How to Find Malicious Files in WordPress (Complete Guide)

Removing WordPress malware has a frustrating failure mode: you clean what you can see, the site looks fine for a week, and then the infection is back. The reason is almost never reinfection from outside. It is a file you missed the first time, a backdoor sitting quietly in a folder nobody thinks to check, waiting to restore its friends.

Finding every malicious file is therefore the whole game. This guide covers where malware actually hides in a WordPress installation, and then a systematic process to find it all using the WordSec scanner, so the cleanup sticks the first time.

Where malicious files hide in WordPress

After enough incident cleanups, the hiding spots repeat. Check these first, and take the list with you into the scan results:

• wp-content/uploads: the number one location. The uploads tree is writable by design and should contain media only. Any .php file in it is guilty until proven innocent.
• Fake or lookalike plugin folders: a directory named wp-optimizer-pro or akismet2 containing a single PHP file is a backdoor wearing a costume.
• Modified core files: attackers append loader code to files that run on every request, like index.php, wp-settings.php, or wp-config.php.
• mu-plugins: must-use plugins load automatically and never appear on the normal Plugins page, which makes the folder a favorite persistence spot.
• Theme files: functions.php of the active theme runs on every page load, so injected code there is both effective and easy to overlook.
• Disguised file names and extensions: malware ships as favicon_bak.ico, .cache.php, or wp-log1n.php, banking on nobody reading file listings closely.
• The database: injected JavaScript in posts and widgets, or PHP serialized into options. Not a file at all, which defeats file-only scanners.
• Scheduled cron tasks: a wp-cron job that re-downloads the payload after every cleanup. This is the classic cause of "it came back".

A single infection typically uses several of these at once: one visible payload, one or two quiet backdoors, and a cron job as insurance.

Step 1: Run a full seven-stage scan

Install WordSec, open the Scanner module, and run a full scan. The stages map directly onto the hiding spots above: file integrity, version checks, permissions and ownership, backup and log file detection, malware signatures, cron tasks, and the database. On large sites, enable low resource mode so the scan does not compete with your visitors while it works through the file tree.

The following steps walk through reading the results the way an incident responder would.

Step 2: Start with file integrity, not signatures

Jump to the file integrity findings first. This stage compares your core files against the official WordPress originals and lists every added, deleted, and changed file. It is the most trustworthy signal in the whole report, because it does not depend on recognizing the malware, only on knowing what clean looks like.

Treat the three categories differently:

• Changed core files: almost certainly malicious edits. Core files do not modify themselves.
• Added files in core directories: no legitimate plugin adds files to wp-admin or wp-includes.
• Deleted files: rarer, but some malware removes security-related files.

Step 3: Review the malware signature findings

Next, go through the malware stage results, where files matched one of WordSec's 117 detection rules. For each finding you get the file path and the matched rule, and two safe verification tools:

• View the flagged content directly in the dashboard, without touching the file over FTP or executing anything.
• Check the file on VirusTotal with one click, to get independent antivirus engines' opinions on the same content.

That second opinion matters most for the gray zone: obfuscated code that might be a nulled plugin's license check or might be a webshell. If you want to know what you are looking at, eval, base64_decode, gzinflate, and create_function chained together in a file that has no reason to exist is the signature look of packed malware.

Step 4: Check permissions, leftovers, and versions

Three quieter stages fill in the picture:

• Permissions and ownership: world-writable directories and files owned by the wrong user are how the malware got write access. Fix these or the next infection uses the same door.
• Backup and log detection: forgotten backup.zip, db.sql, and debug.log files leak credentials and structure. Remove them from the web root.
• Version checks: outdated components with known vulnerabilities show you the likely entry point. Cross-reference against the vulnerability database and see How to Protect WordPress from Vulnerable Plugins and Themes.

Step 5: Hunt the persistence: cron and database

Now close the comeback routes. In the cron tasks results, review every scheduled job. Legitimate jobs come from WordPress core and your known plugins; a job with a random-looking hook name, or one that fetches a remote URL, is the reinstaller. In the database stage results, look for injected script tags and suspicious option entries.

This is the step most manual cleanups skip, and the reason WordSec scans cron and the database as first-class stages rather than files only.

Step 6: Quarantine, verify, then delete

Resist the urge to mass-delete. The safe workflow per finding:

1. Quarantine the file. It is disarmed immediately but not gone.
2. Watch the site for anything that breaks. A false positive shows up here as a broken feature, and you can restore the original in one click.
3. Once confirmed, delete permanently. For common integrity findings, auto fix restores the official version of a modified core file directly.

Repeat until the findings list is empty, then run a second full scan. A clean second scan, including cron and database stages, is your actual finish line. The full incident process around this, including post-cleanup password rotation, is in How to Scan and Remove Malware from WordPress.

Step 7: Keep watch so round two never comes

Two settings turn this from a one-time cleanup into standing coverage:

• Scheduled scans re-run all seven stages automatically, and scan history lets you prove when a file first appeared.
• The Alarm module sends real-time notifications to email, Telegram, or Slack for security events, so the next unexpected change pings your phone instead of waiting for your next manual check.

For a real-world case of how fast attackers move from disclosure to mass exploitation, read our analysis of the wp2shell pre-auth RCE campaign: the sites that found the dropped files early were the ones with automated scanning already running.

Frequently asked questions

How do I find hidden malware files in WordPress?

Run a multi-stage scan that covers file integrity, malware signatures, cron tasks, and the database, then work the findings from integrity outward. Hidden malware relies on you checking only the obvious places; a seven-stage scan removes that advantage.

Are PHP files in wp-content/uploads always malicious?

Effectively yes. WordPress stores media in uploads, not executable code. The rare legitimate exception comes from a poorly built plugin, and even then it deserves scrutiny. Treat every PHP file in uploads as a finding.

Why does my malware keep coming back after I delete it?

Because a backdoor or a malicious cron job survived the cleanup and reinstalls the rest. Scan scheduled tasks and the database, not just files, and audit mu-plugins and your theme's functions.php for leftover loaders.

Can I just reinstall WordPress to remove malware?

Reinstalling core replaces modified core files, which helps, but it does not touch uploads, themes, mu-plugins, the database, or cron entries, where most persistence lives. A reinstall plus a full multi-stage scan is the reliable combination.

What tools do I need to find malicious files?

A scanner with file integrity checking, signature detection, database and cron coverage, safe content preview, and quarantine. WordSec provides all of these from the WordPress dashboard on the free plan, including VirusTotal lookups for second opinions.

---

Find everything, remove it once: install WordSec, run the full scan, and then harden the site with the WordPress Security Checklist 2026 so there is no next infection to hunt.