How to Clean an Infected WordPress Website

Cleaning a WordPress site is three jobs: remove the malicious code, close the way in, and prove nothing was left behind. Skip the second and you will do all three again next month.

Before you touch anything

1. Take a snapshot of files and database as they are. This is your evidence.
2. Note what you know: when it started, what changed recently, what the host or Search Console said.
3. Take the site offline or into maintenance mode if it is actively harming visitors.

Cleanup

1. Replace WordPress core with a fresh official copy of the same version, preserving only wp-config.php and wp-content.
2. Reinstall every plugin and theme from source rather than editing files — deleting and reinstalling is faster and more reliable than cleaning by hand.
3. Delete anything that is not a legitimate plugin or theme, including plugin-shaped directories that are not in the directory.
4. Remove PHP files from uploads, then block PHP execution there.
5. Clean the database: injected content in posts and options, rogue administrators, unexpected scheduled tasks.
6. Reset every credential — WordPress admins, database, hosting, FTP/SSH, API keys — and regenerate the salts.

Close the way in

Now identify the entry point: an unpatched plugin with a known vulnerability, a stolen credential, a shared-hosting neighbour, or an outdated PHP version. Scan the site and patch everything in the fix-today bucket. If a vulnerable plugin has no patched version, replace it before going back online.

Prove it is clean

1. Compare core files again — no modifications.
2. Re-check as a logged-out mobile visitor from a search referrer.
3. Request review in Search Console and with any blacklist that flagged you.
4. Watch logs for a fortnight for repeat attempts on the endpoint that was used.

If any of this is beyond what you want to take on: malware removal and emergency repair.

Hardening reduces the damage. Patching removes the hole. Scan your site free to see what still needs patching.