How To Remove Malware From Your WordPress Website

Remove Malware From WordPress

How to remove malware from my WordPress site? If you find yourself often asking this question, you’re not alone. WordPress website owners across the world are worried about malware and hackers, thanks to the popularity of the WordPress platform. Think about it. When a platform is popular enough to be the undisputed CMS market leader, you can be sure that hackers have their eyes set on it too.

In this article, we show you some effective and recommended ways to remove malware from your WordPress site.


Before we tell you how to remove malware from WordPress sites, let us take a moment to understand how you can tell if your site is infected.

Here are some of the telltale signs of a malware infection:

  • There is a sudden change in your website traffic
  • Your website is suspended by your web host or by Google, thus blocking traffic to your site.

You could even be blacklisted by Google.

  • The message “This site may be hacked” shows up for your website on Google search results.
  • Your customers start complaining about not being able to access their accounts or even your website.
  • Unauthorized pop-up ads appear on your website.
  • You or your customers start receiving many spam emails.

These are only a few symptoms that suggest that your WordPress site could be infected with malware. You can see how damaging malware can be for your reputation, SEO rankings, your traffic, and your bottom line.

Before discussing removing malware from WordPress sites, let us first understand where most malware infections are located in your installation.


Depending on the type of attack, hackers can gain unauthorized access to different areas of your WordPress installation. Listed below are the areas that are most likely to be infected:

  • WordPress files or folders, including PHP files like the wp-config.php file.
  • WordPress database tables or records.
  • Plugin/theme files installed on your website.

The best way to know the actual site of infection is to perform a deep scan of your entire site. Let us look at ways of scanning your WordPress site for malware infections.


Malware scanning is the first step towards cleaning your WordPress site from all infections. A complete scanning determines if your website is indeed infected or not.

For complete malware scanning and removal, here are the three steps you need to perform:

  1. Scan for malware in your WordPress site.
  2. If found, remove malware from the WordPress site.
  3. Prevent future malware infections on your WordPress site.

Let us first learn how to scan for malware on your WordPress site either through:

  • manual scanning
  • a malware scanning tool

Scan for malware manually

For a complete scan, you need to scan your WordPress installation files and your WordPress database system. This needs you to possess a fair bit of technical and WordPress know-how,  enough to work with tools like FileZilla or phpMyAdmin, and WordPress files and databases.

Most core WordPress files should never be modified. You need to check for integrity issues in the wp-admin, wp-includes, and root folders.

For manual scanning of WordPress installation files:

  1. Download a fresh copy of the WordPress version your site uses.
  2. Then, access your installation files through FTP or a file manager.
  3. Compare the current installation files with the downloaded copy – to see if they have been recently modified (using their date and time stamp).
  4. Make sure to check for any recent modifications in crucial files (or folders) of your existing installation like wp-config.php, .htaccess, or wp-content folder. These folders should not contain any executable files. If there are any PHP or javascript files here, this could point to malware.

For manual scanning of your WordPress database:

  1. Connect to your current WordPress database tables and check for malicious code in database functions like “base64_decode” and “gzinflate.”
  2. Check for unknown links or iFrames that hackers inject into database records.

As observed, manual scanning is long and time-consuming – and must be attempted only by technical WordPress experts. There is also the possibility of missing some hidden malware.

Next, let us discuss automated scanning using a malware scanning tool or plugin.


A faster and easier way of scanning your WordPress website and database for malware is through a malware scanning tool or plugin. WordPress security plugins have evolving algorithms that can detect even malware that you may miss in the manual method. They can be installed just like other WordPress plugins and help you scan multiple websites, plugins, themes, and the database in a few clicks.

There are plenty of free and paid malware scanning tools available in the market but we recommend investing in a paid plugin like MalCare, Sucuri, or Wordfence, for the deep scanning and up-to-date malware detection they guarantee.

Now that you know how you can confirm the malware infection on your site, let us look at how to remove malware from a WordPress site.


After detecting the malware code, it is time to remove the infection from your WordPress site. This needs to be done in such a way that there is no more trace of the malware on your entire site.

As in the case of malware scanning, there are two ways to remove WordPress malware, namely:

  • Through manual cleanups
  • Using a malware removal tool

Let us discuss each of these two methods. However, before executing either of these methods, make sure you take a complete backup of your existing WordPress installation and database files. You can use an automated backup plugin like BlogVault that lets you run unlimited on-demand backups.


As in the case of manual malware scanning, manual cleanup is a long and technical process, where you need to complete two steps:

  1. Cleaning the infected WordPress files or folders
  2. Cleaning the hacked WordPress database tables

To begin, download a fresh copy of the WordPress version that you are using.

To clean your infected WordPress files:

  1. Use an FTP tool like FileZilla to connect to your current WordPress installation.
  2. Replace each of your infected (or modified) files with the corresponding file from your fresh copy or stored backup.

To clean your WordPress database:

  1. Connect to your WordPress database using your admin panel.
  2. Delete any records containing suspicious code – or remove the entire table. For any customized files, you need to remove the suspicious code from the file manually.

Because of their complexity, manual cleanups can easily go wrong and end up damaging your website. Additionally, with hackers devising new ways of compromising websites, manual scanning and cleaning may not be effective against every type of malware attack.

Let us check how automatic malware removal using plugins fare compared to manual cleanups.


Apart from detecting malware on websites, malware scanning tools can also remove malware from WordPress sites with just a few clicks. All you need to do is to install a security plugin like MalCare or Sucuri on your website, and they will do the rest.

With the MalCare tool, you do not need to even wait to get WordPress support or technical assistance to remove the malware. Once you have installed the tool, it automatically scans your website for any malware. If it finds a hack, it alerts you so you can log in and use the “Auto Clean” feature to clean both your WordPress files and database in a few clicks and within a few minutes.

However, malware attempts and attacks are not a one-time affair. Hackers will be back again to try and infect your site. You have to make sure that your site is protected from future attacks. Next, let us find out how you can do that.

Creating and managing your own WordPress site has never been easier. With free themes, plugins and more you can have your business website or blog up and running in no time. Yet, one problem with this increase in site volume is an increase in malware. Malware is any software that disrupts normal functioning of a site and/or steals data. What is worse, most users are not aware that their sites are exposed to these nasty programs. But the good news is this. There are a ton of WordPress plugins that combat malware! So, here are the best WordPress malware removal plugins you can get today.

First, how do I know if my site has malware?

Malware comes in all shapes and sizes. And new versions of malware come daily. So, how do you know if your websites’ infected? Here are 7 common signs that your site might have malware.

  1. Unable to login to WordPress
  2. Sudden drop in traffic
  3. Design of site altered or removed
  4. New user accounts in WordPress dashboard
  5. Spammy links added to your site
  6. Popups screen and ads
  7. Your site becomes unresponsive

If your site is experiencing any of the above symptoms, you might want to do a malware scan.

The good news is free and paid plugins offer protection against these programs. So, let us dive into the 12 best WordPress malware removal programs you can get today…

1) Wordfence Security – Firewall & Malware Scan

First on the list is one of the most popular WordPress security plugins on the market. Wordfence Security protects your site from malicious attacks, hackers, and bots. This plugin offers a firewall and malware scans designed to get rid of existing malware. It also provides security protection to keep new attacks from infecting your site.

Our WordPress Malware Removal Score – 9.5/10


  • Free version should meet most site owner’s security needs
  • Custom login URL option for advanced user login
  • Weekly reporting option directly to your email
  • reCAPTCHA to protect WordPress login, register and comment forms.
  • All in one security plugin


This plugin is one of the best all-encompassing security plugins out there. The only knock on this plugin is the speed of its malware scan. It tends to run slow, because of how in depth it is. But other than that, this is our top for security features and user friendliness.

2) Cerber Security, Anti-spam & Malware Scan

Cerber security anti-spam and malware scan is one of the best for complete protection. Offering advanced protection against hackers, spam, malware and brute force attacks, this plugin does it all. Also includes a routine security report as an added benefit

WordPress Malware Removal Score – 9.2/10


  • Email report setup and log file access.
  • Offers malware background scans
  • Includes dual malware/virus protection
  • Create custom login URL
  • Automatically detects spam comments
  • Security scanner verifies WP core files.


This plugin is a great choice for experienced WordPress users that know how to navigate plugin settings. This plugin may be hard to use for the novice site owner.

3) iThemes Security (formerly Better WP Security)

Next up is the iThemes Security plugin. This plugin was formerly Better WP security, and the new and improved plugin is certainly worth a look. With 1+million active installations, iThemes provides over 30 ways to keep your site secure. These include malware scans, virus detection, anti-spam, and file checkers. This robust plugin is a great option for those that have some experience and want a lot of security features.

WordPress Malware Removal Score – 9/10


  • Offers Google reCaptcha for anti-spam.
  • Deep malware scans and scheduling.
  • Password security.
  • Two factor authentications offered.


This is a widely used WordPress malware removal plugin that offers a ton of advanced features.

One downside of this plugin is it is not quite as user friendly as some others on the list. If you have a little experience however, this is a great option to try!

4) Anti-Malware Security and Brute-Force Firewall

Next up is the Anti-Malware Security and Brute-Force Firewall plugin. As their name suggests, this plugin specializes in identifying and removing malware. Designed to identify new threats, this makes a great choice for ongoing security.

WordPress Malware Removal Score – 8.8/10


  • Massive defense against malware.
  • Complete scan removes known security threats and database injections.
  • Checks the integrity of your WordPress core files.
  • Automatically downloads definition updates to protect against new attacks.


This plugin specializes in malware. It may not be as comprehensive as your site needs if you are suffering from spam comments and pingbacks.

5) Titan Anti-Spam & Security

The next plugin that is known for identifying malware is Titan Anti-spam & Security. This plugin includes anti-spam, firewall, malware scanner and defense audits. This all in one security plugin is great for getting rid of existing malware. Their comprehensive firewall that stops brute force attacks and by restricting login attempts is a nice addition! What is more, Titan anti-spam and security has an easy to use interface. Perfect for those that need a quick solution.

WordPress Malware Removal Score – 8.4/10


  • Impressive malware security scanner with over 1000 signatures for the basic plan.
  • Titan user interface makes deleting suspect files easy.
  • Checks your site’s existing vulnerabilities and provides defense recommendations.
  • Comprehensive security plugin


Although this is a comprehensive plugin, many of the advanced features are only accessible with a PRO plan. May not be enough protection for more established sites.

6) Astra Security Suite- Firewall and Malware Scan

Next up on our list of the best WordPress malware removal plugins is the Astra Security Suite. The newest plugin to join the list, this has the potential to be one of the best security plugins out there. With advanced all in one suite that includes firewall anti-spam, brute force protection and malware scans. What is even better is this plugin being extremely easy to set up. A 5-minute quick installation is all you need. No DNS changes necessary. This is a fantastic option for those looking for an all in one solution that has a smaller active user base.

Our WordPress Malware Removal Score – 8.2/10


  • All in one security platform for most needs.
  • Guided setup
  • One click scans for easy detection.
  • Impressive spam detection for SEO and comments.


The only downside to this plugin is its relatively small user base and lack of in-depth user reviews. However, this is a solid choice for security plugins with advanced anti-spam features.

7) Defender Security – Malware Scanner, Login Security & Firewall

This impressive, all-encompassing security plugin should be given serious consideration. Defender security offers a malware scanner, IP blocking, audit logs and more. And this is standard for the free version of the plugin. Be sure to check out their platform of plugins to improve SEO and enhance your site!

WordPress Malware Removal Score – 8.2/10


  • Login masking.
  • Server and core update alerts (critical for security)
  • Disable WordPress file editor to stop hackers in their tracks.
  • Includes malware scan and security firewall.


This a great plugin for those that need all in one security solution. Yet, we did not find the interface to be the most user friendly. Also, some of the advanced features negatively impact search engine visibility. Use carefully!

8) Sucuri Security

Another immensely popular all in one security plugin is Sucuri. This plugin specializes in all thing’s malware removal, auditing. This is a good option for those in search of a tried and tested malware security plugin. Sucuri also specializes in transparency to their users. Easily monitor logs, core files, brute force attacks and more!

WordPress Malware Removal Score – 8/10


  • Blacklist Monitoring
  • Deep scan malware protection.
  • Post hack actions
  • Offers remote malware scanning.


This is a widely used WordPress malware removal plugin. However, this does not feature a full suite of protection. It does offer a firewall with its premium plan.

9) Ninja Scanner Virus and Malware Protection

This lightweight plugin offers some great security features. And it should not slow down your site! The malware scanner checks for existing vulnerabilities and identifies security gaps. What is more, this plugin includes virus detection as well. With this fast security plugin, you receive good protection without sacrificing speed.

WordPress Malware Removal Score – 8/10


  • File integrity checker.
  • Email report setup and log file access.
  • Offers malware background scans
  • Includes dual malware/virus protection


This plugin is designed to give solid security without slowing down your site. The scans may not provide an in-depth review of infected files. This plugin also does include anti-spam.

10) Malcare Security Plugin for WordPress Websites

The Malcare plugin has been around for some time, and with good reason. It is one of the most utilized plugins for security scans and malware detection. The best part is Malcare might be the easiest to use plugin on the list. Malcare offers a one click protection scan. This makes finding and removing harmful programs a breeze. It also has a deep cloud-based scanner offering optimal protection against advanced attacks.

WordPress Malware Removal Score – 7.8/10


  • File integrity checker.
  • Email report setup and log file access.
  • Offers malware background scans
  • Includes dual malware/virus protection


This plugin is designed to give solid security without slowing down your site. The scans may not provide an in-depth review of infected files. This plugin also does include anti-spam.

11) NinjaFirewall (WP Edition) – Advanced Security

This plugin operates slightly differently than the rest on this list. As a true standalone firewall, this provides additional security measures to your site. And it still operates much like any other plugin would. This gives you the added benefit of having security built in front of your WordPress site. This is opposed to cloud-based security plugins.

Our WordPress Malware Removal Score – 7.5/10


  • Blazing fast brute force attack protection.
  • Standalone firewall.
  • Offers a live log of traffic.
  • Simple to use interface.


This plugin offers great security with the added benefit of being a true standalone security plugin. However, its malware scanning might be lacking compared to other options on this list.

12) Quttera

Another solid malware scanning option is Quttera. This plugin features in depth malware scanning and trojan horse detection. One added benefit of this plugin is it also checks Google periodically to see if your site has been blacklisted! This is a common sign that indicates your site has been hacked.

Our WordPress Malware Removal Score – 7.5/10


  • Offers a comprehensive security platform for most needs.
  • Google blacklisted site integration.
  • One click scans for easy detection.
  • Simple to use interface.


This plugin has an impressive list of security features; however, these may conflict with other plugins. Some users have noted compatibility issues. Be sure to test this plugin in a staging environment before going live.

13) CleanTalk Security and Malware Scan

A lightweight and all in one security plugin that is relatively new to the scene. It may be worth a look as it includes a suite of features in their free plan. Clean Talk offers one click malware scans, web app firewall, security log and updates.

Our WordPress Malware Removal Score – 7.5/10


  • All in one security platform for most needs.
  • Daily malware log and reporting
  • One click scans for easy detection.
  • Lightweight so should not interfere with site speed


This plugin is still working out some user interface issues. However, this could be due to plugin incompatibility. Much like the Clean Talk plugin, make sure to test in a staging environment first.


While there is no such thing as 100% immunity from hackers, you can implement security measures to make it harder for them to attack your site. Here are ten measures that help:

  1. Switch to a more secure WordPress web hosting provider.
  2. Apply regular updates to Core WordPress as well as installed plugins/themes.
  3. Implement a strong password policy for all users.
  4. Install a website firewall to block any suspicious IP requests to your website server.
  5. Take regular backups of your WordPress website and database files.
  6. Protect your WordPress account by limiting the number of login attempts or enabling Two-Factor authentication.
  7. Implement the SSL certification for your website.
  8. Limit the number of administrative (or “admin”) users by implementing various user roles.
  9. Install a WordPress security plugin or tool.
  10. Implement website hardening measures such as disabling file editing of PHP files, blocking PHP execution in untrusted folders, changing security keys, etc. Security plugins like MalCare integrate website hardening measures into their features so even non-technical users can harden their websites in a few clicks.

These measures, recommended by WordPress security experts should be part of your WordPress maintenance strategy.


We hope this article helped you understand how to remove malware from a hacked WordPress site. Manual scanning and removal methods are quite complex and recommended for more technical users with an understanding of WordPress, its file structure, etc. For everyone else, we recommend security plugins like MalCare or Sucuri designed specifically to ensure the security of a WordPress site. MalCare, for instance, includes most of the security measures included in this article in addition to malware scanning and removal. So whether it is firewall protection, login protection,  2-factor authentication, or updates, everything is taken care of from within a single dashboard.

Need help keeping your WordPress website safe and secure? You may want to consider our WordPress maintenance service. We would be happy to help and partner with you!

About The Author

Dustin Reed

Dustin Reed, is the owner and senior web technician for Innovative Solutions Group. He started working at Innovative Solutions Group in 2011 and took over as owner in 2016. He takes great pride in the fact that he truly enjoys doing what he does best, Building Professional Websites! During his 10 years working at Innovative Solutions Group, he has been responsible for many different aspects of the business ranging from creating new accounts/domains on Innovatives server to responsive(mobile-friendly) template creation. Some of his other responsibilities/strengths are WordPress website design, CSS/HTML coding, creating visual animations using Jquery, page layout, and troubleshooting many different types of problems that may arise. When he is not busy working at Innovative Solutions Group, he enjoys doing all of the great outdoor activities that the beautiful state of Montana has to offer. Such as, fishing, camping, hiking and enjoying a day at the lake during the summer.

Leave a reply

Your email address will not be published.

wordpress maintenance service and security


I have been a customer of Innovative Solutions Group since 2013. Dustin is so wonderful to work with. He is patient, professional, and very knowledgeable. Anytime I reach out to the office, they are extremely responsive and address my need VERY quickly. I can't recommend this company enough!!! I am so grateful that I am able to have a successful web-based business, because of them!!Diana FlutieJune 29, 2021
I've worked with Dustin Reed at Innovative Solutions Group now for 2 1/2 years, and am so happy I found them. I came to ISG so frustrated. I'd had my website rebuilt by guys in Pennsylvania, and they never listened to me about anything--from a logo they designed that I didn't like, but they plastered all over the site, to how the site would operate. Dustin and I sat down and within 4 minutes he'd dealt with my most important issues. He continues to be resourceful, making my site much more profitable, and if quick to respond to problems. ISG happens to be close to my home, but I would recommend them to anyone dependable, professional service.eileen ClarkeFebruary 19, 2021
Dustin is great. Quick to respond to any inquiries and reasonable pricing.Nobe Eyecare AssociatesApril 7, 2020
I have been with Dustin and Innovative Solutions for over a year now. Dustin and his company have taken my business to a whole new level. With what they have done with our website and how people find us is amazing. We have grown 10 times over because of Innovative. If your in need of the next level of success in marketing, your in great hands here. You will not be disappointed. Thank you Dustin and the team!!Troy KennettJanuary 15, 2020
Great, courteous and fast service. A very honest business that will not overcharge. Highly recommended!Doseof RealityJanuary 3, 2020
Cynthia MonteilSeptember 18, 2017
Excellent service. We have been with Innovative since the launching of our site. They not only designed the entire site with the functionality we wanted, but have hosted it reliably no matter how high the traffic spikes. I would recommend Innovative to anyone looking for a professional, reliable and very responsive team.Susan Duclos (All News PipeLine)September 6, 2017
This group is amazing to work with. We started our partnership a year ago and we could not be happier!Amber DJuly 25, 2017
Work was done in a very timely matter and Dustin was great to work with!Jacob WanderseeJune 19, 2017
I used Dustin at Innovative Solutions to initially just host my website. After working with him I decided to do a pretty significant makeover on my site. He did a great job, was super responsive and has Fletcher in the Design Department to help with graphics and such. He answered inquiries after hours and is very reasonably priced. I have used quite a few web people over the years and Innovative Solutions is undoubtedly who I will continue to use.Gary GavinJune 9, 2017
Super helpful! From the very beginning the designer was patient and offered great suggestions. Very customer friendly. They wanted the site to be perfect for me. Also, ease of billing. Thank you for creating a great site.Serapha CruzJune 3, 2017
I owned the company for over 20 years, and Dustin treats customers in a very courteous and professional manner. That why I'm going back to Innovative for help with our latest personal web project.Daniel DeiningerMay 22, 2017