How to Clean a Hacked WordPress Site: 3 Ways to Remove Malware

Full disclosure: Must-Have Security is our own plugin, and it is the first of the three methods below. We have tried to keep the other two just as complete — the manual route and the Claude Code route both work with no plugin from us at all — so you can pick the one that fits your situation, not ours.

You logged in and something is wrong. Google is showing a red “this site may be hacked” warning under your result, or spammy Japanese keywords appear in Search Console, or visitors land on a pill-selling page that you never made. Maybe there is a new administrator account you did not create, or your host emailed you about malware. A hacked WordPress site is a bad afternoon — but it is a fixable one, and the sooner you act, the less damage the attacker can do.

This guide gives you three complete ways to clean an infected WordPress site, from fastest to most hands-on. Whichever you choose, the shape of the job is the same: find the malicious files, remove them, put clean code back, and close the door the attacker came through so they cannot walk straight back in. Work on a copy or with a fresh backup if you can — cleanup occasionally breaks a fragile site, and you want a way back.

First, confirm it is actually hacked

Not every problem is malware. Before you start deleting things, look for the tell-tale signs of a real compromise:

Unknown files that can run code — a .php file inside wp-content/uploads (nothing there should ever execute), or core files that no longer match the official WordPress release.
Admin accounts you did not create, or your own account’s email quietly changed.
Redirects and injected content — visitors (especially from Google) bounce to another site, or you see spam links in your pages’ source that are hidden from logged-in users.
Search Console or your host flags malware, or antivirus blocks your own site.
Scheduled tasks nobody added and outbound connections to addresses you do not recognise.

If you see one or more of these, you have a cleanup to do. Here is how — pick a tab.

How to clean a hacked WordPress site: 3 ways

The three tabs below are three routes to the same clean site. The first uses our plugin and is the fastest for most people. The second is the full manual method — more work, total control, no plugin needed. The third points an AI coding agent at your server over SSH. Read the one that fits you.

Recommended — the fastest route for most sites. If you want the shortest path from “I think I’m hacked” to a clean, protected site, install a scanner that also blocks re-infection. This is our own plugin; here is exactly what the cleanup looks like.

1. Install and run a scan

Install Must-Have Security and open Malware scan. A scan runs in two passes: first everything that can execute — PHP files, .htaccess and .user.ini, and anything under uploads that looks like code — is checked against the official WordPress checksums and a shared reputation database; only what cannot be proven safe is sent for a deeper look. Then a full pass walks every other file for PHP hidden inside it.

On an infected site, the flagged files appear at the bottom of the panel with a plain-language reason. Here the scanner has found a web shell disguised as a cache file in the uploads folder:

The Must-Have Security malware scan flagging a backdoor / web shell in wp-content/uploads, marked MALICIOUS with 96% confidence. — A scan that found one malicious file — a base64/eval web shell hidden in the uploads folder.

2. Review, then remove

Each finding tells you what it is and why it was flagged, so you are not deleting blind. Use View to read the file, Ignore if it is a false positive you trust, or Remove to delete it. The scanner never deletes anything on its own — removing an infected file acts on a judgement that can occasionally be wrong, so the decision stays with you. Click Remove (or Delete N malicious files) and the web shell is gone.

For core files that were tampered with, the right fix is to restore the official copy rather than delete them — the plugin flags those separately and points you at a reinstall.

3. Stop it from coming back

This is the part a scanner alone does not do, and it is why re-infection is so common. Must-Have Security keeps a write-protection layer running underneath WordPress: by default, no request can write executable code to your site. When malware tries to drop a fresh PHP loader into uploads — exactly how it would reinstall itself — the write is refused and logged:

Must-Have Security file log showing a CREATE of wp-cache-loader.php in wp-content/uploads refused by the file firewall. — A malware persistence attempt — a PHP file being written into uploads — refused before it ever touched disk.

Because ordinary admin access is not the same as permission to change code, even a legitimate change — installing a plugin, editing a theme — asks a trusted administrator to confirm with a factor that does not live in the database, such as a passkey:

Must-Have Security asking a trusted administrator to confirm a file change with a passkey before allowing it. — Writing code needs a passkey, not just an admin login — so a stolen password (or leftover malware) can't rewrite your files.

That is the difference between cleaning a site and keeping it clean: the scan removes what is there today, and the write-protection means the attacker’s next drop has nowhere to land. Full details are in the Must-Have Security documentation.

Still finish the “close the door” checklist below — update everything, rotate secrets, and check your users. A scanner is one layer, not the whole job.

The full manual method — no plugin, total control, more care required. This is the route the professionals use, and it is genuinely detailed. You will need file access (SFTP/SSH) and, ideally, WP-CLI, which makes several steps a single command. Take a full backup first — of both files and the database — so you can get back if a deletion breaks the site.

1. Find what was tampered with and what was added

Start read-only. Verify core against WordPress’s official checksums, look for PHP where none belongs, and grep every PHP file for the obfuscation functions malware leans on:

Terminal session: wp core verify-checksums reporting modified core files, find locating a PHP file in uploads, and grep matching eval/base64_decode across wp-content. — Three read-only checks: modified core files, a stray PHP file under uploads, and obfuscation signatures across the codebase.

Write down every path these turn up. A match on eval(, base64_decode, gzinflate, str_rot13 or assert( is not proof of malware on its own — some legitimate code uses them — so open each file and look. A web shell is usually obvious: a wall of encoded text, or a short script that runs $_POST/$_REQUEST input. Legitimate code will make sense; a backdoor will not.

2. Restore clean files (never hand-edit infected core)

Do not try to “clean” a modified core or plugin file by deleting the bad lines — you will miss something. Replace the whole thing from a known-good source: re-download WordPress core, and reinstall each affected plugin and theme fresh from the repository. Then delete the standalone malicious files (the web shells) that do not belong to anything. Finally, shuffle the salts to invalidate stolen sessions and re-verify:

Terminal session: wp core download --force, reinstalling a theme and removing the web shell, wp config shuffle-salts, and a final wp core verify-checksums that passes. — Put clean code back, delete the shell, rotate the salts, and confirm core verifies clean before you stop.

3. Clean the database and the config files

Malware does not only live in files. Check these too:

wp-config.php — look for anything appended to the end of the file, an unexpected auto_prepend_file, or base64 blocks. Compare it against wp-config-sample.php.
.htaccess files — in the root and in uploads. Attackers add redirect rules and re-enable PHP execution here. Regenerate the root file from a clean default if in doubt.
siteurl and home — in wp_options, make sure both point at your real domain, not an attacker’s.
Unknown users — SELECT user_login, user_email FROM wp_users; and delete any account you did not create. Check wp_usermeta for wp_capabilities that was quietly upgraded to administrator.
Injected options and transients — spam links and loaders are sometimes stored in wp_options; look for very large or recently changed autoloaded rows.
Scheduled tasks — a rogue WP-Cron event can re-drop the payload after you clean it. List them and remove any hook you do not recognise.

WordPress’s own “My site was hacked” FAQ is a good companion checklist. When every check comes back clean and the symptoms are gone, move on to the “close the door” steps below — the manual method fixes today’s infection, but the vulnerability that let it in is still there until you patch it.

Let an AI agent drive the cleanup over SSH — you supervise. Claude Code is a command-line coding agent that can run real commands on your behalf. Pointed at your server, it can carry out the same audit a professional would — read the state of the site, reason about what it finds, and, with your approval, fix it — while explaining every step. It runs on your own machine and reaches the server over SSH; it never needs a plugin installed on the site.

1. Give it a way in (a dedicated SSH key)

Add an SSH alias for your server in ~/.ssh/config (say, prod) using a key you can revoke afterwards. Test that ssh prod 'wp core version' works from your machine. Working over SSH like this means Claude uses your existing WP-CLI and shell — no code runs on the site itself.

2. Ask for an audit first — no changes

Start read-only. Tell it to connect and investigate, but not to change anything yet. It will run the same checks as the manual method — checksums, a hunt for PHP in uploads, a grep for obfuscation — and then explain what it found and what it proposes to do:

Claude Code terminal: connecting to a server over SSH, running wp core verify-checksums and a grep for eval/base64_decode, then reporting the modified core file and the web shell and proposing a cleanup plan. — Claude runs a read-only audit over SSH, identifies the entry point and the payload, and lays out a plan before touching anything.

Reading the plan before you approve it is the whole point: you see exactly which files it will restore and which it will delete, in plain language, before a single change is made.

3. Approve the fix, then re-verify

When you are happy with the plan, tell it to proceed. It restores core from the official checksums, deletes the web shell, and shuffles the salts — then re-runs the verification to prove the site is clean, and suggests the follow-ups (rotate passwords, hunt for unknown admins) that a scanner would not think to mention:

Claude Code terminal: running the cleanup commands over SSH, then wp core verify-checksums passing, and summarising that core is restored, the web shell removed and sessions invalidated. — After approval, Claude fixes it and re-verifies — core restored, web shell removed, sessions killed — then recommends the next steps.

This is the most flexible route — the agent adapts to whatever your specific infection looks like — but it is also the one that most rewards supervision. Keep it read-only until you have read its reasoning, approve changes deliberately, and treat its recommendations as a starting point. For a deeper look at running these audits on a schedule, see our writing on connecting Claude to WordPress.

Whichever route you took: close the door

Removing the malware is only half the job. If you do not fix how the attacker got in, and revoke what they took, you will be cleaning the same site again next week. Do all of these regardless of which method you used:

Update everything. WordPress core, every plugin, every theme. The overwhelming majority of hacks come through a known vulnerability in outdated code, not a clever zero-day.
Delete what you do not use. An inactive plugin is still code on disk that can be exploited. Remove plugins and themes you are not running, especially nulled or abandoned ones.
Rotate every secret. Change all administrator passwords, shuffle the security keys and salts in wp-config.php (this logs everyone out and kills any stolen session cookies), and change the database password and your hosting/FTP passwords.
Audit your users. Delete accounts you did not create, and turn on two-factor authentication so a stolen password alone is not enough. Our own guide to TOTP two-factor in Must-Have Tweaks covers the fit, and temporary admin access is a safer way to let a helper in during cleanup.
Ask Google to take another look. If your site was flagged, use Search Console’s Security Issues report to request a review once you are clean.
Get real backups in place. The single thing that turns the next incident from a crisis into a five-minute restore is a recent, off-site, tested backup. See our 3-2-1 backup strategy for WordPress and why encrypted backups matter.

How do WordPress sites get hacked in the first place?

Almost never through a password guessed by brute force, and almost never through WordPress core itself. In practice the entry point is one of three things: a vulnerable plugin or theme (by a wide margin the most common — an out-of-date component with a known flaw that lets an attacker upload a file or run code), a stolen or reused credential (an admin password that leaked in a breach elsewhere), or a nulled/pirated plugin that shipped with a backdoor already inside it.

Once in, the attacker’s first move is almost always to write a small PHP file — a “web shell” — somewhere writable, often disguised as a cache or config file in wp-content/uploads, and to inject a loader into a legitimate file so it survives. That is why cleanup is not just “delete the bad file”: you have to find every copy, restore the files they tampered with, and take away the ability to write new ones. It is also the idea behind the first method above — if code simply cannot be written to your site without your approval, re-infection has nowhere to land. You can read the vendor-neutral background in our roundup of WordPress security approaches for 2026.

Frequently asked questions

Can I clean a hacked WordPress site for free?

Yes. The manual method and the Claude Code method both cost nothing but your time (Claude Code is a paid tool, but you can do the exact same steps by hand). What you cannot buy back is the time — the manual route is genuinely fiddly, and one missed backdoor means the infection returns. A scanner shortens the “find every copy” part, which is where manual cleanups usually fail.

Should I just delete the whole site and restore a backup?

If you have a clean backup from before the infection, restoring it is often the fastest and safest option — but only if you also patch the vulnerability that let them in, or they will re-hack the restored copy. The catch is knowing when the site was clean; many infections sit quietly for weeks. If your only backups are recent, they may already contain the malware.

How do I know I got all of it?

Re-run the check that first found the problem and make sure it comes back clean: wp core verify-checksums should pass, a fresh scan should show zero findings, and the symptoms (redirects, warnings, spam) should be gone. Then keep watching for a week — re-infection usually shows up within days if you missed a backdoor or left the entry point open.

Is a scanner enough on its own?

A scanner finds and removes what is already there, which is exactly what you want during cleanup. What it does not do by itself is stop the next file from being written. That is why Must-Have Security pairs the scanner with a write-protection layer: cleaning is reactive, and blocking new code is what keeps the site clean afterwards.

Do I need to tell my visitors?

If the site handled personal data and there is any chance it was exposed, you may have a legal duty to notify — check your local rules (GDPR and similar). At a minimum, if customer accounts exist, force a password reset once you are clean.

The takeaway

Cleaning a hacked WordPress site comes down to four moves: find the malicious code, remove it, restore clean files, and close the way in. A scanner like Must-Have Security does the finding and removing for you and — just as importantly — stops new malware from being written, so the cleanup holds. The manual method gives you total control for the price of care and patience. And an AI agent like Claude Code can drive the whole audit over SSH while you watch. Pick the one that matches your comfort level, do the “close the door” checklist without skipping it, and get a real backup in place before the next time.