Moatline

How to remove malware from WordPress

A practical, step-by-step cleanup guide from a team that cleans hacked WordPress sites every week. It works whether you use Moatline or not.

By the Moatline team at Next Nova Technologies · Updated 12 October 2026 · 12 min read

Before you start

Work calmly and in order. Deleting files at random is the most common reason a cleanup fails: you remove the visible symptom, miss the backdoor, and the site is reinfected within days.

  • Use a clean computer. If the site was hacked with a stolen password, the device that password was typed on may be infected too.
  • Tell your host. Many hosts scan accounts and can show you which files they flagged and when. That date helps you find how the attacker got in.
  • Have these ready: your hosting control panel (cPanel or similar), FTP or File Manager access, and phpMyAdmin.

1. Confirm the infection

Typical signs that a WordPress site has malware:

  • Visitors are redirected to spam, scam or “you won a prize” pages, often only on mobile or only when they arrive from Google.
  • A fake “verify you are human” box asks visitors to press keys or paste a command. This is ClickFix, and it installs malware on the visitor's computer.
  • Google shows “This site may be hacked” or Chrome shows a red warning screen.
  • Japanese or pharma spam pages appear when you search site:yourdomain.com in Google.
  • Admin users, plugins or files you didn't add, or plugins that you can see in File Manager but not in wp-admin.
  • Your host has suspended the account or sent a malware notice.

2. Back up the infected site

It sounds odd, but take a full backup of the infected site (files and database) before you change anything. If a cleanup step breaks something you can recover it, and you keep the evidence you need to work out how the attacker got in. Store it off the server and label it clearly as infected.

3. Scan files and the database

You need to find every place the attacker left code, not just the first one. A good scan checks:

  • WordPress core, plugins and themes against the official copies on WordPress.org. Any file that differs from the original is suspicious.
  • wp-content/mu-plugins, which run automatically and don't appear in the normal plugin list.
  • wp-content/uploads. This folder should contain images and documents, never PHP files.
  • The database: posts, widgets, options and page-builder data such as Elementor, where scripts are often injected.
  • Scheduled tasks (cron) that reinstall malware after you remove it.

The free Moatline Malware Scanner plugin checks all of these, compares files with WordPress.org and tells you which plugin each infected file belongs to. Install it from Plugins → Add New, open Malware Scanner → Scanner and click Run Full Scan. See the docs for how to read the results.

Online scanners that only take a URL can see your public pages, not your files or database. They are useful as a first check but can't confirm a site is clean.

4. Replace infected files with clean copies

Don't try to edit infected files line by line. Replace them:

  1. WordPress core: in wp-admin go to Dashboard → Updates and click Re-install version. If you can't get into wp-admin, download WordPress from wordpress.org and upload the wp-admin and wp-includes folders over FTP, replacing the old ones. Don't overwrite wp-content or wp-config.php.
  2. Plugins and themes: delete each infected plugin and install a fresh copy from WordPress.org or from the developer's own site. Your settings are kept in the database, so they come back.
  3. Premium plugins and themes: download fresh copies from your account with the developer. Never use “nulled” or GPL-club copies; they are one of the most common ways malware gets in.
  4. wp-config.php: open it and look for anything unusual above or below the normal settings, such as long encoded strings or include lines pointing to odd files.
  5. Uploads: delete any .php file inside wp-content/uploads.

5. Remove fake plugins and hidden files

Many infections in 2026 arrive as complete fake plugins. In recent cleanups we found plugins called “WordPress Defender”, “WordPress Security” and “White Label” with the author set to just “wordpress”. Some remove themselves from the plugin list in wp-admin, so you only see them in File Manager.

  • Open wp-content/plugins in your host's File Manager and compare the folders with the plugins you actually use. Delete any folder you don't recognise.
  • Check wp-content/mu-plugins. Most sites have nothing there, or only files added by the host.
  • Look in the active theme's functions.php for code added at the very top or bottom. Replacing the whole theme with a fresh copy is the safest fix.
If your host's malware cleaner has already emptied an infected file but left the folder, your site can show a fatal error. Delete the whole fake plugin folder to fix it.

6. Clean the database

  • Users: in Users → All Users, filter by Administrator and delete anyone you don't know. Attribute their content to a real user.
  • Injected scripts: remove <script> tags pointing to unknown domains from posts, widgets and page-builder content. Moatline lists each affected post so you can open and fix it.
  • Options and cron: malware often stores code in the wp_options table and schedules a task to reinstall itself. In Moatline, click Clean DB Now to remove known malicious tasks and options.

7. Lock the door behind you

This is the step most people skip, and it's why sites get reinfected.

  1. Change every password: WordPress admins, hosting/cPanel, FTP/SFTP and the database.
  2. Generate new security keys and salts so every existing login cookie stops working. Moatline does this in one click under Hardening.
  3. Turn on two-step login for administrators.
  4. Update WordPress, every plugin and every theme. Delete plugins and themes you don't use.
  5. Turn off the built-in file editor and block PHP from running in the uploads folder (Moatline's Lockdown page does both).
  6. Scan again a day later, and again a week later, to make sure nothing came back.

8. Clear Google and browser warnings

If Google flagged your site, open Google Search Console → Security & Manual Actions → Security issues, confirm the issues are fixed and click Request review. Reviews usually take from a day to a few days. If spam pages were indexed, remove them with the Removals tool and make sure they now return a 404.

When to get professional help

Get help if the site is an online shop or handles customer data, if malware keeps returning after you've followed every step, or if your host has suspended the account. Next Nova Technologies, the team behind Moatline, offers hands-on malware cleanup.

Frequently asked questions

Can I remove WordPress malware without a plugin?
Yes. You can replace WordPress core, plugins and themes with fresh copies over FTP and search the database by hand in phpMyAdmin. A scanner just makes it much faster to find what changed, especially code hidden in the database.
Will restoring a backup remove the malware?
Only if the backup is from before the infection, and you still need to close the hole the attacker used. Many sites are infected for weeks before anyone notices, so recent backups often contain the malware too.
Why does the malware keep coming back?
Something was missed: usually a hidden admin user, a fake plugin, a file in mu-plugins, a PHP file in uploads or a scheduled task in the database. Stolen passwords that were never changed are the other common cause.
How long does a WordPress malware cleanup take?
A simple infection takes one to two hours with the steps below. Sites with several backdoors, many plugins or database injections can take most of a day.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides