How to Find and Remove WordPress Malware and Spam Injections

Spotting and removing WordPress malware requires identifying where malicious code or SEO spam is hiding—typically in core files, theme functions, active plugins, or the database—and systematically cleaning or replacing those components. The safest process involves putting your site in maintenance mode, taking a full offsite backup, replacing core and plugin files from clean sources, and scrubbing database spam signatures or backdoors. If your site is redirecting visitors or flagged by Google Search Console, taking prompt, structured action prevents long-term SEO damage and domain blacklisting.

What You Are Seeing: Common Symptoms of WordPress Malware

WordPress malware rarely announces itself with a giant banner. Modern automated hacks are designed to stay hidden from site owners as long as possible while monetizing your server resources or search engine authority. If you suspect your site has been compromised, you will typically observe one or more of these distinct symptoms:

• Malicious Mobile or Conditional Redirects: First-time mobile visitors or traffic coming from search engines get redirected to scam landing pages, fake tech support, or online casinos, while logged-in site admins see a completely normal website.
• SEO Spam Injections (The "Japanese Keyword Hack"): Searching Google using site:yourdomain.com reveals thousands of indexed pages containing foreign characters, pharmacy products, or counterfeit goods that do not exist on your real site.
• Unexplained Admin Accounts: New administrator-level user accounts appear in your WordPress dashboard with generic names or disposable email addresses.
• Google Search Console Security Warnings: Google flags your domain with a "This site may be hacked" warning or issues a formal Security Issues manual action notification.
• Hosting Suspensions or Server Load Spikes: Your web host sends an abuse notification or temporarily suspends your account due to outbound spam emails, high CPU usage, or rogue port scanning originating from your account.

Where Malware and Spam Hide in WordPress

To clean a hacked site effectively, you must understand where attackers hide their code. A partial cleanup is one of the leading causes of re-infection because leaving a single backdoor behind allows automated bots to re-inject malicious scripts within hours.

Step-by-Step: How to Safely Clean WordPress Malware

Before executing any cleanup commands, put your site in maintenance mode and download a complete copy of your current site files and database. Even a compromised backup is critical as a safety net in case a file replacement accidentally breaks custom functionality.

Step 1: Replace WordPress Core Files

Never attempt to manually line-edit corrupted WordPress core files. The safest and fastest route is to replace the entire core directory structure with clean files fresh from WordPress.org.

1. Download the official ZIP archive for your exact WordPress version from WordPress.org.
2. Extract the archive on your local computer.
3. Connect to your server via SFTP or SSH.
4. Delete your existing wp-admin and wp-includes directories on the server.
5. Upload the fresh wp-admin and wp-includes folders from the official download.
6. In your site's root directory, overwrite files such as index.php, wp-settings.php, wp-compiler.php (if present as malware), and wp-blog-header.php with clean versions. Do not overwrite your custom wp-config.php file or your wp-content directory.

Step 2: Clean Plugin and Theme Files

Malware often targets themes and plugins because they contain customizable code. If you are using premium themes or plugins, ensure you have clean installer archives ready from the original developers.

1. Make a list of all installed plugins on your site.
2. Delete the contents of your wp-content/plugins/ directory on the server.
3. Re-download fresh, untouched copies of each plugin directly from the official WordPress plugin repository or legitimate commercial vendor dashboards, then re-upload them to your server.
4. For active themes, download a fresh copy from the vendor and replace the existing theme folder in wp-content/themes/. If you have custom code in a child theme, manually review every PHP file for obfuscated strings like eval(base64_decode(...)) or unusual gzuncompress() functions before restoring it.

Note: If you previously downloaded paid plugins or themes from unauthorized "nulled" sites, remove them immediately. Learn more about why this happens in our guide on why fake or nulled WordPress plugins are a security disaster.

Step 3: Inspect the Uploads Directory for Hidden Backdoors

The wp-content/uploads/ folder should contain image, document, and media files—never executable PHP scripts. Attackers frequently drop hidden PHP files into upload directories to serve as backdoor entrances.

You can search your uploads folder for rogue PHP files using SSH with the following command:

find wp-content/uploads/ -type f -name "*.php"

If this command returns any results, inspect those files. Unless a highly specific plugin explicitly requires a PHP script in uploads (which is rare), these files are almost certainly backdoors and should be deleted immediately.

Step 4: Audit and Clean the Database

Malware injections often store spam links or malicious auto-loading scripts inside your database tables, particularly in wp_options and wp_posts.

• Check Rogue Admin Users: Open phpMyAdmin or use WP-CLI to view all users with administrator privileges. Delete any unknown users immediately.
• Inspect Auto-Loading Options: Examine the wp_options table for option names containing unexpected JavaScript code, foreign character strings, or encoded payloads inside siteurl, home, or custom plugin options.
• Search for Injected Scripts in Posts: Query your wp_posts table for common script tags or iframe injections inserted by spam bots:

SELECT * FROM wp_posts WHERE post_content LIKE '%<script%' OR post_content LIKE '%<iframe%';

Carefully review the matching entries and remove any unauthorized JavaScript or hidden link payloads from your post content.

Step 5: Replace Security Keys and Reset Credentials

Once the files and database are clean, invalidate all existing browser sessions and database connection paths to prevent compromised access tokens from being reused.

1. Change your database user password in your hosting control panel and update the corresponding DB_PASSWORD definition in wp-config.php.
2. Generate new secret salt keys using the official WordPress Salt Generator and replace the salt definitions in your wp-config.php file. This immediately logs out all active users across the site.
3. Reset passwords for all legitimate WordPress administrator accounts, SFTP users, and control panel accounts using strong, unique passphrases.

How to Prevent Malware Injections from Returning

Cleaning malware is only half the battle; hardening your environment ensures automated scanners cannot find another way in.

• Disable In-Dashboard File Editing: Add define('DISALLOW_FILE_EDIT', true); to your wp-config.php file. This prevents logged-in users or compromised admin accounts from modifying theme or plugin PHP code directly through the WordPress dashboard.
• Set Strict File Permissions: Ensure directory permissions are set to 755 (or 750) and file permissions are set to 644 (or 640). Your wp-config.php file should be set to 600 or 640.
• Maintain a Consistent Update Routine: Vulnerable plugins and outdated core files cause over 80% of WordPress compromises. For detailed prevention tips, read our article on how WordPress sites get hacked and how to prevent it.

When to Call a Professional

Removing complex malware can quickly become overwhelming, especially when dealing with persistent backdoors that survive file replacements, deeply nested database injections, or strict Google blacklist warnings threatening your revenue.

If you are seeing persistent re-infections, your host has suspended your account, or you simply cannot afford the downtime of an trial-and-error cleanup, bringing in dedicated engineers is the fastest way to recover safely.

At Mend, our senior WordPress engineers handle full malware cleanups, backdoor extermination, and database sanitization on a safe, backup-first workflow. If your site is compromised, submit a request through our Hacked Site Cleanup Guide or get immediate help with our Emergency Rescue Service. We will fix your site fast with a flat rate, plain-English root-cause report, and a money-back guarantee.