Can I remove WordPress malware without a plugin?

Yes, but manual cleanup needs hosting or SSH access, a known-clean copy of WordPress, database access and enough knowledge to distinguish malware from custom code. You can use external scanners and WP-CLI checksums, then replace core, plugin and theme files manually. The difficult parts are database infections, hidden backdoors and reinfection, so a plugin or professional service is safer for complex cases.

Does deleting the file flagged by a scanner remove the infection?

No, deleting one flagged file may leave the entry point or another backdoor in place. Malware can also be stored in database content, hidden among legitimate plugin files or restored by a compromised account. Preserve the file, investigate the finding, check users and database content, rotate credentials, replace compromised software and rescan before declaring the site clean.

Why does malware come back after I clean WordPress?

Malware usually returns because something that can recreate it remains active. Common causes include an overlooked backdoor, an infected database, stolen credentials, an outdated plugin or another compromised site in the same hosting account. Scan all sites in the account, clean the database, update or replace vulnerable software, rotate credentials and ask the host to check server logs and neighbouring accounts.

Will a WordPress checksum warning always mean malware?

No. A checksum warning means a file differs from the reference version or that no reference checksum was available. Custom code and premium plugins commonly lack WordPress.org checksums, while an unexpected file in a core directory deserves investigation. Compare the file with the official package and your deployment records before replacing or deleting it.

When should I restore a backup instead of cleaning the site?

Restore a backup when you have a trustworthy copy from before the compromise and can also fix the vulnerability that allowed the attack. Otherwise, restoration may bring the malware straight back. Keep the infected copy for evidence, restore files and database together where possible, update every component, rotate credentials and scan the restored site before putting it online.

How to scan and remove malware from WordPress sites

Security Time About 45 minutes for a simple infection; several hours for a persistent compromise 7 steps Updated 5 Sep 2026

The short answer

You can scan WordPress with a security plugin, WP-CLI checksums and an external scanner, but removing malware safely often needs hosting or file access. Back up the infected state first, clean files and database content, rotate every credential, then scan again before requesting a review.

The route

01Contain and preserve the site
02Run layered malware scans
03Review findings before deleting
04Replace compromised software
05Clean access and database content
06Rescan and harden the site
07Use the fast route for multiple sites

What you need

WordPress administrator or hosting access
A recent backup or enough storage to create an incident copy
SFTP, hosting file-manager or SSH access for manual cleanup
A separate computer with an up-to-date malware scan

Contain and preserve the site

Record what you saw, when it started and any recent plugin, theme or hosting changes. If possible, put the site into maintenance mode or temporarily restrict access while you work. Tell your host, especially on shared hosting, because the compromise may affect other sites in the account.

Create a copy of the database and all files before deleting anything. Keep this copy separate from the clean site; it may contain useful evidence, but do not restore it blindly. WordPress recommends treating the database and files as one backup set.

Run layered malware scans

Use an application-level security scanner, an external website scanner and, if you have SSH, WP-CLI checksums. A scanner can find known signatures, suspicious changes and some backdoors, but no single scan proves that a site is clean. Scan the computer you use to administer the site as well, because stolen FTP or WordPress credentials can cause reinfection.

From the WordPress directory, wp core verify-checksums checks core files. You can also run wp core verify-checksums --include-root --version=$(wp core version) and wp plugin verify-checksums --all --strict. A checksum warning is not automatically malware: custom or premium plugins may not have WordPress.org checksums.

Review findings before deleting

Do not delete every flagged file on sight. Compare each finding with the scanner explanation, the original plugin or theme package and your backup. Legitimate custom code, cache files and modified templates can trigger warnings, while a new file or a small change inside an otherwise normal PHP file can be a backdoor. Save a copy of anything you remove.

Pay particular attention to unexpected files in core directories, altered .htaccess, wp-config.php, theme entry files, plugin files and executable files in uploads. Repeatedly recreated files usually mean that another backdoor, scheduled task, stolen account or database payload is still active.

Replace compromised software

For WordPress core, replace the files with a clean copy of the same version or reinstall the current version after confirming compatibility. Replacing clean core directories is safer than editing infected core files by hand. Remove unused plugins and themes, then download active ones again from their original developer or WordPress.org source rather than keeping suspicious copies.

Do not overwrite the whole site with an old backup unless you know it predates the compromise. If the infection keeps returning after visible files are removed, stop and involve your host or a professional cleaner; the persistence may be in the database or another site on the account.

Clean access and database content

Remove unknown administrator accounts and review recent users, posts, redirects, options and other content you did not create. File-only scans can miss malicious code stored in the database, including injected settings or post content. Do not run broad search-and-replace commands against the database without a backup, because serialized data and legitimate content can be damaged.

Change WordPress, hosting, SFTP, database, email, API and payment-service credentials from a clean computer. Regenerate the WordPress authentication keys and salts, then update the database password in wp-config.php if you changed it. This logs out existing sessions and closes credentials that may already be exposed.

Rescan and harden the site

Run the layered scans again, check the site in a private browser window and inspect redirects, search results, forms, admin users and outbound email. If Google or another browser has warned visitors, request a review only after the site stays clean; a clean-looking homepage is not enough.

Update WordPress, plugins, themes and server software, delete anything unused, disable dashboard file editing with DISALLOW_FILE_EDIT, use least-privilege accounts and keep independent backups. Set up file-change monitoring and scheduled scans so a Friday-night reinfection is noticed before it becomes a larger incident.

Use the fast route for multiple sites

If you manage several WordPress sites through MainWP, MainWP - Virusdie is the faster route than repeating the manual process site by site. It is designed for centralised scheduled scanning, real-time monitoring, security reports and automatic malware removal from the MainWP dashboard.

Use automatic removal as a starting point, not as a substitute for checking the entry point, unknown users, database content and credentials. Keep a backup before remediation and confirm each site with a second scan after the tool reports that it is clean.

The fast route

Let MainWP do it

Centralized scheduled scanning and automatic malware removal for multiple WordPress sites managed through MainWP.

Get MainWP

Sources

wordpress.org /documentation/article/faq-my-site-was-hacked/?utm_source=op…
developer.wordpress.org /advanced-administration/security/hardening/?utm_source=open…
wordfence.com /learn/finding-removing-backdoors/?utm_source=openai
developer.wordpress.org /cli/commands/plugin/verify-checksums/?utm_source=openai
developer.wordpress.org /advanced-administration/security/backup/?utm_source=openai

Questions

Can I remove WordPress malware without a plugin?: Yes, but manual cleanup needs hosting or SSH access, a known-clean copy of WordPress, database access and enough knowledge to distinguish malware from custom code. You can use external scanners and WP-CLI checksums, then replace core, plugin and theme files manually. The difficult parts are database infections, hidden backdoors and reinfection, so a plugin or professional service is safer for complex cases.
Does deleting the file flagged by a scanner remove the infection?: No, deleting one flagged file may leave the entry point or another backdoor in place. Malware can also be stored in database content, hidden among legitimate plugin files or restored by a compromised account. Preserve the file, investigate the finding, check users and database content, rotate credentials, replace compromised software and rescan before declaring the site clean.
Why does malware come back after I clean WordPress?: Malware usually returns because something that can recreate it remains active. Common causes include an overlooked backdoor, an infected database, stolen credentials, an outdated plugin or another compromised site in the same hosting account. Scan all sites in the account, clean the database, update or replace vulnerable software, rotate credentials and ask the host to check server logs and neighbouring accounts.
Will a WordPress checksum warning always mean malware?: No. A checksum warning means a file differs from the reference version or that no reference checksum was available. Custom code and premium plugins commonly lack WordPress.org checksums, while an unexpected file in a core directory deserves investigation. Compare the file with the official package and your deployment records before replacing or deleting it.
When should I restore a backup instead of cleaning the site?: Restore a backup when you have a trustworthy copy from before the compromise and can also fix the vulnerability that allowed the attack. Otherwise, restoration may bring the malware straight back. Keep the infected copy for evidence, restore files and database together where possible, update every component, rotate credentials and scan the restored site before putting it online.