WordPress Malware Scan & Removal

The Problem

Your site is sending spam, redirecting visitors, flagged by Google, or just "feels wrong" — WordPress infections often hide in theme files, plugins or even the database, surviving a surface-level cleanup.

About this problem

WordPress infections persist because malicious code is rarely in one place. It is commonly injected into theme files, hidden in the uploads folder, added as a rogue plugin, stored in database options or posts, or planted as backdoor scripts that reinstall the infection after a cleanup. The entry point is often an outdated plugin, a nulled theme or a stolen password.

People usually come looking for this when Google or the host flags the site, visitors are redirected to unfamiliar pages, spam is sent from the domain, or unknown admin users appear. Often the earlier attempt with a security plugin cleaned up the visible part but the problem returned.

What's Included

• Full scan of files, themes, plugins and the database for malicious code
• Removing identified malware and any backdoors found
• Updating core, themes and plugins to patch the entry point used
• A written summary of what was found and how it likely got in

What's NOT Included

• Guaranteeing against reinfection if underlying vulnerabilities (weak passwords, outdated plugins) aren't also fixed
• Requesting Google/browser blacklist removal (can be added if needed)
• Rebuilding a site that's too badly damaged to clean (would be flagged upfront)

How It Works

1. I take a full backup of the infected files and database so that nothing is lost and the original state can be reviewed.
2. I compare core files against the official WordPress release and scan themes, plugins and uploads for injected code, obfuscated scripts and unexpected PHP files.
3. I search the database for malicious content in posts, options, widgets and user tables, and check for unknown administrator accounts.
4. I remove the identified malware and backdoors, and replace core, theme and plugin files with clean copies from official sources where possible.
5. I update WordPress, themes and plugins, and reset salts and affected passwords so that existing sessions and stolen credentials stop working.
6. I rescan the site, check the front end and admin as a normal visitor, and write a summary of what was found and the likely entry point.

In practice: you buy the service, send over whatever access or details the job needs, I investigate and do the work, and you confirm it's resolved before we call it done.

Frequently Asked Questions

How do I know if my WordPress site has been hacked?

Common signs are unexpected redirects, spam pages, new admin users, security warnings from Google or your host, and files you do not recognise. A scan of the files and database confirms it.

Can you guarantee it will not be infected again?

No. If the original weakness, such as weak passwords or outdated plugins, is not also fixed, reinfection can happen. I update what is vulnerable and point out the rest in the summary.

Will you remove my site from Google's blacklist?

Requesting review is not part of the base service but can be added if needed.

What if the site is too damaged to clean?

If it would be more sensible to rebuild, I will say so upfront. A rebuild is not part of this service.

Do you scan the database as well as files?

Yes, the files, themes, plugins and the database are all checked, since infections often hide in database content.

Will my site go offline while you clean it?

I work to keep downtime minimal, but if the site is actively harming visitors it may be better to put it in maintenance mode while the cleanup is carried out.

Is server-level security included?

The work focuses on the WordPress site. Server-wide hardening is a separate matter.