Do Not Start With Delete
Start by preserving evidence. Capture URLs, filenames, timestamps, user changes, redirects, and log snippets before removing files. Cleanup without evidence can hide the entry point.
Problem
WordPress Malware Scan Checklist
Review suspicious WordPress files, redirects, users, public exposure, and backup readiness before deleting anything from a live site.
Problem, cause, fix, verify
Problem
A malware concern needs evidence-first review because rushed cleanup can delete proof, miss persistence, or break legitimate plugin and theme files.
Audience
WordPress owners, agencies, and administrators handling a suspected malware incident.
First check
Start by preserving evidence. Capture URLs, filenames, timestamps, user changes, redirects, and log snippets before removing files. Cleanup without evidence can hide the entry point.
Verify
WPlura Security Center and SiteCheck can help organize public exposure and WordPress-side review evidence, while backup tooling supports recovery decisions. They are review aids, not a substitute for professional incident response when compromise is confirmed.
Editorial trust
- Publisher
- WPlura Editorial Team
- Published
- Updated
- Content type
- Problems
On this page
Symptom
A malware concern needs evidence-first review because rushed cleanup can delete proof, miss persistence, or break legitimate plugin and theme files.
For: WordPress owners, agencies, and administrators handling a suspected malware incident.
Diagnosis
What to check before changing the site
Separate False Positives
A changed file is not automatically malware. Plugin updates, cache rebuilds, deployment tools, and custom code can create noise. Compare ownership before labeling a file malicious.
Check Public Exposure
Look for exposed backups, installer files, debug logs, database dumps, and executable uploads. Publicly reachable artifacts can reveal how the site was changed or leak additional sensitive data.
Close The Entry Point
Replace untrusted files, update vulnerable components, remove unauthorized access, rotate credentials, and confirm the vulnerable route is closed. A clean file tree is temporary if the door remains open.
WPlura Fit
WPlura Security Center and SiteCheck can help organize public exposure and WordPress-side review evidence, while backup tooling supports recovery decisions. They are review aids, not a substitute for professional incident response when compromise is confirmed.
WordPress SecuritySeverity: HighLast reviewed: 2026-09-16
Diagnosis
Symptoms, causes, checks, and fixes
Symptoms
- Visitors see redirects, injected links, unfamiliar popups, spam pages, or browser/security warnings.
- File-change notices, unknown PHP files, or modified plugin/theme files appear outside normal update windows.
- Search results, server logs, or customer reports mention pages the owner did not create.
Most Common Causes
- Compromise can start with weak credentials, vulnerable plugins, exposed backups, unsafe uploads, or abandoned administrator access.
- Malicious files may sit beside legitimate cache, backup, or plugin files, so filename alone is not enough.
- Restoring too early can reintroduce the same entry point if the cause is not understood.
How To Confirm The Cause
- Record affected URLs, redirect chains, changed files, unknown users, recent updates, plugin versions, and server log timestamps.
- Group findings by ownership: core, plugins, themes, uploads, wp-config.php, public archives, database content, and administrator accounts.
- Compare suspicious files against clean plugin/theme packages or the responsible developer's expected custom code.
Fixes
- Quarantine confirmed suspicious files and preserve notes before deletion.
- Replace modified core/plugin/theme files from trusted sources and patch the entry point.
- Rotate credentials, invalidate sessions, review administrators, and confirm backup restore points before any destructive recovery.
How To Verify The Fix
- Retest the affected URLs, search snippets, redirects, public archive paths, and login activity after cleanup.
- Confirm no new suspicious files or administrators reappear during the monitoring window.
- Document the entry point, files changed, credentials rotated, backup status, and follow-up owner.
When To Contact Support
Escalate when customer data, payment workflows, search warnings, server-level compromise, unknown persistence, or legal/privacy duties may be involved.
References