WordPress malware cleanup: evidence before deletion

When a WordPress site gets hacked, the fastest-looking action is often the most dangerous one: deleting files before understanding what happened. A cleanup should protect the real business data first, then remove the infection.

Evidence before deletion

Malware can hide in uploads, fake plugins, modified theme files, cron jobs, database options, spam posts, form submissions or injected JavaScript. Some suspicious functions are also used by legitimate plugins. That is why I separate confirmed malware from suspicious code before deleting anything.

The workflow I use

1. Isolate the site and stop public damage where possible.
2. Snapshot files and database before cleanup.
3. Verify core with checksums.
4. Scan plugins, themes, mu-plugins and uploads.
5. Inspect database for spam links, redirects, injected scripts and fake users.
6. Confirm malware vs false positives.
7. Clean safely by replacing, removing or repairing only confirmed items.
8. Harden and monitor with WAF, 2FA, update discipline and logs.

No cleanup can guarantee a site will never be attacked again. A serious cleanup reduces risk, preserves legitimate data and gives the owner a clear recovery path.