You can remove malware from WordPress yourself if the infection is simple, you have a clean backup and you’re comfortable with file access and the database. The job is to replace every file you can from a trusted source, hunt down backdoors and rogue admin accounts, reset every password, then close the hole the attacker used. If you take payments, hold customer data or the hack has come back before, DIY gets risky fast.
Key takeaways
- Deleting the visible malware isn’t a clean-up. Sucuri found backdoors on 49% of hacked sites and rogue admin users in 55% of infected databases.
- Copy the infected site before you change anything, then replace files from trusted sources rather than editing them.
- Change every password twice: once when you find the hack, and again once the site is clean.
- A DIY clean suits a small brochure site with a known-good backup. A store, a repeat infection or exposed customer data needs a professional.
Can you really clean a hacked WordPress site yourself?
Yes, sometimes. WordPress.org publishes its own guide for owners doing exactly this, and it’s honest about the hard part. It calls finding and removing the hack “the most daunting part of the entire process” (WordPress.org).
The risk isn’t that you’ll fail to remove what you can see. It’s that you’ll miss what you can’t. Sucuri’s 2023 report found backdoors on 49% of compromised sites, and malicious admin users in 55% of infected databases (Sucuri). Leave either behind and the attacker simply walks back in. That’s the main reason hacked websites get reinfected.
When does DIY work, and when is it risky?
Be honest with yourself before you start. This is the line we draw.
If your host has already switched the site off, start with our guide for when your website is suspended for malware, because the host’s process comes first.
How do you remove malware from WordPress, step by step?
This follows the order in WordPress.org’s guide, with the gaps we see most often filled in. Work through it in order. Skipping ahead is how backdoors survive.
- Write down what you see. Note the symptoms, when you first saw them and anything that changed recently, such as a new plugin. This becomes your incident record.
- Take a copy of the infected site. Download all files and export the database before you touch anything. If a step goes wrong, you can get back to where you started.
- Scan your own computer. WordPress.org notes that attacks often start on the owner’s computer, with malware stealing saved logins. Cleaning the site is pointless if your laptop hands the password straight back.
- Tell your host. On shared hosting, the infection may reach beyond your site. Your host may also have logs and clean backups you don’t know about.
- Lock everyone out. Reset every WordPress password and replace the security keys in wp-config.php, which logs out every session, including the attacker’s.
- Replace WordPress core. Upload fresh copies of the wp-admin and wp-includes folders, for the same version you run. WordPress.org advises doing this over SFTP rather than the dashboard’s reinstall button, which can leave the attacker’s extra files in place.
- Replace plugins and themes. Delete each plugin and theme folder and install a fresh copy from its official source. Remove anything you don’t use. Nulled (pirated) themes and plugins go for good.
- Hunt for what’s left. Check wp-content/uploads for PHP files, which shouldn’t be there. Check .htaccess files, wp-config.php and any file in the site root you don’t recognise.
- Clean the database. Remove admin users you didn’t create, and search posts and options for injected scripts or spam links.
- Change every password again. WordPress.org stresses this: passwords changed while the site was still infected can’t be trusted. Include hosting, SFTP, database and email.
What about restoring a backup instead?
A backup from before the infection is often the fastest route. The catch is knowing when the infection started, because a hack can sit unnoticed for some time before anything visible happens. Restore, then still do steps 5, 7 and 10, and patch whatever let them in. Otherwise you’ve rolled back to a site with the same hole.
Where does WordPress malware hide?
Most of the infections we clean go well beyond the obvious file. The usual hiding places are:
- The uploads folder, disguised as images or tucked into dated subfolders.
- Theme files such as header.php, footer.php and functions.php, which load on every page.
- .htaccess, often edited to redirect visitors from Google but not you.
- The database, as scripts in posts or widgets, or as extra admin accounts.
- Must-use plugins in wp-content/mu-plugins, which run automatically and don’t show in the normal plugin list.
Some hacks are built to stay out of sight. A pharma hack, for example, shows spam to search engines while you see a normal site. If Google is listing pages you never wrote, that’s the likely culprit.
What are the signs you’re out of your depth?
Stop and get help if any of these happen part-way through:
- You’ve replaced the files and the malware comes back within days.
- You find files you can’t explain, and you’re not sure whether they’re safe to delete.
- The site takes card payments. A skimmer on a checkout is a data breach, not just a nuisance.
- Customer details may have been exposed. If your business is covered by the Notifiable Data Breaches scheme, the OAIC expects a suspected breach to be assessed within 30 days.
- Emails from your domain are bouncing or landing in spam, which suggests the server itself is blacklisted.
- You’ve spent a full day on it and still can’t say how the attacker got in.
The last point matters most. Patchstack found that 46% of WordPress vulnerabilities disclosed in 2025 had no fix available at disclosure (Patchstack). If the hole is an unpatched plugin, a clean site can be reinfected the same week. Our hacked website repair service finds the way in as well as the malware.
What do you do once the site is clean?
Cleaning is half the job. The other half is making sure it stays clean:
- Update everything, and keep doing it. Remove plugins that are no longer maintained.
- Turn on two-factor login for every administrator.
- Clear Google’s warning. In Search Console’s Security Issues report, request a review once everything is fixed. Google says a malware review “can take from a few days to a few weeks” (Google Search Console Help).
- Set up off-site backups you’ve tested, so next time a restore is quick.
- Check your hosting. Accounts that are isolated from each other, a firewall and malware scanning make reinfection harder. Our checklist for secure web hosting covers what to ask.
For the wider recovery, including blacklists and search clean-up, our website hacked recovery guide goes further.
What does professional clean-up cost compared with DIY?
DIY costs your time, and the risk is a hidden backdoor. A professional clean costs money, but it should include finding the entry point and locking the site down.
Our website maintenance plans combine both. Maintain & Protect costs $40, $80 or $120 a month + GST, plus a one-off setup that includes a full security audit and lockdown. If your site is already compromised, the setup fee doubles ($240, $480 or $720 + GST), because the clean-up comes first. After that, the site is covered by “hack-free or we fix it free”.
Frequently asked questions
Will a security plugin remove malware from WordPress on its own?
It can find and remove a lot, and it’s a good first scan. But plugins run inside WordPress, so a deep infection can hide from them or disable them. Treat a plugin’s clean result as a starting point, then check users, uploads and core files by hand.
Should I just delete the site and start again?
Rarely. You’d lose content and still need the database. Replacing WordPress core, plugins and themes with fresh copies gives you most of the benefit of starting again, while keeping your pages, posts and settings.
How do I know the site is really clean?
Scan again with a different tool, check for unknown admin users, look for PHP files in uploads and compare core files against fresh copies. Then watch it for a few weeks. If nothing comes back and Google’s warning clears, you’re in good shape.
How long does a DIY clean-up take?
It depends on the site and the infection. A small site with a clean backup can be quick for a confident owner. Without a backup, or on a store with many plugins, it can stretch over several days, and Google’s review adds days or weeks on top.
Do I need to tell my customers about the hack?
If personal information may have been accessed and your business is covered by the Notifiable Data Breaches scheme, you may need to notify affected people and the OAIC. Even if you’re not covered, telling customers about suspicious emails or payments is the right thing to do.
Sources
- FAQ My site was hacked, WordPress.org, updated July 2026
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
- Quick reference guide for responding to data breaches, OAIC
- State of WordPress Security in 2026, Patchstack
- Security Issues report, Google Search Console Help