Symptoms include:

• Your website redirects to spam websites
• Unknown admin users appear in dashboard
• Google flags the site as malicious
• Random pop-ups or advertisements
• Files modified without your knowledge
• Host sends malware warning
• Site becomes extremely slow or crashes

Detecting early reduces cleanup time and prevents damage.

Best malware scanners:

• Wordfence Security — best free scanner
• MalCare — automatic malware detection
• iThemes Security Pro
• Sucuri SiteCheck (online scanner)

Scan your entire site — core files, plugins, themes, uploads, and database.

Before deleting or editing infected files, create a full backup (files + database).

Recommended backup tools:

• UpdraftPlus
• All-in-One WP Migration
• BlogVault

Store the backup off-site (Google Drive, Dropbox, S3).

Best auto-cleanup tools:

• MalCare — 1-click malware removal
• Sucuri — enterprise-grade malware cleanup
• Wordfence Premium

Automatic cleanup removes malware from files and database without breaking your site.

Steps to clean manually:

1. Identify infected files via scanner logs
2. Open each file and remove suspicious code (iframe, eval, base64, obfuscated script)
3. Compare file with a clean WordPress core file
4. Delete unknown PHP files inside:
• /wp-admin
• /wp-includes
• /wp-content/uploads/
5. Remove infected cron jobs
6. Clean infected database tables (wp_options, wp_posts, wp_users)

Manual cleanup is risky — always keep a backup.

Go to Dashboard → Updates → Reinstall WordPress.

This reloads a fresh copy of WordPress without affecting your content or settings.

Reset passwords for:

• All WordPress users
• Hosting account
• FTP / SFTP users
• Database user
• Email accounts (if used for WP login)

Remove:

• Plugins you don’t use
• Outdated themes
• Nulled / cracked templates

Use only trusted sources like WordPress.org or official authors.

Recommended firewalls:

• Wordfence Firewall
• Cloudflare WAF
• MalCare Firewall

Hardening tips:

• Enable 2FA
• Secure wp-admin
• Disable file editing
• Update plugins weekly
• Use strong passwords
• Install SSL/HTTPS
• Regular automatic backups