins, with a weighted median of five hours from public disclosure to mass exploitation. Other common routes are stolen or reused credentials, an abandoned plugin or theme, and compromised hosting. Find yours by checking file modification dates, looking up your plugin versions against a vulnerability database, and reading your access logs — and do this before cleaning, because cleaning destroys the evidence.
What to do next
Before you delete a single file, take a full backup of the compromised site and download your access logs.
I know it feels wrong to preserve malware. But those files and logs are the only record of how they got in — and without that, you'll clean the site, feel relieved, and be back here in two weeks.
Free: The WordPress maintenance checklist.
Related guides
- WordPress security without a sysadmin — preventing the next one
- WordPress backups — the restore option you'll wish you had
- Auditing plugins for security risk — finding the entry point
- Two-factor and login hardening — closing the credential route
- Email blocklists — if the compromise sent spam
Join the Newsletter
Get practical marketing tactics delivered straight to your inbox.
Written by
Muhammad Basim
Related Articles
Transactional Email Services Compared for WordPress
Every one of these services will deliver your password resets. That's not the differentiator. What differs is setup difficulty, what the free tier covers, how good the logs are when something goes wrong, and — the one people never consider until it bites them — whether the service also handles marketing mail, and whether you […]
Contact Form Notifications Not Arriving: Every Cause
Here's the version of this problem that costs the most: it's been happening for months and you don't know. The form says "thank you." The visitor believes they've reached you. You believe nobody's been in touch. There's no error, no bounce, no alert — just an absence, and absences are invisible. Most of the time […]
WooCommerce Order Emails Going to Spam: The Fix
"I never got a confirmation. Did my order go through?" Every store owner gets this message. And when it arrives often enough, you stop treating it as customer confusion and start realising your receipts genuinely aren't landing. This costs more than most email problems, because a missing order confirmation doesn't just annoy someone — it […]