Malware hides from the site owner, not from the server. Look at the evidence the attacker cannot easily edit before you look at the pages they can.
Start with signals you do not control
Search Console — security issues and manual actions appear here first for most owners.
Google Safe Browsing / browser warnings — a blunt but reliable signal.
Your host — suspension notices, abuse reports and outbound-mail spikes.
Server logs — repeated POSTs to a single plugin endpoint, or requests to files that should not exist.
Then the site itself
Compare core files against the official release. Any modification in wp-includes or wp-admin is a finding, not a curiosity.
List PHP files in wp-content/uploads. There should be none.
Check file modification times across plugins and themes for a cluster of recent changes you did not make.
Review the user list for administrators you do not recognise, and for accounts created around the suspicious dates.
Check scheduled tasks for jobs you did not create.
Search the database for injected script tags and iframes in post content and options.
View the site as a logged-out visitor from a mobile user agent — a lot of redirect malware only fires for those.
Being unable to find malware is not evidence there is none. If external signals say you are infected and your scan says you are clean, believe the external signal and keep looking.
