Malware on a WordPress site can hide in plugins, themes, uploads, and core files, which makes cleanup more than a simple delete-and-scan process.
This guide explains how to clean malware with Wordfence and why a careful, repeatable workflow matters.
What Wordfence Does During Malware Cleanup
Wordfence is a security plugin for WordPress from Defiant that combines a firewall, endpoint malware scanner, and remediation tools.
It can detect known malicious signatures, file changes, and suspicious code patterns, then help you repair or delete affected files.
For many site owners, Wordfence is useful because it centralizes three critical tasks:
- Scanning WordPress core, plugins, themes, and uploads
- Comparing files against trusted WordPress.org versions
- Flagging suspicious code such as obfuscated PHP, injected JavaScript, and unauthorized admin accounts
Understanding its limits is equally important.
Wordfence can identify and help remove many infections, but it cannot guarantee a complete cleanup if an attacker has persistent access through stolen credentials, server-level compromises, or a vulnerable third-party service.
Before You Start: Contain the Incident
Before you begin the cleanup, reduce the chance of further damage.
If the site is actively redirecting users, sending spam, or serving phishing pages, put it into maintenance mode or restrict access temporarily.
- Change WordPress admin passwords immediately
- Reset hosting panel, FTP/SFTP, SSH, and database credentials
- Log out all users if possible
- Back up the current infected site for forensic review
Do not overwrite the infected backup with a “clean” version until you know how the malware entered the site.
Preserving evidence can help you identify the source, such as a vulnerable plugin, compromised administrator account, or exposed file permissions.
Install and Configure Wordfence Correctly
If Wordfence is not already installed, add it from the WordPress plugin repository and activate it from the Plugins screen.
During setup, enter an email address for alerts and enable the recommended firewall and scan options.
Key configuration steps include:
- Set the scan to run regularly, not just once
- Allow Wordfence to compare files against official WordPress core checksums
- Enable alerts for file changes, login attempts, and plugin updates
- Review firewall learning mode and transition it to protection mode after tuning
If the infection is severe, consider using a clean staging site for investigation.
This allows you to review files, plugins, and traffic patterns without risking live visitors.
Run a Full Wordfence Scan
Start with a complete scan of the WordPress installation.
Wordfence checks core files, theme files, plugin files, comments, posts, and suspicious URLs, then reports items that need attention.
Pay close attention to findings such as:
- Modified WordPress core files
- Unknown PHP files in wp-content/uploads
- Injected code in header.php, footer.php, or functions.php
- Suspicious base64, gzinflate, eval, or str_rot13 usage
- Unexpected administrator accounts
- External links or scripts loaded from unfamiliar domains
Not every warning is malware.
Legitimate customizations, caching plugins, and premium themes can trigger alerts, so verify each result before deleting anything.
How to Clean Malware with Wordfence Step by Step
Once the scan identifies threats, use Wordfence’s remediation options carefully.
The goal is to restore known-good files, remove malicious code, and eliminate persistence mechanisms.
1. Repair WordPress core files
If Wordfence marks core files as modified, use the repair feature to replace them with official WordPress versions.
This is usually safer than manual editing because it removes injected changes and restores integrity.
2. Delete malicious files
Remove files that have no legitimate purpose, especially PHP files in the uploads directory or random filenames created recently.
Malware often hides in places where PHP should not normally exist.
3. Restore clean plugin and theme files
If a plugin or theme file has been altered, reinstall that plugin or theme from a trusted source.
For premium products, download a fresh copy from the vendor rather than editing compromised files line by line.
4. Inspect code injection points
Open the files Wordfence flags and look for unfamiliar code snippets, encoded payloads, remote includes, and script tags added to templates.
Common infection points include:
- functions.php
- wp-config.php
- .htaccess
- header.php and footer.php
- mu-plugins and drop-in files
If you are unsure whether code is malicious, compare the file with a clean copy from the same version of the plugin or theme.
Remove Backdoors and Hidden Persistence
Cleaning visible malware is not enough if a backdoor remains.
Backdoors are designed to let attackers re-enter later, often through a disguised PHP file, cron job, or database injection.
Use Wordfence findings together with a manual review to look for:
- Recently modified files that were not part of the scan result
- PHP files in writable directories
- Suspicious scheduled tasks in wp-cron or server cron
- New administrator users you did not create
- Injected JavaScript in posts, widgets, or the database
Also check your hosting account for unfamiliar files, as a compromise outside WordPress can recreate infected content even after a cleanup inside the CMS.
Harden the Site After Cleanup
After you remove the malware, strengthen the site so the same attack path is less likely to succeed again.
Wordfence can help with ongoing protection, but hardening should include broader account and platform controls.
- Update WordPress core, plugins, and themes
- Delete unused plugins and themes completely
- Use strong, unique passwords and multi-factor authentication
- Limit administrator accounts to trusted users only
- Set correct file permissions on the server
- Disable file editing in wp-config.php where appropriate
- Review XML-RPC exposure if you do not need it
Enable Wordfence live traffic and login alerts so you can spot brute-force activity, repeated failed logins, or unexpected POST requests.
Verify the Cleanup Worked
After remediation, run another full scan and review the results carefully.
A clean scan is a strong sign, but verification should also include a few external checks.
- Test the site in an incognito browser window
- Inspect page source for unfamiliar scripts or redirects
- Use Google Search Console for security warnings
- Check Safe Browsing tools for blacklisting status
- Monitor server logs for repeated suspicious requests
If search engines or browsers previously flagged the domain, request a review only after you are confident the malware and its persistence mechanisms are gone.
Common Mistakes to Avoid
Many cleanup failures come from rushing the process.
Avoid these errors when using Wordfence to remove malware:
- Deleting files without identifying how they were introduced
- Ignoring non-core locations such as uploads and mu-plugins
- Leaving compromised admin accounts active
- Assuming one scan is enough for full recovery
- Skipping password resets for hosting and database access
Wordfence works best as part of a complete incident response workflow, not as a one-click fix.
When to Escalate Beyond Wordfence
If the infection keeps returning, or if critical business functions are affected, escalate to a professional WordPress security service or incident response specialist.
Recurrent reinfection often means the root cause is outside the plugin layer, such as server compromise, shared hosting contamination, or a vulnerable integration.
Seek additional help when you see any of these signs:
- Repeated malware after cleanups
- Unknown server-side processes or cron jobs
- Database corruption or mass spam injections
- Unauthorized changes in hosting control panel settings
- Evidence of stolen credentials across multiple services