Reliable malware removal is not deleting the first file a scanner flags. It is understanding what was changed, what persistence the attacker left, and which vulnerability or credential let them in. Clean only the effect and it returns within days.
Step 1 — Preserve evidence before you touch it
Take a full backup of the infected site — files and database — and label it clearly. It is not a clean restore point; it is the evidence that tells you the entry point and the timeline. If the host is about to suspend the account, this snapshot may be your only record.
Step 2 — Find the injected and modified files
Compare your core, plugin and theme files against known-good copies. The fastest way is to reinstall WordPress core over itself and reinstall plugins from clean sources, then look at what remains. When searching manually over SFTP, the tell-tale signs are functions used to hide code: eval(, base64_decode(, gzinflate(, str_rot13( and preg_replace with the /e modifier. Pay special attention to .php files inside /wp-content/uploads — nothing legitimate executes PHP there.
Is your website affected right now?
Send the URL and the symptom you can see. Jordi Ensenyat reviews the case personally and defines the scope and quote before anything is changed. This form never asks for passwords.
Step 3 — Clean the database, not just files
File-only cleanups miss a lot. Check wp_options for injected values in siteurl, home and any autoloaded option carrying script; review wp_posts for spam content; and audit wp_users for accounts you did not create. Malicious scheduled tasks hide in the cron array — a task that rewrites files after each cleanup is the classic reinfection mechanism.
Step 4 — Close the entry point
Removal without closing the door is temporary. Identify the vulnerable plugin, theme or outdated core that allowed access and update or replace it. Then rotate every credential that could have been exposed — WordPress admins, database, SFTP/FTP, and hosting — and invalidate active sessions so a stolen cookie stops working.
Step 5 — Check the neighbours
On shared hosting, one infected WordPress install can reinfect the others in the same account. Scan every site under the account, not just the one you noticed.
What cannot be promised
No responsible provider guarantees a site can never be compromised again. The realistic outcome is a clean, usable site with the evidenced entry point closed, credentials rotated, and a record of what was found and what to monitor. If the site is a store, the log points at core corruption, or the malware keeps returning after cleanups, that is the point to bring in a specialist — send the URL and the symptoms and it can be assessed without credentials.
EVIDENCE-LED WORDPRESS RECOVERY
Malware cleanup that addresses persistence, not only symptoms
A hacked site can look normal while backdoors, scheduled tasks or database payloads keep access open. Cleanup therefore covers the WordPress files, database, users and server-level persistence relevant to the incident, followed by checks that the malicious behaviour no longer reproduces.
What we verify
- Unexpected administrators, modified core files and executable uploads
- Injected database content, JavaScript, redirects and SEO spam
- Backdoors, cron jobs, server rules and stolen access paths
- Public pages, search results, security warnings and host feedback after cleanup
What a verified outcome means
The goal is a clean, usable site with compromised access rotated and the likely entry point closed where evidence allows. You receive a record of what was found, what changed and what still needs monitoring.
BEFORE THE ASSESSMENT
Common questions about this WordPress incident
Does malware removal include the WordPress database?+
Yes. File-only cleanup can miss injected options, posts, users or scheduled payloads, so relevant database areas are reviewed as well.
Can you guarantee that a hacked site will never be compromised again?+
No responsible provider can guarantee that. The work removes identified malware, closes evidenced entry points and documents remaining risks and monitoring needs.
Should I restore the oldest available backup?+
Not automatically. A backup may already be infected or may lose valuable data. Its date, integrity and business impact should be assessed first.