Website malware removal is something you can often do yourself, but not always, and knowing the difference in five minutes saves you money and heartache. Some infections are straightforward to clean with free tools and care, while others need a professional. This DIY guide gives you honest triage up front, the forensic backup step cleaners regret skipping, free scanning routes, the full cleanup process, the point where DIY stops being smart, and what fair paid help looks like.
Honest triage up front
Before you start, work out whether this is a DIY job. You can usually clean it yourself if the infection is recent, limited to obvious injected files or spam pages, and your site is a standard setup you understand, with good backups available.
You genuinely need a professional if the infection keeps returning after cleanup, if the malicious code is heavily obfuscated and you cannot tell clean from infected, if the compromise reaches the server level beyond your site, or if you are not comfortable working with files and databases.
A quick way to tell in five minutes: run a scan, look at how widespread and hidden the infection is, check whether it has already returned once before, and honestly assess your own comfort with files and databases. If it looks contained and you know your way around, proceed with the DIY steps below.
If it looks deep, persistent, or beyond your skills, plan for expert help rather than making things worse.
Before touching anything: the forensic backup
The step cleaners most regret skipping is taking a backup of the infected site before you change a thing. It feels counterintuitive to back up a hacked site, but this frozen copy is valuable.
It preserves evidence of what was changed, which helps you understand the infection and find every part of it, and it is essential if you later hand the job to a professional who needs to see the compromise. It also protects you if your cleanup accidentally breaks something, letting you compare or restore. Take this backup of files and database, label it clearly as the infected state, and store it separately from your clean backups.
Only once you have this safety net should you begin removing anything, since starting to delete files without a record can leave you unable to trace the full infection or recover from a mistake.
Free scanning routes
Several free scanning methods help you find the infection, though each has limits. Remote scanners check your site from the outside by loading its pages, which can spot malware and blacklisting visible externally, but they cannot see hidden server side code.
Plugin scanners run inside your site and can examine your files and database against known malware signatures, catching more than remote scanners, though they may miss cleverly obfuscated or brand new infections. Manual indicators are also useful: recently modified core files you did not change, unfamiliar files with odd names, unexpected admin users, and strange entries in your htaccess or database all point to compromise.
Combining these routes gives the fullest picture, since no single free scanner catches everything.
Use a remote scan and a plugin scan together, then verify with manual inspection, understanding that a clean scan result does not fully guarantee a clean site if the malware is well hidden.
The DIY cleanup process
With a backup taken and the infection identified, work through the cleanup carefully. Reinstall the core files: replace your WordPress core with fresh copies from the official source, which removes any injected core files while preserving your content in the database. Reinstall themes and plugins from source, deleting the installed versions and reinstalling clean copies from official sources, since infected theme and plugin files are common.
Inspect the uploads folder closely, because attackers often hide malicious PHP files among your images and media where they are easy to miss, so remove any executable files that do not belong there. Check the database for injected spam content, malicious options, and unfamiliar entries, cleaning them carefully, ideally with guidance if you are unsure, since database mistakes can break your site. Audit scheduled tasks and users, removing any the attacker created to maintain access.
Throughout, work methodically and heed the risk warnings: back up before each major change, and if a step feels beyond you, stop and reassess rather than pressing on. A thorough cleanup removes every trace, which is what prevents the infection returning.
How to find the infected files without guessing
The step people find hardest is not removing malicious code, it is working out which files contain it. Scanners miss things, and reading through a site by eye is not a plan. Two techniques do most of the work, and both are read only, so neither can break anything.
Sort by modification date. An attacker has to write to your server, and writing leaves a timestamp. Almost every file on a WordPress site was last modified when it was installed or updated, so files changed in the last two weeks form a short list, and on a site you have not touched recently that list should be nearly empty.
Over SSH, listing the PHP files modified in the last fourteen days gives you exactly that:
find . -name "*.php" -mtime -14 -ls
Without SSH, most file managers and FTP clients will sort a folder by date modified, which is the same idea done slowly. Look especially at the uploads folder, where no PHP file has any business existing at all, and at the site root.
Compare against the originals. WordPress core and anything from the plugin repository are published files, so you can check yours against the official copies rather than judging the code yourself. With WP-CLI:
wp core verify-checksums
wp plugin verify-checksums --all
Anything reported as modified is either something you edited deliberately or something you did not, and there are usually very few of either. This is the fastest way to find an injection hidden inside a legitimate file, which is the case that defeats a visual inspection.
One thing to do before any of this: put the site into maintenance mode or take it offline. It stops visitors being served malware while you work, stops the infection spreading further, and means the file dates you are reading are not changing under you.
Change every credential, from a computer you trust
Cleaning the files without changing the credentials means the attacker simply logs back in, and this step is missing from a surprising number of cleanup guides.
Assume everything is known to them. Anyone with file access could read your configuration file, which contains the database credentials in plain text. The full list to rotate is every WordPress administrator password, the database user, the FTP or SFTP account, SSH keys if you use them, and the hosting control panel login.
On WordPress, also replace the security keys and salts in wp-config.php, because that invalidates every active session on the site at once, including any the attacker is still holding. Change passwords without that step and you can leave them logged in.
Do this from a machine you are confident is clean. This is the part people skip and it matters more than it sounds. A common way sites get compromised is not a site vulnerability at all, it is malware on the owner’s or developer’s own computer stealing saved FTP credentials from their client.
If that is what happened, changing your passwords on the infected machine hands the new ones straight over, and you will be cleaning the same site again next month. If you have had repeated reinfections with no explanation, run a proper antivirus scan on every computer that has ever had access before you rotate anything.
Google is not the only list you are on
Most guides end at requesting a review in Search Console. That clears the warning in Google’s results, and it is the one that matters most for traffic, but it is not the only place your domain has been recorded.
Browsers and desktop security products maintain their own reputation lists, and they update on their own schedules from their own data. A site can be clean in Google’s eyes while a visitor’s antivirus is still blocking it, or while a link to it is still stripped in a corporate email filter. Each of those maintains a review or removal request process of its own, and none of them is triggered by Google clearing you.
The practical version of this is short. After Google confirms the site is clean, check your domain against the major reputation checkers, and file a review with any service still flagging you. It is a handful of forms rather than a project, and it is worth doing, because the traffic that stays blocked after a Google recovery is invisible in Search Console and easy to keep missing for months.
When DIY stops being smart
Be honest about the point where continuing yourself does more harm than good. If the infection keeps coming back despite thorough cleanup, there is a hidden backdoor or a deeper compromise you have not found, and an expert is better equipped to trace it.
If the malicious code is heavily obfuscated, disguised so you cannot distinguish it from legitimate code, you risk either missing it or deleting something you need. If the compromise is at the server level, affecting more than your site, it is beyond what site cleanup can fix. And if you simply are not confident working with server files and databases, the risk of breaking your site outweighs the saving.
In these cases, stopping and bringing in a professional is the smart move, not a failure. The goal is a genuinely clean, working site, and recognizing when the problem exceeds your tools protects both your site and your time.
After cleanup: hardening and Google recovery
Removing the malware is only half the job, since you must also close the entry point and recover with Google. Harden the site immediately: update everything, replace all credentials with strong unique ones, add two factor authentication, and fix file permissions, because reinfection through the same hole is the most common reason cleanups fail.
Then handle the Google side, requesting a security review in Search Console if your site was flagged, and monitoring closely for any return. The full ranking recovery process is covered in our guide on SEO recovery after a hack, and ongoing protection is in our WordPress security settings guide. Cleanup plus hardening plus Google recovery together are what turn a malware incident into a solved problem rather than a recurring one.
Paid cleanup services
If you decide to pay for cleanup, know what fair looks like so you are not overcharged or misled. Reasonable services offer a clear scope, a fair fixed or transparent price, cleanup plus hardening to prevent reinfection, and help with the Google review if needed.
Red flags include vague pricing that balloons, pressure and scare tactics, no mention of closing the entry point, and guarantees that sound too good. A fair service explains what it will do, secures the site as well as cleaning it, and does not exploit your panic. Compare a couple of reputable providers, ask what their cleanup includes and whether they harden the site afterward, and be wary of the cheapest or the most alarmist.
Paying for cleanup is reasonable when the job is beyond you, as long as you choose a service that genuinely fixes and secures your site rather than just removing the obvious spam and leaving the door open. The cheapest cleanup that ignores the entry point is no bargain, since you will be paying again when the infection returns, so value a service that closes the hole over one that only wipes the symptoms.
Frequently asked questions
Can I remove website malware myself?
Yes, you can often remove website malware yourself if the infection is recent and contained, you have backups, and you are comfortable with files and databases. The process involves reinstalling core, theme, and plugin files from clean sources, inspecting the uploads folder and database, and closing the entry point. However, if the infection keeps returning, is heavily obfuscated, or reaches the server level, professional help is the safer choice.
How much does malware removal cost?
Professional malware removal costs vary by the severity of the infection and the provider, from a modest one time fee for a straightforward cleanup to more for complex or recurring cases. Fair services offer transparent pricing and include hardening to prevent reinfection. Doing it yourself costs only your time. Be wary of vague pricing that balloons or scare tactics, and compare a couple of reputable providers before paying.
Why does malware keep coming back?
Malware keeps coming back when the cleanup removed the visible infection but never found and closed the entry point the attacker used, such as an outdated plugin, weak credentials, or a hidden backdoor. Reinfection through the same hole is the most common cleanup failure. To stop it returning, you must update everything, replace all credentials, remove every backdoor, and monitor closely, since cleaning without securing simply invites the attacker straight back in.
Do free scanners actually work?
Free scanners do work for finding known and visible malware, and they are a valuable first step, but they have limits. Remote scanners cannot see hidden server side code, and plugin scanners may miss cleverly obfuscated or brand new infections. So a clean free scan does not fully guarantee a clean site. Use free scanners alongside manual inspection for the fullest picture, and treat a suspicious result as reason to investigate further.
Will reinstalling WordPress remove malware?
Reinstalling WordPress core files removes malware injected into those core files, but it does not clean infected themes, plugins, the uploads folder, or the database, where malware often hides. So reinstalling core is an important step but not a complete fix on its own. A full cleanup also reinstalls themes and plugins from source, inspects uploads and the database, and closes the entry point, since malware left in those places will otherwise survive a core reinstall.
How do I find which files are infected?
Sort by modification date and compare against the originals. Attackers have to write to your server, so files changed in the last couple of weeks form a short list, and on a site you have not touched it should be nearly empty. Over SSH, a find command listing PHP files modified in the last fourteen days gives you that list.
Then run wp core verify-checksums and wp plugin verify-checksums –all to compare your files against the official published copies, which finds injections hidden inside otherwise legitimate files.
Do I need to change passwords after removing malware?
Yes, all of them, because anyone with file access could read the database credentials in plain text from your configuration file. Rotate every administrator password, the database user, the FTP or SFTP account, any SSH keys and the hosting control panel. On WordPress also replace the security keys and salts in wp-config.php, which logs out every active session including the attacker.
Do it from a computer you know is clean, since malware stealing saved FTP credentials from a developer own machine is a common cause of repeat infections.
Is requesting a Google review enough to clear malware warnings?
No. It clears the warning in Google results, which matters most for traffic, but browsers and desktop security products keep their own reputation lists that update independently. A site can be clean to Google while a visitor antivirus still blocks it. Check your domain against the major reputation checkers after Google clears you and file a removal request with any service still flagging it.