Why WordPress Malware Keeps Coming Back After Cleaning

Short answer: malware returns when a cleanup removed the symptom but left either the persistence mechanism or the way in. It can also arrive again from a second infected site on the same hosting account.

The five usual survivors — and how to check each

1. A backdoor elsewhere than the detected file. Run grep -RIlE 'eval\s*\(|base64_decode\s*\(|gzinflate\s*\(|str_rot13\s*\(|assert\s*\(|create_function\s*\(' wp-content/ across the whole install, uploads included.
2. A valid credential still in the attacker’s hands. Rotate WordPress, database, SFTP and hosting passwords and invalidate sessions.
3. A vulnerable component never updated. Compare installed versions against known vulnerabilities and update or replace.
4. A cron task that rewrites files. Inspect wp cron event list for unfamiliar hooks.
5. Cross-contamination from another install in the account. Scan every site under the same hosting user.

Distinguish cache from real reinfection

A cached page can keep serving an old malicious response with no new infection. Before concluding it returned, record file hashes and modification times: new or freshly modified files mean genuine reinfection; identical files behind a stale cache mean a caching problem. Purge every cache layer and re-check.

What a complete cleanup includes

Comparison against clean core/plugin/theme sources, review of non-standard files in writable directories, a database audit (options, posts, users, cron), server-config review, credential rotation, and checks across neighbouring sites. The most useful question is not “is it clean?” but “what was the entry vector, what persistence was removed, and what will be monitored?”.

Monitor after the fact

Watch file integrity, user accounts and search results for at least a few weeks. Reinfection usually returns quietly, and the earlier it is caught the smaller the second cleanup.