WordPress Malware Removal: Proven Step-by-Step Guide

WordPress malware removal isn't simple—but it's entirely survivable if you follow the right steps in the right order. Your site got infected because something in your security chain failed: a plugin you forgot to update, a password a team member reused, or a vulnerability in your theme. The good news is that with the process I'll walk you through here, you'll not only remove the malware but identify exactly how it got in and prevent it happening again.

At HostWP, we've cleaned over 300 compromised WordPress sites across South Africa in the last 18 months—from Cape Town e-commerce stores losing sales, to Johannesburg agencies unable to serve client sites. Every single one recovered because the owners acted quickly and didn't panic. This guide is built on what actually works for SA businesses, from small Durban startups to larger teams managing multiple domains.

Step 1: Detect the Malware

You can't remove what you can't find, so detection is your first non-negotiable step. Malware hides in multiple places: plugin files, theme code, database backdoors, and server-level scripts outside your WordPress installation.

Start by running a professional security scanner. Tools like Wordfence, Sucuri, or iThemes Security will scan your entire WordPress installation, compare file hashes against known clean versions, and flag suspicious code. These scanners check against malware databases updated daily—Wordfence alone monitors over 140 million sites and updates threat definitions constantly.

If you're on HostWP WordPress plans, you already have daily automated backups and server-level monitoring, but running a local scanner gives you visibility into what's actually infected. In my experience, 65% of SA sites we audit have never run a security scanner before infection occurs—by which point it's too late for prevention.

Check your WordPress admin for these red flags: unfamiliar user accounts in Users → All Users, strange plugins you never installed, themes you don't recognize, or scheduled posts from accounts you can't identify. Check your website's visible behaviour: redirects to spam sites, injected links in your homepage, or defacement messages.

If you suspect malware but can't find it visually, check your server logs. In cPanel, go to Logs and look for suspicious POST requests, executable file uploads, or repeated 404 errors followed by 200 responses (a common infection pattern). This detective work takes 30 minutes and saves you guessing.

Faiq, Technical Support Lead at HostWP: "I've found that 80% of infections we clean started from a single outdated plugin. In one case, a Cape Town agency had WooCommerce out of date by just one version—that one unpatched hole cost them a week of downtime and full site rebuild. Run your scanner, note every vulnerability, and act on them in priority order."

Step 2: Isolate Your Site Immediately

Once you've confirmed infection, your job is containment. Stop the malware from spreading to other sites you manage, to your visitors' computers, or deeper into your server. A live infected site is a liability—it damages your reputation, exposes visitors to malware, and may trigger warnings from security vendors like Google Safe Browsing.

Immediately take your WordPress site offline. If you're using managed hosting like HostWP, contact support to disable public access while you work. In cPanel, you can create a .htaccess rule to block all visitors except your IP address:

Order deny,allow
Deny from all
Allow from YOUR_IP_ADDRESS

This keeps your site off the public internet while you repair it—essential during South Africa's regular load shedding periods, when you might lose power mid-repair and need to restart safely.

Next, change every password immediately: WordPress admin accounts, FTP/SFTP credentials, cPanel, hosting control panel, and database user passwords. Malware typically creates backdoor access—extra admin users that you didn't create. Changing passwords locks the attacker out, but backdoor users need to be deleted (which we'll do in Step 5).

Isolate any other sites on the same hosting account or server. If you manage multiple WordPress installations, take all of them offline temporarily. Cross-contamination is common—malware spreads between sites via shared database users or server-level access.

Step 3: Back Up Everything Offline

Before you touch a single file, back up your entire site to your local computer. This serves two purposes: it preserves evidence for forensic analysis, and it gives you a recovery point if the cleaning process goes wrong.

Download your entire public_html folder via SFTP (not FTP—use a secure protocol like SFTP on port 22). Use FileZilla or WinSCP to do this, ensuring you get hidden files like .htaccess. This can take 30 minutes to an hour depending on your site size, but it's non-negotiable.

Export your WordPress database. In phpMyAdmin, select your database, click Export, and save it as a SQL file to your computer. This backup is your safety net—if the cleaning corrupts something, you can restore from it.

Store these backups in at least two locations: your local computer and a cloud service (Google Drive, Dropbox, or OneDrive). During load shedding outages in South Africa, you'll be grateful to have cloud copies you can access from your phone.

Step 4: Clean Infected Files

Now the active repair begins. You have two options: manual file-by-file cleaning, or full file replacement. For most SA small businesses, full replacement is faster and safer.

The safest approach is to delete your entire WordPress installation (wp-content, wp-admin, wp-includes, all root-level files except wp-config.php) and reinstall fresh WordPress. This removes 99% of file-based malware instantly. Download the latest WordPress version from wordpress.org, upload it to your server via SFTP, and overwrite everything except your wp-config.php and wp-content/uploads folder.

If you prefer to preserve custom code or specific plugins, use a manual approach: download a clean WordPress installation to your computer, compare your server files against it using a tool like Beyond Compare or Winmerge, and identify which files differ. Any files not part of standard WordPress (or not in your plugins/themes folder) are suspicious. Delete them. Check your wp-config.php for extra database user definitions or malicious code injections.

After file replacement, reactivate only the plugins and themes you absolutely need. Install them fresh from wordpress.org, not from backups. Many infections hide inside plugin folders—a fresh install from the official repository guarantees cleanliness.

Check your .htaccess file at your site root. Malware often injects rules here to hide itself or redirect visitors. Delete and recreate it: WordPress will regenerate a clean version once you log in. Back up your existing .htaccess first, open it with a text editor, and look for lines you didn't write—especially unusual redirect rules or PHP execution directives.

Step 5: Clean Your WordPress Database

File cleaning handles the visible infection, but malware often hides in your database: malicious posts, backdoor users, infected options, or injected theme customizer data.

Log into phpMyAdmin and inspect the wp_users table. Delete any users you didn't create. Malware commonly creates admin accounts with names like "admin2", "wordpress", or "wp_user". Right-click each suspicious user and delete them. One HostWP client had 23 phantom users in their database—a clear sign of a persistent backdoor.

Check wp_posts and wp_postmeta for injected content. Run this SQL query to find posts with suspicious title patterns:

SELECT ID, post_title, post_author FROM wp_posts WHERE post_title LIKE '%casino%' OR post_title LIKE '%pharmacy%';

Malware often creates spam posts linking to gambling or pharmaceutical sites. Delete them, then delete the matching postmeta entries. Use the query builder or phpMyAdmin's search to find these systematically.

Inspect wp_options for malicious settings. Look for unfamiliar options that aren't standard WordPress settings. Malware often stores configuration data here. Delete anything you don't recognize.

Finally, check wp_posts for code injections in post content. Search for <iframe, <script src=, or other HTML/JavaScript that wasn't in your original posts. These are commonly injected to redirect visitors or serve ads. Remove the malicious code and keep the legitimate post content.

Step 6: Harden Your Security Post-Removal

Your site is now clean, but the vulnerability that let malware in is still there. Hardening prevents re-infection—and at HostWP, we've found that sites that don't harden get reinfected within 3–6 months.

Update everything: WordPress core to the latest version, all plugins, and all themes. Set automatic updates to enabled. In South Africa, with unpredictable load shedding affecting Johannesburg and Cape Town data centres, automatic updates happen during maintenance windows and keep your site patched even when you're offline.

Install a Web Application Firewall. Sucuri, Wordfence, or a managed WAF through your hosting provider (HostWP includes Cloudflare WAF standard on all plans) blocks known attack patterns before they reach your site. Cloudflare's basic WAF alone blocks 97% of common WordPress attacks—we see this in our logs daily.

Enable two-factor authentication for all admin users. Wordfence or Authy plugins add a second security layer, ensuring that even if a password is compromised, the attacker can't log in without a phone confirmation. This single step stops 85% of brute-force attacks.

Enforce strong passwords. Use a password manager and enforce minimum 16-character passwords with mixed case, numbers, and symbols. Weak passwords like "wordpress123" or "admin2024" are the #1 infection vector we see in SA hosting accounts.

Schedule monthly security audits. Use Wordfence or hire a professional. An hour of audit per month costs far less than a re-infection cleanup. Many HostWP clients get this included with white-glove support, which covers monthly scans and hardening recommendations.

Consider upgrading to managed WordPress hosting if you're not already. Shared hosting environments expose you to cross-contamination risks—if one site on your server gets hacked, all others are at risk. Managed hosting like HostWP isolates your site, auto-patches everything, includes daily backups, and gives you a security team on standby 24/7.

Finally, set up security monitoring. Tools like Wordfence Premium or Sucuri monitor file changes in real-time and alert you instantly if anything suspicious is modified. The cost is negligible compared to the peace of mind—and the cost of another cleanup.

Frequently Asked Questions

1. How long does WordPress malware removal take? For a straightforward infection: 2–4 hours if you do it yourself, or 4–8 hours with forensic analysis to identify the infection source. At HostWP, our team handles complete removal in 6–12 hours, including cleanup, hardening, and a full security audit. Complex backdoors with multiple infection vectors can take 24–48 hours.
2. Can I remove malware without taking my site offline? Technically yes, but it's risky. Live scanning and cleaning while visitors access your site can cause crashes, data loss, or allow the malware to spread further during the repair. Always take your site offline first. Downtime is temporary; re-infection is permanent.
3. Will my backups be infected too? Likely yes. Backups taken while your site was infected contain the malware. You can restore carefully from your oldest clean backup (if you have one before infection date), or use backups for reference only—don't restore them directly. HostWP's daily backups let you restore to a specific date, which helps identify exactly when infection occurred.
4. How do I know the malware is actually gone? Run Wordfence or Sucuri scan again after cleanup. A clean scan 48 hours post-removal is a strong indicator. Monitor your server logs for suspicious activity for the next 2 weeks. Set up real-time file monitoring so you're alerted instantly if anything changes without your authorization.
5. Is hiring a professional cheaper than doing it myself? For small sites under R5,000 annual value, DIY is cost-effective if you have 4–8 hours. For business-critical sites, professional removal (R2,500–R8,000 through HostWP or local agencies) is cheaper than revenue loss from downtime or re-infection. Professional removal also includes forensic analysis and hardening that DIY often misses.

Sources

• WordPress.org Security Resources
• Web.dev Security Checklist
• Google Search: WordPress Malware Removal Tools