Malware Cleanup

Scanning a WordPress Site for Malware Before It Costs You Rankings

A defaced homepage is the obvious case — most WordPress infections hide quietly in plugin folders and core files for weeks before anyone notices.

24/7

Human support if you find an infection

Daily

Backups to roll back to before the infection

30-day

Money-back guarantee

Free

Migration to a clean host

In short

To scan WordPress for malware, run a dedicated scanner plugin such as Wordfence or Sucuri that checks core files against known-good checksums, then cross-check with a server-side scan from your host, since a browser-based plugin can't always see what a compromised file does at the file-system level. Look for unexpected admin users, unfamiliar PHP files inside upload folders, and core files flagged as modified since installation.

A clean scan report combined with matching checksums across core, theme, and plugin files is the strongest signal your site is actually malware-free.

WordPress malware rarely announces itself with a defaced homepage. More often it hides as an injected redirect that only fires for search-engine crawlers, a spam-link footer visible only when you view page source, a backdoor PHP file dropped into an images folder, or a mailer script quietly sending spam through your server in the background. By the time Google flags the site or a hosting provider emails about abuse complaints, the infection can be weeks old, which is exactly why a manual glance at the homepage isn't a scan.

A proper scan combines a WordPress-level scanner plugin, which understands core file checksums and common malware signatures, with a server-level scan from your host, which can see files a compromised wp-admin dashboard might be hiding from you. Hosting Cheap backs this process with daily backups so there's always a clean restore point to fall back to, 24/7 human support to help confirm a server-side scan result, and free managed migration if the safest fix turns out to be moving off a repeatedly compromised host entirely.

Signs Your WordPress Site Has Been Compromised

The obvious symptoms are a browser warning about a deceptive site ahead, a security label attached to your listing in search results, or visitors reporting they were redirected to a spam or pharmacy page instead of your content. Less obvious symptoms include a sudden spike in outgoing email from your server, the site feeling sluggish for no reason you can trace (often a sign of a background script running crypto-mining or spam code), or content quietly injected into your footer with hidden links pointing at other sites.

On the file side, watch for an admin account you didn't create, a modified wp-login.php, or unfamiliar files with a .php extension sitting inside your uploads folder — a location that should only ever contain images, documents, and media, never executable code. Unexplained additions to a theme's functions.php file are another common hiding spot for injected code.

Running a Scanner Plugin the Right Way

Install a scanner plugin such as Wordfence, Sucuri, or MalCare and run a full scan that compares your core WordPress files against known-good copies from the official repository. Review each flagged item individually rather than trusting a single summary count — a heavily customized theme file or a cached template can trigger a false positive, while genuinely dangerous signatures usually involve obfuscated code like base64_decode or eval wrapped around content that has no reason to be encoded.

Schedule recurring scans on a weekly basis rather than running one and forgetting about it, and pair the plugin scan with a manual look at recently modified files sorted by date through your file manager or FTP client — malware often touches only a handful of files, and sorting by modification date narrows the search fast.

Reading Scan Results Without Getting Lost in Noise

Most scanner reports group findings by severity: critical, suspicious, and informational. A single informational note about file permissions doesn't mean your site is compromised, but a critical flag on a core file or a match against a known backdoor signature deserves immediate attention. Work through critical items first rather than trying to clear every notice at once.

For anything flagged as suspicious, open the file in a code editor and look for the patterns that separate real infections from legitimate customizations: nested eval and base64_decode calls, gzinflate wrapped around unreadable strings, or str_rot13 used to obscure a payload. Comparing the flagged file against a clean copy from the official WordPress, theme, or plugin repository confirms whether it's been tampered with.

Removing Infected Files and Confirming the Site Is Clean

Once you've confirmed which files are genuinely infected, remove them rather than trying to patch the malicious code out by hand. Reinstall core WordPress files fresh through the 1-click installer in your cPanel-style panel, and replace affected themes and plugins from their original source rather than editing the compromised copy. Because malware frequently harvests credentials on its way in, change every password tied to the site afterward — WordPress admin, database, hosting or cPanel login, and FTP.

Run the scanner again after cleanup and confirm it comes back with zero flags before considering the job done. If cleanup turns out to be incomplete or the infection is too deeply embedded to trace confidently, restoring from a daily backup taken before the compromise is often faster and safer than continuing to chase individual files, and 24/7 human support can help confirm the server itself is clean once the WordPress layer is sorted.

How to Scan WordPress for Malware and Remove It

Why a Fast, Backed-Up Host Matters After an Infection

A slow host makes malware harder to deal with, not easier — full-site scans crawl on constrained shared resources, and a compressed backup download can time out right when you need it most. Pure NVMe SSD with LiteSpeed caching keeps a full scan and file comparison moving instead of stalling halfway through a large plugin directory.

Daily backups mean there's a real restore point from before the infection, not just a hope that cleanup goes perfectly, and 24/7 human support means you're not reading server logs alone at 2am trying to work out if a scan result is a false positive.

Daily backups you can roll back to if a cleanup goes wrong
24/7 human support to check server-side scan results with you
Free managed migration off a repeatedly compromised host
1-click reinstall of clean WordPress core files

Why Hosting Cheap

What you get

Daily backups

A restore point from before the infection, in case cleanup can't fully undo the damage.

24/7 human support

Real people to help confirm a server-side scan result, any time an infection turns up.

Free managed migration

Move off a host that keeps getting compromised without doing the transfer yourself.

NVMe SSD + LiteSpeed

Full-site scans and large file comparisons finish quickly instead of timing out.

Free auto-renewing SSL

A legitimate padlock so any browser warning traces back to content, not a lapsed certificate.

30-day money-back guarantee

Try a cleaner, better-supported host risk-free while you sort out the cleanup.

How It Works

Get set up in a few steps

Run a scanner plugin and a host-level scan

Combine a WordPress scanner with a server-side scan since neither sees everything alone.

Review flagged files and confirm true positives

Check obfuscated code patterns and compare against clean source files before deleting anything.

Remove infected files, reset credentials, then rescan

Clean up, change every password tied to the site, and confirm a zero-flag scan before moving on.

Included

Everything you need, on every plan

Scanner plugin installed and a full scan completed
Core WordPress files checked against official checksums
Uploads folder checked for unexpected .php files
Admin user list reviewed for unfamiliar accounts
All passwords changed: WordPress admin, database, hosting, FTP
Infected files removed or core files reinstalled clean
Site rescanned with zero flags before calling it resolved
A recent backup available in case cleanup needs a rollback

FAQ

Frequently asked questions

How do I know if my WordPress site has malware?

Common signs include browser warnings, a security label on your search listing, unexpected redirects to spam sites, unfamiliar admin accounts, and a sudden spike in outgoing email. A scanner plugin combined with a host-level scan confirms it rather than relying on symptoms alone.

Can a scanner plugin alone guarantee my site is clean?

Not entirely. A plugin scan checks what WordPress itself can see, but a compromised install can sometimes hide files from its own dashboard. Pairing it with a server-side scan from your host closes that gap.

Why do PHP files show up in my uploads folder?

That folder should only ever contain images, documents, and media. A .php file there almost always means malware dropped a backdoor script disguised as an upload, and it should be treated as a critical finding.

Will Google penalize me while my site is infected?

Search engines can flag infected sites with a warning label or remove them from results until they're confirmed clean, which directly costs traffic. Cleaning up quickly and requesting a review afterward limits how long that penalty lasts.

Should I reinstall WordPress core after a malware scan?

Yes, if any core file was confirmed modified. Reinstalling fresh core files through a 1-click installer is faster and more reliable than trying to manually undo changes to individual files.

How often should I scan WordPress for malware?

A weekly automated scan catches most infections early, with an additional scan after installing any new plugin or theme, since third-party code is the most common entry point for compromise.

Clean Host, Clean Restart

Move to hosting with daily backups, 24/7 human support and NVMe speed — from $2.09/mo, migration is free.

Get Started