How to Remove Malware From WordPress Site [Guide]

Updated on July 24, 2024 by Editorial Team

Looking for the step-by-step process to remove malware from WordPress site? This detailed guide is for you.

Being a popular open-source platform that powers over 800 million websites worldwide, WordPress is often vulnerable to cyberattacks. Indeed, statistics suggest that every 1 in 25 websites had been infected in 2022, the most common type of infection being malware.

Malware refers to any malicious software used by hackers to exploit a website. Left unchecked, it can damage your website and steal sensitive business information, affecting its reputation.

So, it becomes extremely important to be aware of malware attacks and act quickly to prevent future attacks.

Knowing how to identify and remove malware from your WordPress website can help you ensure the security of your website and its contents.

In this article, we’ll walk you through the step-by-step process to remove malware from WordPress site.

Table Of Content

What is Malware in WordPress?

Malware is an umbrella term for any malicious software designed to damage a computer system or website. It can infect your website through viruses, worms, or spyware.

As for WordPress websites, malware attacks in WordPress can affect the website’s performance, its web server, and user experience and even negatively impact the site’s SEO performance.

Even though regular maintenance of your website and the use of security plugins can prevent most attacks, your website might still be vulnerable to malware attacks.

What are the Most Common WordPress Malware Infections?

While there are various malware infection types active on the internet, not all of them affect WordPress.

Here are the most common WordPress malware infection types you should be aware of-

  • Backdoors

As the name suggests, this malware lets a hacker access a website by creating a backdoor entry.

Once an attacker finds a vulnerability – a weak password or an insecure admin panel, they can plant a backdoor in the website and use it to gain unauthorized access.

  • Pharma Hacks and Spam Content

Attackers can use SEO spam or spamdexing on a website to manipulate the search engine results and ranking and divert traffic to other websites for shady promotions.

In most cases, these infections are well-hidden and hard to detect.

  • Hacktools

Hacktools are software applications designed to gain unauthorized access to a computer system, network, or website.

These allow attackers to perform DoS (Denial of Service) attacks, service-level exploits, and other illicit tasks to harm a website.

  • Phishing

Phishing is a technique hackers use to get people’s sensitive information through fraudulent activities via emails or websites.

Attackers pose as well-known businesses to trick people into sharing information like their login credentials, contact, or bank account details.

It can seriously affect a website’s reputation and its performance.

How to Remove Malware from WordPress site [7-Step Guide]

Here is the step-by-step process to remove WordPress malware from your website-

1. Backup Your Website Files and Database

Hacked websites not only pose a security threat, but they can also put your essential files at risk.

Before you begin the WordPress malware removal process, backup all your website files so that if anything breaks, you can restore your data easily.

Backup your wordpress site how to remove malware from wordpress site [guide] from the plus addons for elementor

The backup includes two aspects of your website – the WordPress database, where the website settings, content, and user information are stored. And your files, which include the plugins, images, and themes of your website.

If you still have access to your website, you can manually backup your WordPress files and database using a reliable plugin.

There are tons of free plugins available on WordPress that will allow you to backup critical data within minutes.

Conversely, if you don’t have access to your website and are using a hosting service, you can contact the provider for website database backup.

Looking for an easy method to back up your WordPress website? Look at these 5 Best WordPress Backup Plugins for quick backup and restore.

2. Scan Your Website

If you suspect a malware attack on your website, the next step is identifying the infection that has affected your website.

To do this, use the WordPress scanner plugin to scan your website for malware threats. The process is likely to take only a couple of minutes.

Alternatively, you can use a URL scanner to know if your website is infected with malware. This includes scanning your WordPress database, files, and source code.

For this, scan for any suspicious activities in the following folders-

  • WordPress Core: These are your WordPress files that must be scanned for any potential security issues.
  • The .htaccess file: This is a hidden file that you can access if you have an FTP client with access to the hidden file view.
  • The wp-content folder: This folder contains the uploaded website files, themes, and plugins and can contain malware infections.
  • The wp-config.php file: This file has your WordPress site’s username and password.

Additionally, once you’ve backed up your WordPress core files, consider deleting all the files in the public_html folder to remove malware.

You can do this via your hosting provider and stop the malicious code from affecting data on your site.

3. Consult with Hosting Provider

Your hosting provider can also help you remove malware files from your website.

Contacting your web hosting provider regarding the malware attack is important, especially if you’re on a shared hosting plan.

The hosting provider can scan your website and server to identify malware. In addition, they can guide you through removing malware from your website without affecting its content or performance.

4. Uninstall and Reinstall the Latest Version of WordPress

If you have a corrupted WordPress version, the next step would be to uninstall and reinstall the latest version of WordPress to clean your hacked website.

Ensure you’ve installed the same version as before to allow your website to work properly.

First, download the latest version of WordPress from wordpress.org. Access the WordPress files and replace the ‘wp-admin’ and ‘wp-includes’ folder.

Now, connect with your FTP client or use your file manager to upload all the WordPress files to your server to overwrite the existing installation.

Here’s how you can do this –

  • Create an FTP connection with your web server.
  • Navigate to the wp-content folder in the root directory. Right-click on it and select
  • On your hosting provider’s panel dashboard, go to website> Auto Installer. Select WordPress, enter the installation details, and check the Overwrite Existing Files.
  • Back on your FTP client, refresh the directory list, and reupload the downloaded wp-content folder.

Also, edit the wp-config.php file to get the database from your website. This will easily transfer all the new files to your existing websites without the malware.

5. Reinstall Themes and Plugins

Once you’ve removed all the unwanted website files and reinstalled the fresh WordPress version and core, it’s time to reinstall your website themes and plugins.

Navigate to the WordPress plugin repository and download the required plugins again to avoid using infected core files again.

Also, reinstall a cleaner version of your WordPress theme from the library.

However, if you’ve been using a child theme for your website, you’ll need to reinstall a cleaner version of the parent theme while keeping the customizations of your child theme intact.

Follow these steps to do so-

  • On your WordPress dashboard, go to Appearance > Themes and deactivate your parent theme.
  • Go to your File Manager or FTP client and delete the parent theme folder.
  • Next, search for your theme in the WordPress library, download and activate it.
  • Alternatively, if you’re using a premium theme from a third-party source, download the theme and go to Appearance > Themes.
Themes how to remove malware from wordpress site [guide] from the plus addons for elementor

  • Here, select Add New > Upload Theme to upload your theme and activate it.

Apperence 2 how to remove malware from wordpress site [guide] from the plus addons for elementor

  • Now activate your child theme, and you should be able to run the latest version of the parent theme with all your customizations.

6. Recover the Password and Permalink

Once your WordPress installation is complete, the next step is to recover your WordPress username, password, and permalinks.

After resetting your username and password, go to Settings > Permalinks and click on Save Changes. This will restore your .htaccess file, and your URLs will run accurately.

However, while recovering your username and password, if you notice any unknown user account indicating unauthorized access, contact a WordPress security partner to detect hidden malware and remove unknown user access.

7. Use Security Plugins

Once you’ve successfully replaced your WordPress core files, database, themes, and plugins with a cleaner version, it’s best to install and run a security plugin.

You can find many free security plugins in the WordPress library that will alert you of any security issues or malware attacks.

The best WordPress security plugins create a web application firewall that prevents malware from breaking into your website. This helps you stay on top of your website security and ensure it doesn’t fall victim to hacking attempts again.

How to Protect Your Website from Future Malware Attacks?

When it comes to your website’s security, knowing how to remove malware from your website is not enough. If your website has been attacked once, it’ll likely get reinfected again.

So, it’s better to know how you can prevent a malware attack in the first place.

Here are a few actions you can take –

1. Update WordPress Regularly

Outdated WordPress themes and plugins are how hackers often gain access to a website.

Since WordPress is an open-source platform, security patch updates are regularly released to address any vulnerabilities in the platform.

In addition, all the third-party plugins and themes are also maintained regularly with the latest security and functional updates.

So, update your website regularly to protect it from hackers and WordPress viruses.

2. Change Your Password

Another good way to keep hackers away from your website is to change your WordPress password and database credentials regularly.

Further, it is important to limit user access to your website to avoid security vulnerabilities.

To change your WordPress password, go to Users > Profile on your WordPress dashboard.

Change your password how to remove malware from wordpress site [guide] from the plus addons for elementor

Under Account Management, click Set Password to set a new password, and click on Update Profile.

After setting a strong password, log out of all active sessions on your website.

Set new password how to remove malware from wordpress site [guide] from the plus addons for elementor

3. Schedule Frequent Backups

Frequent website backups are the key to maintaining the security of your website. Ideally, you should take daily or weekly real-time backups of your WordPress website to ensure maximum security.

The backup frequency can vary depending on how often you update your website.

For instance, if you publish blogs on your website daily and that’s the only update you make regularly, consider setting a daily backup.

This way, if your website is infected with malware and something goes wrong, you can easily restore the latest backup and work on your website.

4. Use Malware Scan Plugin

You must also regularly scan your website to detect any malware attacks. You can use a reliable WordPress malware scanner plugin to protect your website from attacks and keep your data safe.

Want to detect and remove malware from your WordPress website automatically? Check the 5 Best WordPress Malware Removal Plugins with virus protection.

20 checklist for wordpress site maintenance how to remove malware from wordpress site [guide] from the plus addons for elementor
Do you Manage WordPress Websites? Download Our FREE E-Book of 20+ Checklist for WordPress Site Maintenance. ​



    Wrapping Up

    Your WordPress website is an essential aspect of attracting a large audience, and its security is not something you should take lightly. Keep your website up-to-date and scan it regularly to detect any WordPress viruses.

    If you come across any signs of a malware attack, follow the steps mentioned in this article to remove the threat and keep your website secure.

    And, If you’re using Elementor page builder for your website, check out The Plus Addons for Elementor, an all-in-one plugin that helps you to improve your website and enhance the user experience.

    Featuring 120+ responsive widgets, the Plus Addons is all you need to add unique functions and features to your website and customize it however you want.

    Check out the Complete List of 120+ Widgets and Extensions here. Start building your dream website without coding!

    Further Read: Protect your WordPress website against attacks and identify any security or performance issues by following the WordPress Maintenance Checklist: 20+ Key Tasks.

    FAQs on Removing Malware from WordPress Sites

    How do I get rid of malware on WordPress for free?

    To get rid of malware from your WordPress website for free, you can download a WordPress security plugin. Such plugins can scan your website to detect any viruses and automatically delete any malicious files. You can also remove malware manually by following the step-by-step process mentioned in this blog.

    How do I manually check for malware?

    To manually detect malware in your website, you can start by checking your WordPress core and database files, along with any recently modified files like WordPress themes and plugins. You must also check your .htaccess file and scan each website page.

    How does malware generally infect a WordPress site?

    Malware can infect a WordPress website in various ways, mostly due to a website vulnerability, such as a weak password or outdated plugins or themes. It can also be planted by a hacker who might gain access to a website through backdoors, hacktools, or phishing attempts.

    Can I remove malware from WordPress myself?

    Yes, you can remove malware from WordPress manually by identifying the malware type, scanning and deleting infected files, and reinstalling WordPress core, themes, and plugins. However, if you find this process too technical, you can also use an easy WordPress security plugin to identify and remove malware automatically.

    Can someone hack my WordPress website?

    Your website might be vulnerable to hacking attempts if left unchecked. Outdated WordPress core, themes, and plugins, weak passwords, connecting to open networks, and more are some of the ways hackers can attack your website and get access to critical information.

    Related Blogs