How to Check cPanel Logs for WordPress Malware
If you manage a WordPress site, cPanel logs can reveal the first signs of infection long before visible damage appears.
Knowing how to check cPanel logs for WordPress malware helps you trace suspicious requests, identify compromised files, and understand how an attacker moved through your site.
The key is to look at the right logs in the right order: access logs, error logs, raw referrers, and authentication records.
Each one tells a different part of the story, and together they can expose malicious behavior that WordPress plugins or scanners may miss.
Which cPanel Logs Matter Most?
cPanel provides several log sources that are useful during a WordPress malware investigation.
The most important ones usually live in your hosting account’s Metrics or Raw Access sections, plus server-side error logs tied to your domain or application directory.
- Access logs: Show every request to your site, including IP address, URL, timestamp, status code, user agent, and referrer.
- Error logs: Record PHP warnings, fatal errors, and script-level issues that often appear after malicious code is injected.
- Raw access logs: Give you downloadable historical records for deeper analysis and offline review.
- Login-related logs: Depending on your host, these may include cPanel, FTP, SSH, or email access records.
For WordPress malware detection, the access log is usually the most revealing because it shows repeated hits to suspicious endpoints, unusual POST requests, and probing for vulnerable plugins.
How to Check cPanel Logs for WordPress Malware?
Start by opening cPanel and locating the log tools provided by your host.
The exact menu names vary, but most accounts include Metrics, Raw Access, Errors, or Awstats reports.
1. Open the access logs for your WordPress domain
Find the domain-specific access log and review requests during the period when symptoms began.
Look for patterns such as repeated visits to the same URL, especially admin pages, XML-RPC endpoints, or plugin paths.
Common WordPress paths to inspect include:
/wp-login.php/wp-admin//wp-admin/admin-ajax.php/xmlrpc.php/wp-content/plugins//wp-content/uploads/
Malware activity often appears as a burst of requests from one IP address or a small range of IPs, especially if the attacker is brute-forcing login credentials or testing vulnerable plugins.
2. Sort by timestamp and look for sudden spikes
Check the timeline of requests around the time your site slowed down, redirected visitors, sent spam, or started generating strange file changes.
Malware infections often correlate with a spike in requests, failed logins, or POST submissions to unfamiliar URLs.
Pay special attention to:
- Traffic spikes at odd hours
- Many requests from the same country or ASN
- Short bursts of 404, 403, or 500 errors
- Requests that target files you did not create
If a plugin file begins receiving unusual direct hits, that may indicate exploitation or malicious scanning.
3. Inspect suspicious referrers and user agents
Referrer and user agent data can help distinguish bots from normal users.
Malicious campaigns frequently use generic, spoofed, or empty user agents, while referrers may show spam domains or unrelated pages.
Examples of suspicious indicators include:
curl,wget, or scripted user agents- Empty or obviously fake browser strings
- Referrers from gambling, adult, or unrelated SEO spam domains
- Repeated hits from automated scanning tools
These clues do not confirm malware on their own, but they can identify the source of intrusion attempts and help you narrow the investigation.
What Log Patterns Suggest WordPress Malware?
WordPress malware does not always announce itself directly.
Instead, it leaves a pattern of abnormal requests, file access, and errors that point to compromise.
Repeated POST requests to login or admin endpoints
Frequent POST requests to wp-login.php or xmlrpc.php can indicate brute-force attacks or credential stuffing.
If those requests come from a large number of IP addresses or the same IP at high frequency, the site may be under attack.
Requests to unfamiliar PHP files in uploads
WordPress should not normally execute PHP files from /wp-content/uploads/.
If your logs show requests to PHP files inside uploads, that is a strong red flag because attackers often place web shells or backdoors there.
Unexpected admin-ajax or plugin calls
Many infections abuse plugin endpoints or AJAX handlers to execute unauthorized actions.
If an endpoint is being hit repeatedly without a valid user session, check whether the plugin is outdated, abandoned, or already compromised.
404s followed by successful hits
A sequence of failed requests followed by a successful request to the same area can reveal reconnaissance and exploitation attempts.
Attackers often probe for files, then switch to the first path that responds with a 200 status.
How Do Error Logs Help Confirm Malware?
Error logs are useful when suspicious requests trigger PHP warnings, unexpected function calls, or fatal errors.
These messages can expose malicious code paths and help you locate the infected file.
Look for:
- Unexpected include or require errors
- Fatal errors in files you did not modify
- Warnings involving
eval(),base64_decode(), or encoded payloads - Errors referencing plugins or themes that should not be active
Malware often uses obfuscation, so an error log may mention a strange filename even if the visible infection is elsewhere.
Use the timestamp in the error log to match it against access log activity.
How to Correlate cPanel Logs with WordPress Files?
Logs become much more useful when you compare them with the actual contents of your WordPress installation.
If a suspicious request happened at 2:14 a.m., look for file changes around that same time in wp-content, themes, or uploads.
Focus on:
- Recently modified PHP files
- Files with random names or unusual extensions
- Theme
functions.phpchanges you did not make - New cron jobs, hidden admin users, or unknown plugin folders
A common technique is to match the first suspicious request in the logs with the first abnormal file modification on the server.
That connection often points to the entry point used by the attacker.
What Should You Export and Preserve?
If you suspect malware, preserve evidence before cleaning anything.
Download the relevant logs from cPanel and store them securely so you can analyze them later or share them with your host, security team, or incident responder.
- Access logs for the affected domain
- Error logs for the same time period
- Raw access archives if available
- FTP, SSH, and cPanel login history if exposed by your host
Preserving logs is important because some hosts rotate or truncate them quickly.
Once logs are overwritten, you may lose the timestamps needed to determine how the compromise happened.
Which Indicators Mean You Need Immediate Action?
Some patterns suggest active compromise and require urgent response, not just monitoring.
If you see any of the following, treat the site as at risk:
- New PHP files in
uploadsor cache directories - Repeated access to admin pages from unknown IPs
- Evidence of spam, redirects, or injected scripts in HTML output
- Unexpected changes to core WordPress files
- Admin logins from locations you do not recognize
At that point, block suspicious IPs, rotate passwords, update WordPress and plugins, and quarantine affected files.
If the infection is persistent, you may need to restore from a clean backup after verifying the backup itself is not infected.
Common Mistakes When Reading cPanel Logs
Log review is effective only when you avoid a few common errors.
The biggest mistake is assuming a clean-looking front page means the site is safe.
Many infections live quietly in file uploads, redirects, or dormant backdoors and only activate under certain conditions.
- Ignoring older logs that show the initial breach
- Focusing only on WordPress admin traffic and missing file-level requests
- Confusing normal bot traffic with targeted exploitation
- Deleting logs before capturing timestamps and IP addresses
- Skipping error logs, which often provide the clearest clue
For the best results, review logs alongside file integrity checks, plugin audits, and WordPress user account reviews.
How to Make Log Review Faster Next Time?
Once the site is clean, set up better logging habits so future investigations are easier.
Many hosts let you retain longer log history, while security plugins and external monitoring tools can alert you to suspicious behavior before it escalates.
- Keep regular backups and test restores
- Monitor file changes in
wp-content - Remove inactive plugins and themes
- Use unique strong passwords for cPanel, FTP, and WordPress
- Enable two-factor authentication where available
Documenting your baseline traffic also helps.
When you know what normal requests look like, suspicious behavior stands out quickly the next time you inspect the logs.