WordPress virus removal: scanning, cleanup, and what to do afterward

How do you scan WordPress for viruses?

WordPress virus scanning takes place at three layers: security plugins running inside the site, online scanners visiting it externally, and hosting or server-side scans. WordPress documentation states that no single method is best, and combining application-based and remote scanners significantly increases the chance of detection.

Plugin-based scanners

A WordPress virus scanning plugin accesses site files internally, so it can also catch backdoors invisible from outside. WordPress’s hacked page mentions Wordfence and Sucuri among long-established application-based scanners; both are listed in the wordpress.org plugin directory:

• Wordfence Security: According to its directory page, it compares core, theme, and plugin files against versions in the WordPress.org repository; it searches files, posts, and comments for malicious URLs and known backdoor signatures.
• Sucuri Security: According to its directory page, it offers file integrity monitoring, remote scanning with SiteCheck, security event logging, and post-hack tools for renewing keys and resetting passwords.

The same page lists other scanners such as Quttera and GOTMLS. Since a plugin runs inside a compromised site, its result is not the final word on its own; a clean scan does not prove there is no infection.

The limits of online website virus scanners

Online website virus scanners open the site like an ordinary visitor and see only the code reaching the browser. WordPress documentation gives VirusTotal and Sucuri SiteCheck as examples in this group; Sucuri’s directory page also states that SiteCheck accesses the site like a normal visitor. A backdoor hidden in a PHP file on the server or spam shown only to search engine bots may not appear in this scan.

Server and hosting scans

Many hosting companies offer file scanning in their panels or through their support teams; this may cover folders the plugin cannot see and other sites in the same account. Ask the hosting company whether such a tool is available and how to interpret its findings. The following table compares the three methods side by side:

How do you verify core files?

WordPress core files are verified by comparing them against checksums published by WordPress.org using the WP-CLI wp core verify-checksums command. According to the command’s official documentation, the tool downloads MD5 checksums for the installed version and lists mismatching files. On a server with SSH access, check in this order:

1. Connect to the server through SSH and navigate to the root folder where WordPress is installed.
2. wp core verify-checksums is the command to run; for a Turkish installation, add --locale=tr_TR if necessary.
3. To also see non-WordPress files in the root folder, use the --include-root option.
4. For plugins in the WordPress.org directory, run wp plugin verify-checksums --all.
5. Note every mismatching file and replace it with the official copy of the same version.

This command does not verify themes and uploaded files under wp-content; even if core is clean, the infection may be in these folders. On shared hosting packages without SSH access, a similar comparison is made through security plugins’ core file checks.

How do you replace plugin and theme files from official sources?

Plugin and theme files are replaced by downloading the exact same version from the official source and replacing the entire folder through FTP/SFTP. WordPress documentation recommends copying through FTP/SFTP instead of the dashboard reinstall option; dashboard installers often only overwrite existing files, leaving new files added by attackers in place. The same page also states that wp-admin and wp-includes can be safely replaced and that the version must match the installed version.

• Download free plugins and themes from the wordpress.org directory and paid ones from the developer’s own account.
• Do not restore pirated plugins and themes from unknown sources, known as “nulled”; this code may provide a new infection route.
• Delete unused plugins and themes; Google’s cleanup guide also recommends removing software no longer used from the server.
• Compare changes in a child theme or custom code line by line with an older clean copy, if available.

WordPress documentation states that index.php, header.php, footer.php, and functions.php are frequent attacker targets because they can affect every page request. For custom themes without an official source, read these files manually; compare unfamiliar blocks against their backed-up versions before deleting them.

How do you find malicious code in uploads, the database, and users?

The easiest places to overlook during WordPress virus removal are areas outside file scanning. Malicious code can also hide in wp-content/uploads, database post and settings records, or fake administrator accounts. Examine these three areas manually, separately from core and plugin checks.

.php files inside wp-content/uploads

The uploads folder is for images, PDFs, and media files; a file with a .php extension here is a strong warning sign. Check through the file manager or in SSH using find wp-content/uploads -name "*.php". Because some plugins place empty protective files in subfolders, open and read every found file before deleting it.

Injected scripts and spam links in the database

Scan the database, particularly post content and the settings table (wp_posts and wp_options in most installations, though the table prefix may differ). Look for unfamiliar <script> tags, hidden links, and pharmaceutical, gambling, or foreign-language text unrelated to the site. Wordfence’s directory page states that it searches posts, comments, and files for malicious URLs on the Google Safe Browsing list. Before manual editing, back up the database; incorrectly altering serialized data in the settings table can break the site.

Unknown administrator users

Filter the Users screen by the Administrator role or run wp user list --role=administrator, and note every unfamiliar account. WordPress documentation lists new user creation as an obvious indicator of compromise. Note the registration date before deleting an account; this date provides a clue to when the attack began.

What should you check in wp-config.php and .htaccess?

In wp-config.php, look for unfamiliar include lines and encoded PHP blocks; in .htaccess, look for rules redirecting visitors to other domains. WordPress documentation describes .htaccess as one of the most frequently changed and abused files regardless of infection type; it may exist in subfolders as well as the root folder.

• wp-config.php: eval(, base64_decode( and similar encoded expressions and lines calling other files
• wp-config.php: undefined code added beyond database details and security keys
• .htaccess: RewriteRule lines sending search engine or mobile visitors to another website
• .htaccess: unexpected copies in subfolders such as uploads
• Modification dates: files recently changed although nobody touched them

Expressions such as base64_decode also occur in some legitimate plugins; they are not proof of malicious code alone and must be assessed in context. Make a copy of either file before deleting suspicious lines.

What gets changed after cleanup?

When cleanup is finished, renew security keys (salts), change all passwords once again, update WordPress, plugins, and themes, and add two-step verification to administrator logins. This order follows the recommendations on WordPress’s hacked page and in the Hardening WordPress guide:

1. Security keys: Obtain a new set from the WordPress key generator and replace the values in wp-config.php; according to WordPress documentation, this signs out everyone with an active session.
2. Passwords: Replace administrator and all other user, FTP/SFTP, hosting panel, and database passwords with long, unique passwords; also update wp-config.php when the database password changes.
3. Updates: The hardening guide states that older WordPress versions do not receive security updates; update core, plugins, and themes to the latest versions.
4. Two-step verification: The same guide recommends two-step verification for administrator logins as an additional measure.
5. Dashboard file editing: A DISALLOW_FILE_EDIT line added to wp-config.php disables editing theme and plugin files through the dashboard.

WordPress virus removal is not complete until the vulnerability the attacker used is found; WordPress documentation calls this stage forensics and states that its purpose is to prevent reuse of the same route. Long-term protection is explained in detail in the WordPress security guide.

What do you do in Search Console if Google shows a warning?

If Google flags the site as hacked or malicious, the warning appears in Search Console’s Security Issues report, and the review request is sent through the same report after cleanup. According to Google’s Security Issues report page, the report covers hacked content, malware, and social engineering. The same page states that most reconsideration reviews may take a few days or a few weeks.

Google requires issues to be fixed throughout the site, not just on example pages, and states that sending a new request while a decision is pending may prolong the process. Cleanup guides by attack type are collected in Google’s help for hacked sites series. How to prepare a review request and the process for removing the search results warning are explained on the recovering a hacked WordPress site page.

Common mistakes: quick deletion or step-by-step cleanup?

The most common WordPress virus removal mistake is deleting only the visible symptom while leaving the infection source and the attacker’s entry vulnerability in place. A step-by-step approach follows the order of backup, scanning, cleanup, access renewal, and closing the vulnerability. The differences are clearest in these areas:

Another common mistake is restoring an old backup and considering the job finished. If the backup was taken after infection began, it brings back the malicious code too; if the restored installation is not updated, the same vulnerability remains. Deleting every suspicious file during WordPress malware removal is also risky: removing a legitimate plugin file can stop the site from working.

When is professional support needed?

Professional support becomes reasonable when SSH or file access to the server is unavailable, infection returns after cleanup, the site is an e-commerce store holding customer data, or a Google warning affects sales. On a site with one plugin, a current backup, and limited symptoms, the business can also take the initial steps in the order above. At Onur Freelance, based in Maltepe since 2019, WordPress virus removal follows this sequence:

1. Examine the symptoms and hosting setup, and back up the infected state.
2. Compare plugin, server, and external scan results.
3. Replace core, plugin, and theme files from official sources; manually check uploads, the database, and users.
4. Renew keys and passwords, install updates, and prepare a Google review request if needed.

No cleanup method can promise there will never be another attack; regular updates and monitoring continue afterward. Onur Freelance’s hacked WordPress site recovery service covers this process, with scope clarified in the initial consultation. For updates and backups after cleanup, the WordPress maintenance and updates service costs 500–2,000 TL per month.