How do you remove malware from a WordPress site?

Removing malware from a WordPress site does not begin with cleaning up, but with understanding how the attacker gained access. Anyone who skips that step removes the damage but leaves the door open.

That sounds like a detour. Yet it is precisely the reason why a cleaned-up site can become reinfected after a few days. The question “how do I remove the malware?” is understandable, but it is not the question that resolves the situation. Below we explain why, and what is actually needed in practice.

Why your first instinct makes the situation more complicated

Suppose you suspect an outdated plugin was the access route. In our practice, that has been the case in approximately 75 per cent of incidents. The logical step is then to update that plugin. But that is precisely the problem.

Because by doing so you remove the exact version that contained the vulnerability. That vulnerable version is the evidence. As long as it is still there, you can establish which vulnerability was exploited and what the attacker was able to do with it. After the update, that point of reference is gone. You have closed something, but you do not know whether it was the only gap, and you do not know what the attacker left behind in the meantime.

This is more concrete than “destroying traces”. An update after a hack makes the investigation impossible in many cases. Not because the instinct is unwise — it is actually very logical. But the consequence is rarely foreseeable at the moment you do it.

The same applies to manually deleting files, deactivating plugins, or running an automated scan and then restoring everything. You can make the situation look cleaner whilst the access route is still intact.

Removing malware and removing the cause are two different things

Removing malware without knowing the cause leaves the situation that made the infection possible in place. A site can look clean, a scan can report nothing, and yet the access route is still open.

That is also why a scan is not enough. A scanner recognises what it recognises. The fact that a scan reports nothing does not mean the site is clean. The difference between “no signals found” and “actually clean” is precisely what this work is about. New or modified malware is sometimes only picked up by scanners later, or not at all.

Insight into the broader approach to security and recovery can be found in our overview of WordPress security and recovering a hacked site.

What actually happens in practice

Recovery does not begin with cleaning up, but with access. Access to the site and to the hosting environment, so that what has happened can be examined at server level. That is a different layer from what you see via the WordPress dashboard.

Next comes establishing where the infection is: in files, in the database, or in both. Then the logging is used to establish how the attacker gained access. Only when that is clear is the access route closed. Only then does the cleanup begin: including reinstallation of the WordPress core, reviewing themes and plugins, and checking the database for injected code.

There are situations where the cause cannot be unambiguously identified from the logging. Sometimes an internal cause cannot be ruled out either. An infected device belonging to someone with access to the site can equally be the source. In those cases, additional logging is set up so that it becomes visible whether the problem lies on the user side.

After the cleanup comes handover. And after that: structural maintenance. For a smaller site, exporting the content and rebuilding on a clean installation may be faster than going through everything. That consideration is part of the work itself, not the planning beforehand.

At handover the site is clean. Recurrence can never be entirely ruled out.

How we approach recovery is described at our WordPress support.

The questions that should be answered at handover: are you certain how the attacker gained access, what happens if the infection returns, and who ensures the site remains up to date afterwards.

Related topics

What to do in the first hours after discovery is covered in My WordPress site has been hacked: what now?. How to recognise the signs yourself is covered in How do you check your WordPress site for malware?. And if you want to understand why sites get hacked in the first place, Why do WordPress sites get hacked? is the right place.

Prevention is a separate track. Securing WordPress preventively explains how to structurally reduce the chance of a new infection, separate from the recovery process. Good maintenance is a factor that is often underestimated in this regard. More about the relationship between updates and security can be found at WordPress updates, compatibility and maintenance.

Frequently asked questions

Can you remove malware from your WordPress site yourself? Technically yes, but the question is whether you know what you are removing and whether you are addressing the cause. Anyone who only cleans up the visible infection without closing the access route has a clean site that can become reinfected. In many cases, intervening yourself makes the investigation harder.

Why is updating a plugin after a hack not a good idea? An outdated plugin has been the access route in approximately 75 per cent of cases in our practice. That vulnerable version is also the evidence: it contains the information about which vulnerability was exploited. After an update, that information is gone, and you do not know what the attacker was able to do or leave behind via that vulnerability.

Does a security plugin remove the malware for you? A security plugin can recognise and report known malware, but it is not a substitute for investigating the cause. Plugins work based on known patterns. New or modified malware is therefore sometimes missed, or only recognised later.

Does a clean scan mean the site is safe? Not necessarily. A scan finds what it recognises. “No signals found” is something different from “clean”. The difference between the two is precisely what becomes visible in a thorough check at server level.

What happens if the malware is gone but the cause is not? The access route is then still open, and reinfection remains possible. Cleaning up without closing that route resolves the visible problem, not the underlying one.

How long does it take to clean up an infected site? Most sites are back online within a day. That is practical experience, not a commitment. The lead time depends on how deep the infection goes, whether the cause can be quickly traced from the logging, and whether a rebuild is faster than a full scan of the existing installation.