Guide
How to remove malware from a website, step by step
To remove malware, change every password, take the site offline if needed, restore a clean backup or remove the infected files, update everything, then close the hole the attacker used. Cleaning without fixing the cause usually means reinfection within days. If you host with us, contact live chat first, because we can scan the account and help you find a clean backup.
The short version
The cleanup in eight steps
Stay calm and do not delete blindly
Deleting files at random can break the site and destroy evidence of how the attacker got in.
Change every password
Hosting, WordPress admin, database, FTP and email, from a device you trust.
Take a copy of the infected site
Keep it for investigation, away from the server.
Scan to find what is infected
Use the hosting scanner and check recent file changes.
Restore a clean backup or remove the malware
A clean backup from before the infection is usually the safest route.
Update everything
Core, plugins, themes and PHP, and delete anything unused.
Check users, files and scheduled tasks
Attackers leave backdoors and extra admin accounts.
Ask for warnings to be reviewed
Use Google Search Console if your site was flagged.
Know the enemy
What website malware is and what it does
Website malware is malicious code planted on your site without your knowledge. It might redirect visitors to scam pages, add hidden links that sell spam products, send junk email through your server, steal form entries or card details, mine cryptocurrency using your server's resources, or simply give the attacker a permanent way back in, called a backdoor.
The code is often disguised. It may be tucked inside a legitimate-looking file in a plugin folder, hidden in a database field, or scrambled so that it looks like gibberish. Sometimes it only shows to visitors arriving from search engines and hides from the site owner, which is why many people are the last to know.
Understanding that malware is a symptom matters. The real problem is the weakness that let it in. Cleaning the code without closing that hole is like mopping a floor while the tap is still running.
Symptoms
Signs your website has malware
| Symptom | What it may mean | First check |
|---|---|---|
| Browser or Google warning page | Site flagged as dangerous | Search Console security issues report |
| Visitors sent to other sites | Redirect code in files or database | Test from a phone on mobile data |
| Odd pages or Japanese-looking text in search results | Spam pages injected | Search your site name in Google |
| Unknown admin users | Attacker created an account | Users list in WordPress |
| Files changed recently that you did not touch | Infected or replaced files | File manager sort by date |
| Hosting alert or suspended mail | Scanner found a threat or spam sent | Read the notice and the mail queue |
| Sudden slowness | Mining or spam sending | Resource usage graphs |
Need help checking your site?
Our live chat is open 24/7 and we can look at your account.
Step by step
Finding the infection safely
Start with the scanner your hosting provides. On our plans Imunify360 scans for malware and flags suspicious files, so the control panel and any notices from us are the first place to look. A scanner is not perfect, so also look at files sorted by modification date. Files in your uploads, plugins or theme folders that changed on a date you did not update anything are suspects.
Compare against known good copies. WordPress core files can be replaced with a fresh download of the same version, and plugins and themes can be reinstalled from their official source. Anything left over that does not belong to a plugin, theme or core is worth a close look. Pay particular attention to unfamiliar PHP files in the uploads folder, because genuine uploads are images and documents, not code.
Look at the database too. Check the users table for administrators you do not recognise, and the options for odd scripts added to titles or widgets. If you are not comfortable inside the database, ask us rather than guess.
Two routes
Restore a backup or clean by hand?
Restore a clean backup
- Fastest and most reliable when you have one
- Needs a backup from before the infection
- You may lose recent posts and orders
- Still need to update and close the hole
- Our weekly remote backups are kept for about a month
Clean the files by hand
- Keeps recent content
- Needs skill to spot every hidden file
- Easy to miss a backdoor
- Replace core, plugins and themes from fresh copies
- Best done with a specialist or with support
Closing the door
Finding out how the attacker got in
Most infections come from a short list of causes: an outdated plugin or theme with a known flaw, a stolen or weak password, a pirated "nulled" theme, or an old forgotten site sitting in a subfolder of the same account. Look at logs for the first signs of the problem and at which plugins were out of date at that time.
Once you know, fix that cause permanently. Update or remove the vulnerable plugin, delete forgotten test sites, and set strong unique passwords with two-factor login on admin accounts. Our guides on securing WordPress and the website security checklist cover the long-term steps.
If the same account shows several infections, one hole is probably still open. Do not just clean again. Search for backdoors such as unknown PHP files, extra scheduled tasks and unfamiliar FTP or admin accounts.
After cleanup
Recovering your reputation
Google warnings
Fix the problem first, then request a review in Search Console. Reviews are usually processed within days.
Email blocklists
If spam went out from your server, check whether your sending address was listed, and ask the list to remove it.
Customers
Tell customers honestly if their details may have been exposed and advise them to change passwords.
Fresh backup
Once the site is clean, take a new backup so you have a known good restore point.
Monitoring
Check the site for a few weeks afterwards for returning files or users.
Learning
Write down what happened and what changed, so the next person knows.
Law
Data protection and reporting
If personal data about customers may have been taken, UK data protection rules can require you to report certain breaches to the Information Commissioner's Office quickly, and to tell the affected people. The ICO website has a self-assessment to help you decide. This is general guidance, not legal advice, so take advice if you are unsure.
For fraud or extortion linked to the incident, Action Fraud is the national reporting centre. Keeping a dated record of what you saw and did makes any report much stronger.
Do not
Mistakes that lead to reinfection
- Cleaning files without changing passwords
- Leaving old plugins and themes installed
- Restoring a backup that was already infected
- Forgetting the database and extra admin users
- Ignoring other sites in the same account
- Using nulled themes again
- Skipping the update step
- Not watching the site afterwards
Prevention
Making the next infection less likely
Once the site is clean, spend an hour on prevention. Turn on automatic updates where you trust them, enable two-factor login, and decide who really needs administrator access. Fewer powerful accounts means fewer ways in.
Schedule a monthly look at the user list, the plugin list and the most recently changed files. It takes ten minutes and is often how the next problem is caught while it is still small.
FAQ
Common questions
Will you clean my site for me?
Contact live chat and tell us what you see. We can check the account with Imunify360 and help you restore from a clean backup. Deep manual cleanup of a site's code is best done with a developer.
How long does cleanup take?
Restoring a clean backup and updating can take under an hour. A manual cleanup of a large site may take much longer.
Can malware spread to other sites?
On our servers CloudLinux isolation keeps accounts apart, but several sites inside the same account can infect each other, so clean them all.
Why does the warning stay after cleaning?
Search engines recheck on their own schedule. Request a review in Google Search Console after the site is clean.
How do I prevent it happening again?
Keep everything updated, use strong passwords with two-factor login, delete unused plugins and keep tested backups.
Keep reading
Related pages
Hosting with malware scanning built in
Imunify360 and weekly remote backups on every plan.