WordPress Malware Removal: DIY, Plugin, Free Offer or Paid Service

WordPress malware removal means finding every piece of malicious code on a hacked site, removing it, closing the hole the attacker used, and getting search engines and browsers to trust the site again. You can do it yourself, run a scanner plugin, use a free cleanup offer or pay a service. The right choice depends on what the site earns and how deep the infection goes.

This page is the buyer's guide. It compares the four routes honestly, lists what a proper cleanup must include, shows what scanners routinely miss, and gives you the questions that separate a careful provider from one who deletes a few files and sends an invoice. If you want to do the hands-on work yourself, our step-by-step guide to fixing a hacked WordPress site has the commands. We also counted every WordPress entry in the US government's list of exploited vulnerabilities, because it shows how little time owners now have between a fix and an attack.

Is my site hacked in WordPress?

Your site is probably hacked if visitors are redirected to sites you do not own, Google shows pages or text you never wrote, a browser or Search Console shows a security warning, or new admin users and files appear that nobody on your team created. One of these signs is enough to treat the site as compromised until proven otherwise.

Some symptoms look like hacks but are not. A broken plugin update, an expired SSL certificate or a host outage can also make a site misbehave. This table separates the two.

If two or more of the "yes" rows apply, skip the debate about whether you are hacked and move straight to choosing how to clean it.

Your four options for WordPress malware removal

There are four realistic ways to remove malware from WordPress: do it yourself, run a security plugin's scanner and cleanup tools, use a free cleanup offer from a security vendor, or pay a service or developer for a full cleanup. A fifth option, restoring a clean backup, is often the fastest of all when it is available, and it is covered in its own section below.

The price of a cleanup is the smallest number in this decision. The larger costs are days of lost sales or leads, a Google warning that scares visitors away for weeks, and a second infection when the first cleanup missed a backdoor.

How can I scan my WordPress site for malware?

Scan your WordPress site for malware in three layers: an outside check that sees what Google and visitors see, a plugin scan of the files and database, and a server-side check of what plugins cannot see. Each layer catches things the others miss, so one clean result from one layer does not prove the site is clean.

Layer 1: what the outside world sees

• Google Search Console, Security issues report. If Google has flagged the site, the report names the issue type and often sample URLs. It is free and it is what Google itself uses to decide on warnings.
• Google's Safe Browsing site status at transparencyreport.google.com. Paste your domain to see whether Google currently treats it as unsafe.
• A site: search. Search site:yourdomain.com and look for titles you did not write. Spam pages often show up here before anywhere else.
• A phone on mobile data. Many redirect hacks only fire for mobile visitors arriving from search. Search for your business on a phone and tap the result.

Layer 2: a plugin scanner

A scanner plugin compares your files against known malware signatures and against the original copies of WordPress core, themes and plugins. That is useful, but read what the free tiers actually say. The WordPress.org listing for Wordfence states that real-time malware signature updates are a Premium feature and the "free version is delayed by 30 days". Its listing also says its removal tools let you delete files, and adds: "Remember to investigate the scan results and backup files first!" The MalCare listing describes cloud scanning as free and lists malware removal and cleanups as paid features. The Malcure listing notes that "a free Malcure Cloud connection is required."

None of this makes these tools bad. It means a free scan is a detection tool, and detection is the first step, not the cleanup.

Layer 3: checks a plugin cannot do well

A developer with SSH access can check things that a plugin running inside an infected WordPress cannot be trusted to report. These are read-only checks: they change nothing.

# do WordPress's own files match the official release?
wp core verify-checksums

# same check for plugins from the WordPress.org directory
wp plugin verify-checksums --all

# every administrator, with registration date
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# PHP files where only media should be
find wp-content/uploads -type f -name "*.php"

# must-use plugins and drop-ins load before normal plugins and are easy to miss
ls -la wp-content/mu-plugins/ 2>/dev/null
ls -la wp-content/db.php wp-content/advanced-cache.php wp-content/object-cache.php 2>/dev/null

# scheduled tasks, including ones a plugin did not create
wp cron event list --fields=hook,next_run_relative,recurrence

Our hacked site guide goes much further, with database queries for injected options and a way to see what Googlebot is served. If any of these checks return something you cannot explain, stop and get help before deleting things, because the evidence of how the attacker got in is in those same files.

What malware scanners miss, and why cleanups fail

Scanners miss malware that lives outside the files they check, malware that is too new to have a signature, and the way the attacker got in. A cleanup that removes the visible malware but not these pieces usually fails within days, which is why "it came back" is the most common reason owners end up paying for a second cleanup.

A real example shows how deep this can go. On 1 October 2026, The Hacker News reported on a Sucuri analysis of a WordPress backdoor designed to rebuild itself. The researcher wrote that "the payload lives in at least eight places at once" and that if you "clean every file on disk, the next page load restores the whole set from the database". The places listed included:

• a .user.ini file that runs a loader before every PHP request;
• a fake plugin in mu-plugins, which loads automatically and does not appear in the normal plugin list;
• the db.php and advanced-cache.php drop-ins, which WordPress loads early;
• a theme's functions.php;
• a compressed copy of the payload stored for redeployment;
• cron hooks with random names, triggered by the server's own cron;
• a hidden administrator account;
• and, on servers that support it, a shared memory segment that "survives file deletion and database cleanup alike".

Most infections are far simpler than that one. But it is a fair picture of what "clean" has to mean: every copy removed at the same time, plus the door closed. Here is what each common shortcut leaves behind.

What a proper WordPress malware cleanup includes

A proper cleanup covers the files, the database, the users, the scheduled tasks, the credentials, the way in, and the public warnings. If a provider's description of the work does not cover each of these, ask which parts are excluded before you agree to it.

1. A backup of the infected site before anything changes. It preserves evidence and protects content and orders added since the last clean backup.
2. Root cause. Which plugin, theme, password or server weakness let the attacker in. Without this, the site is cleaned and then reinfected through the same door.
3. Core files replaced with a clean copy of the same WordPress version and checked against official checksums.
4. Plugins and themes replaced with clean copies from the official source, not just "cleaned", and abandoned or nulled (pirated) ones removed.
5. Uploads swept for executable files and for code hidden inside image or archive files.
6. Must-use plugins, drop-ins, .htaccess, .user.ini and wp-config.php reviewed line by line.
7. Database reviewed: injected scripts in posts and widgets, malicious options, spam pages, and payloads stored for reinfection.
8. Users reviewed: unknown administrators removed, every remaining admin confirmed with the owner, sessions ended.
9. Scheduled tasks reviewed in WordPress cron and the server's crontab.
10. Credentials rotated: WordPress passwords, the database password, hosting and SFTP, any API keys stored in the site, and the security keys and salts in wp-config.php.
11. Everything updated, including PHP if it is past end of life.
12. Google and blocklists: a review request in Search Console once every issue is fixed, and checks of other blocklists if the domain appears on them.
13. A written report: what was found, where, how it got in, what was changed, and what is still a risk.

Item 2 and item 13 are the two that cheap cleanups most often skip, and they are the two that tell you whether the work was done properly.

How fast WordPress flaws are now exploited: what we counted

WordPress flaws are being exploited within days, and sometimes hours, of a fix. We downloaded the US Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities catalog on 29 October 2026 (catalog version 2026.10.28, 1,762 entries) and pulled out every entry that mentions WordPress or WooCommerce. CISA only adds a vulnerability when it has a CVE ID, clear remediation guidance and "reliable evidence of exploitation in the wild".

What the numbers show:

• Seven entries in total, and four of them were added in 2026. The three older ones were all added on 3 November 2021, the day the catalog launched under CISA's directive BOD 22-01, so their long gaps reflect a backlog being filed, not slow attackers.
• The three WordPress core entries are all from 2026. Before July 2026 the catalog held no WordPress core flaw at all.
• For the 2026 entries, the median gap between the CVE being published in the US National Vulnerability Database and CISA confirming exploitation was 3.5 days (1, 3, 4 and 4 days).

That matches what the security vendors see in their own data. Patchstack's State of WordPress Security in 2026 report counted 11,334 new WordPress ecosystem vulnerabilities in 2025, 91% of them in plugins, and states that "the weighted median time to first exploit is 5 hours" and that "46% of vulnerabilities were not fixed in time for public disclosure".

The limits of this count matter. The catalog is a short list of vulnerabilities the US government has confirmed, not a census of attacks. Most plugin attacks never reach it. For example, BleepingComputer reported on 3 September 2026 that the Elementor Pro flaw CVE-2026-32475 was being exploited, with Wordfence blocking more than 190,000 attempts between 19 and 23 August 2026, yet that CVE was not in the catalog when we checked. Read the table as "these were certainly attacked", never as "nothing else was". Our WordPress security statistics page covers the wider numbers, and our page on the 2026 core vulnerabilities has the timeline for the three core flaws.

Method: we downloaded known_exploited_vulnerabilities.json from cisa.gov, matched entries whose vendor, product, name, description or notes contain "WordPress" or "WooCommerce" (case-insensitive), and took each CVE's publication date from the NVD API on the same day. The script and raw files are kept with our research notes.

What is the best website for free malware removal?

There is no single best free option, because "free" covers very different things: free scanners that detect malware but leave removal to you, free plugin tools that delete files you choose, and free cleanup offers from vendors that come with their own terms. A free route is reasonable for a personal site that earns nothing. For a business site, the cleanup is the cheap part of a hack and the slow part is what costs money.

Whatever route you choose, never use a "nulled" (pirated) security or premium plugin to save money. Nulled plugins are a common way malware gets onto WordPress sites in the first place.

When a restore beats a cleanup

Restoring a backup beats a cleanup when you have a backup from before the infection started, the site has changed little since, and you can still close the hole the attacker used. If any of those three is missing, a restore alone will either lose real data or put the site straight back into the attacker's hands.

Our guide to backing up WordPress covers how to keep backups that are actually usable in this situation.

How to choose a WordPress malware removal service

Choose a WordPress malware removal service by asking how it finds the root cause, what it does in the database, and what written report you get afterwards. Good providers answer those questions plainly and before you pay. Use these questions on any provider, including us.

Questions to ask

1. Do you take a full backup before changing anything?
2. How do you find out how the attacker got in, and will you tell me in writing?
3. Do you check the database, users, must-use plugins, drop-ins and cron, or only files?
4. Do you replace plugins and themes with clean copies, or edit infected ones?
5. Which credentials will you rotate, and which ones do I need to change myself?
6. Will you request the Google review, and what happens if Google finds something you missed?
7. What happens if the malware comes back within a set period, and how long is that period?
8. Is the price fixed before you start, and what would make it change?
9. What access do you need, and how will you hand it back?

Red flags

What happens after a cleanup

After a cleanup, three things still need to happen: Google needs to review the site, the site needs hardening so the same attack fails next time, and someone needs to watch it for the following weeks. Skipping the last one is how a missed backdoor turns into a second hack.

Getting Google's warning removed

Google's Search Console help is direct about timing and order. Request a review only "when all issues listed in the report are fixed in all pages", and describe your fixes in the request. Its estimate for malware, hacked content and phishing reviews is that "a review can take from a few days to a few weeks to complete". It also warns that resubmitting too early can lengthen future reviews.

Hardening

• Remove plugins and themes you do not use, and replace any that are abandoned.
• Turn on two-factor authentication for every administrator.
• Give each person their own account with the lowest role that does their job.
• Block PHP from running in wp-content/uploads.
• Move to a supported PHP version. PHP 8.2 loses security support on 31 December 2026, per our PHP end-of-life guide.
• Keep daily backups stored off the server, and test a restore.

Monitoring

Watch for file changes, new admin users, new cron events and new Search Console messages for at least several weeks. A security audit a month after the cleanup is a sensible check that nothing was missed. This is the work our maintenance plans include: security monitoring, malware scanning, hardening and tested off-site backups. Our service page lists recovering a site that was hacked before a plan starts as a separate one-off job, and we quote it as a fixed price after looking at the site.

What a malware removal does not mean

How we handle a hacked WordPress site

We start by looking, not by quoting blind. You send the address and access, we confirm what is infected and how far it goes, and you get a fixed price for the cleanup before any work starts. The work covers every item in the cleanup list above, ends with a written report, and is followed by a Google review request where one is needed. If you want the site watched afterwards, a care plan is optional; you are not required to sign up for one to get the cleanup.

If the site was built by someone who has since disappeared and you are missing logins, start by gathering the hosting, domain and DNS account details you do have. Getting hosting access is usually the first job anyway.