How to Remove Malware from WordPress in 2026 (Complete Guide)

WordPress powers 43% of the web, which also makes it the most attacked CMS on the planet. If your site is reinfecting itself, it's not because 'WordPress is insecure' — it's because you cleaned the visible symptom without finding the actual entry point. This is the exact playbook we run every day.

Step 1 — Confirm you're actually hacked

Symptoms range from obvious (site redirects to a casino) to subtle (Google Search Console reports spammy indexed pages that don't exist on your site). Run our free scanner, check Google Safe Browsing, and log into your host to check for suspended-account emails.

Step 2 — Put the site into maintenance mode

Every second the site stays live, the attacker's payload runs. Enable maintenance mode at the plugin level or drop an .htaccess block by IP. If wp-admin is unreachable, use FTP to rename the plugins directory temporarily.

Step 3 — Identify the entry point

This is the step everyone skips. Check: outdated plugins with known CVEs, nulled premium plugins from CodeCanyon leaks, weak admin passwords, and — most commonly — a shell already sitting in wp-content/uploads/ from a previous infection.

Step 4 — Clean, don't just delete

Restore core files from the official WordPress.org signed archive, not from your host backup (which may already be compromised). For plugins and themes, redownload from the source. Quarantine unknown files instead of deleting — you might need them for forensics.

Step 5 — Rotate every secret

WordPress salts, admin passwords, database password, hosting panel password, FTP/SSH keys. All of them. An attacker who had file write access already exfiltrated your wp-config.php.

Step 6 — Prevent reinfection

Install a real security plugin (we recommend Malwipe, unsurprisingly), enable the upload firewall, add checksum verification on scheduled scans, and set up alerts on new admin user creation.

If any of the above sounds like too much — or your site is actively defaced right now — our $149 emergency cleanup covers the full playbook end-to-end in under 2 hours.