When a WordPress site is compromised, the attacker rarely announces it. They drop a webshell in an uploads folder, inject a few lines into a legitimate file, or schedule a malicious cron job, then come back later. By the time you notice spam pages, redirects, or a hosting suspension, the infection has often been live for a while.
The way to catch this early is to scan regularly and know what to do with the results. This guide walks through scanning WordPress for malware and cleaning it safely using the WordSec Scanner, which runs seven scan stages backed by 117 malware detection rules.
What a malware scan looks for
Good scanning is not just pattern-matching for known viruses. It checks several independent signals, because malware hides in different places:
- File integrity: files that were added, deleted, or changed compared to a known-good baseline.
- Malicious code: webshells and suspicious PHP payloads.
- Configuration and ownership: wrong permissions and unexpected file owners.
- Leftovers: forgotten backups and log files that leak data or give attackers a foothold.
- Scheduled tasks: cron jobs that re-infect a site after you clean it.
- The database: injected content and malicious options.
WordSec covers all of these across its seven stages: file integrity, versions, permissions and ownership, backup and log detection, malware, cron tasks, and database.
Step 1: Install WordSec and run a first scan
Start with a baseline scan so you know where the site stands:
- In your WordPress admin, go to Plugins, Add Plugins, search for WordSec, install it, and activate.
- Open the WordSec menu, click Get Key, then open the Scanner module.
- Run a full scan and let all seven stages complete.
If you are on a busy site, enable low resource mode so the scan runs gently in the background without competing with your visitors.
Step 2: Read the results without panicking
A first scan often surfaces findings that are not malware: a legitimately modified file, a permissions quirk, an old backup. The goal at this stage is triage, not deletion.
WordSec helps you tell signal from noise. For any flagged file you can:
- View the file content directly, so you can see what was actually detected.
- Check it on VirusTotal with one click, comparing it against dozens of antivirus engines.
The cardinal rule of malware cleanup: confirm before you delete. A scanner points you at suspects. You decide what is actually malicious, using the file content and a second opinion from VirusTotal.
The file integrity stage is especially useful here. Because it compares against known-good versions, a changed core or plugin file that should never change is a strong signal, while a changed file you edited yourself is expected.
Step 3: Clean confirmed malware safely
Once you have confirmed a file is malicious, WordSec gives you three safe actions:
- Quarantine: move the file out of harm's way while keeping a copy you can restore. This is the safest first move.
- Delete: remove it entirely once you are certain.
- Restore the original: for a tampered core or plugin file, replace it with the clean version instead of deleting it, so the site keeps working.
For common issues, auto fix can resolve the finding for you. Quarantine first when you are unsure, since it is fully reversible. Deletion is final.
Step 4: Pull the infection out by the roots
Removing a webshell is not enough if the attacker left a way back in. After cleaning the obvious files, check the stages that reveal persistence:
- Cron tasks: a malicious scheduled job can re-download malware minutes after you delete it. Review the cron stage and remove anything you do not recognize. The toolbox also has a dedicated cron viewer.
- Database: injected admin users, spam options, and malicious content live here, not in files.
- Permissions and ownership: files owned by the wrong user, or world-writable folders, are how attackers wrote the malware in the first place.
Clean all of these in the same pass, or the infection can simply come back.
Step 5: Close the door that let it in
A site that was infected once will be infected again unless you fix the entry point. The most common causes are a vulnerable plugin or theme and a weak login. Address both:
- Review your plugins and themes for known vulnerabilities and abandonment. The Supply Chain Security module scores every one, and our guide on protecting WordPress from vulnerable plugins and themes explains the process.
- Lock down authentication with the steps in How to Stop Brute Force Attacks on WordPress.
- Put a firewall in front of the site so the next exploit attempt is blocked before it lands.
Step 6: Schedule scans so you catch the next one early
Manual scanning is fine for a cleanup. Ongoing protection needs automation. In the Scanner module:
- Set scheduled scans to run automatically on a regular cadence.
- Configure quick-scan stages for fast, frequent checks between full scans.
- Use the remote scan trigger to start a scan from outside the dashboard when you manage many sites.
- Keep an eye on the full scan history to spot trends over time.
With scheduled scanning on, file integrity changes are surfaced within hours instead of weeks, which is the difference between a quick cleanup and a full incident.
Frequently asked questions
How do I know if my WordPress site has malware?
Common signs include unexpected redirects, spam pages or pop-ups, a sudden drop in search rankings, browser or hosting warnings, and new admin users you did not create. The reliable way to confirm is a scan: WordSec checks file integrity, malware signatures, cron jobs, and the database across seven stages.
Can I remove WordPress malware without a developer?
Often, yes. WordSec lets you view flagged files, confirm them on VirusTotal, then quarantine, delete, restore, or auto-fix them from the dashboard. For a deeply compromised site, restoring from a clean backup and then closing the entry point is still the safest route.
Will a malware scan slow down my website?
Not if you use low resource mode, which throttles the scan so it runs gently in the background. You can also schedule scans for quieter periods and use quick-scan stages for lighter, more frequent checks.
How often should I scan WordPress for malware?
Schedule a full scan at least weekly, with more frequent quick scans on busy or high-value sites. Automated scheduled scans mean a newly changed or injected file is caught within hours rather than discovered weeks later.
What should I do first if I find malware?
Quarantine the confirmed file rather than deleting it, since quarantine is reversible. Then check cron jobs and the database for persistence, fix the permissions or vulnerability that allowed the infection, and run a fresh full scan to confirm the site is clean.
Scan your site today: install WordSec and run all seven stages, then read the complete security guide to keep it clean.