Removing visible spam pages or a single malicious file rarely ends a WordPress compromise. Attackers commonly leave several footholds: a hidden administrator, a modified plugin, a scheduled task that re-creates files, or a database entry that injects code into every page. A structured WordPress malware cleanup works through each layer in order, then closes the original entry point and hardens the site. This checklist explains what a thorough cleanup covers so you can plan the work, brief a provider, or check what has been done.
What It Is
Malware cleanup is the process of identifying and removing malicious code, unauthorised access, and persistence mechanisms from a WordPress installation and its hosting environment, then restoring normal, trustworthy operation. It touches four areas: the file system (core, themes, plugins, uploads, and configuration files), the database (options, posts, users, and any custom tables), the hosting account (FTP/SFTP users, cron jobs, other sites on the same account), and external services (DNS, CDN, email, and search engine listings). The work is only complete when the way in has been identified as far as the available evidence allows and closed, otherwise reinfection is likely.
Who It Is For
This checklist is useful for:
- Site owners who need to understand what a proper cleanup involves before commissioning one
- Agencies who maintain client sites and want a consistent cleanup standard
- Teams whose site was "cleaned" before but became infected again
- Managers who need to verify that a provider's report covers all relevant layers
What It Helps Clarify
Working through the checklist helps clarify:
- Which parts of the installation can be replaced with known-good copies and which need manual review
- Whether persistence mechanisms such as hidden users or scheduled tasks have been removed
- What the likely entry point was and whether it has been closed
- Which hardening steps should follow to reduce the chance of a repeat
What's Included
- Preparation: take a full backup of the current state, keep earlier backups untouched, and note the date and time
- Core files: replace WordPress core with a fresh copy of the same version from the official source, then update to the current release once the site is stable
- Plugins and themes: reinstall from trusted sources; remove anything unused, abandoned, or obtained from unofficial sources
- Uploads folder: look for executable files where only media should exist
- Configuration: review wp-config.php and server configuration files such as .htaccess for injected rules or redirects
- Database: search options, posts, and widgets for injected scripts or unfamiliar URLs
- Users: review every administrator and editor; remove unknown accounts and reset remaining passwords
- Scheduled tasks: check WordPress cron events and hosting cron jobs for anything unfamiliar
- Credentials: rotate hosting, database, SFTP, and API keys, and regenerate WordPress security salts
- Entry point: update or remove the vulnerable component, fix weak access, and correct file permissions
- Verification: rescan, check pages as both logged-in and anonymous visitors, and request review of any search or browser warnings
- Hardening: enable MFA for admins, limit admin access, schedule updates, and set up monitoring of file changes
What's Not Included
- Command-level malware-removal instructions for untrained staff working on a live site
- A claim that a scan showing no results means the site is clean
- Legal determinations about breach notification or liability
- Ongoing monitoring after cleanup, unless separately agreed
When to Choose It
Use this checklist after the initial containment steps, once you have a backup of the current state and control of the key accounts. It is also useful as an acceptance checklist when a provider reports that a cleanup is finished: ask which items were covered and what was found. If customer personal data, payment data, or logins may have been exposed, involve whoever owns privacy and legal obligations. This article is general information and not legal advice.
Our Approach
Work from the outside in and from known-good to unknown. Replace what can be replaced with clean copies, then spend review time on what is unique to your site: custom themes, uploads, and database content. Record each change, because the record helps explain the incident to stakeholders and supports later decisions. Do not reconnect the site to normal traffic until verification is complete, and plan hardening as part of the job rather than an afterthought. Our Incident Recovery service covers containment, cleanup of malicious code, backdoors and unauthorised users, secure restoration, and closure of the identified entry point, with a written report and hardening recommendations. When the immediate issue is resolved, a separately scoped website hardening engagement can address wider configuration, update discipline, and access controls. Keep the cleanup report with your site documentation; it will be useful if anything similar appears again.
Frequently Asked Questions
Related Articles
Get Started
Need a cleanup that covers every layer?
Tell us what you observed, what has been changed so far, and who controls hosting and the domain. We will confirm a written cleanup scope.
Request a written scope