How to Clean WooCommerce Malware in 2026
If your WooCommerce store is behaving strangely, malware may be the cause.
This guide explains how to clean WooCommerce malware safely, restore trust, and reduce the chance of reinfection.
WordPress and WooCommerce power millions of online stores, which makes them attractive targets for hackers, credit card skimmers, and backdoor malware.
What WooCommerce malware can do
Malware on a WooCommerce site can affect both front-end shoppers and administrative users.
The damage may include stolen customer data, unauthorized redirects, SEO spam, fake checkout forms, and hidden admin accounts.
- Payment skimming: Code injected into checkout pages captures card data before it reaches your payment gateway.
- SEO spam: Malware creates malicious pages, links, or redirects that harm search visibility.
- Backdoors: Attackers leave access points that allow them to return even after obvious files are removed.
- Account abuse: Compromised administrator, editor, or shop manager accounts can be used to change site content and orders.
- Site defacement: Attackers replace homepage content or inject scripts and pop-ups.
Common signs your WooCommerce site is infected
Some infections are obvious, but many are subtle.
Monitoring behavior is often more useful than searching for a single suspicious file.
- Unexpected redirects, especially on product, cart, or checkout pages
- Warnings from Google Safe Browsing, browsers, or antivirus tools
- Unusual admin users or changes to user roles
- Slow performance, crashing pages, or excessive CPU usage
- New files in wp-content, uploads, or plugin folders
- Modified checkout scripts, header files, or payment-related JavaScript
- Spammy links indexed in search engines
Before you start: contain the incident
Before cleaning malware, reduce further damage.
If possible, place the store in maintenance mode, notify your hosting provider, and stop any suspicious payment activity until the site is verified clean.
- Change passwords for WordPress, hosting, SFTP/SSH, database, and email accounts
- Enable two-factor authentication for all privileged users
- Back up the current infected site for forensic review before making changes
- Record the time symptoms began and any recent plugin, theme, or credential changes
Do not overwrite the infected site backup with a “clean” version until you are sure the source of the breach has been identified.
How to clean WooCommerce malware step by step
The safest approach is to remove the entry point, delete malicious code, and verify that the attacker no longer has access.
A rushed cleanup often misses backdoors.
1. Put the site in a controlled state
Take the store offline or restrict access with password protection at the server level.
This limits further damage while you inspect files and accounts.
2. Scan the site with multiple tools
Use a combination of security plugins, server-side malware scanners, and external reputation checks.
Tools such as Wordfence, Sucuri SiteCheck, and your hosting provider’s malware scanner can reveal different symptoms.
Look for injected code in:
- wp-config.php
- .htaccess
- functions.php
- header.php and footer.php
- plugin files inside wp-content/plugins
- theme files inside wp-content/themes
- uploads folders containing PHP files
3. Compare core WordPress files against a fresh download
Download a clean copy of the same WordPress version and compare it with your server files.
Core files should match expected checksums, and any modified core file should be replaced with a known-good copy.
4. Remove suspicious plugins and themes
Deactivate and delete any plugin or theme that is outdated, unrecognized, nulled, or no longer maintained.
Reinstall trusted plugins from the official WordPress repository, WooCommerce.com, or the vendor’s verified distribution channel.
5. Inspect WooCommerce-specific files and checkout scripts
Because WooCommerce handles payment and customer data, focus on checkout templates, custom snippets, and queue-loaded JavaScript.
Malicious code often hides in customizations added by developers or copied from third-party tutorials.
- Review custom code added through theme files or code snippets plugins
- Check scripts loaded on cart, checkout, and my account pages
- Inspect webhook endpoints and payment gateway integrations
- Verify no unknown API keys or external domains are present
6. Delete backdoors and hidden malware
Attackers often install multiple persistence mechanisms.
Search for unfamiliar PHP files, encoded strings such as base64 or gzinflate, and unusual file names in uploads directories.
Pay close attention to:
- Recently modified files with odd timestamps
- Files with long random names
- PHP files inside directories that should contain images only
- Code that uses eval, assert, preg_replace with modifiers, or remote includes
7. Clean the database
Malware can also live in the WordPress database, especially in wp_posts, wp_options, and wp_usermeta.
Check for malicious scripts, injected iframes, spam links, rogue cron jobs, and fake administrator accounts.
Review autoloaded options, scheduled tasks, and any unfamiliar settings related to redirects or external domains.
8. Replace compromised credentials
After removing the infection, rotate all secrets again.
If attackers stole credentials, leaving old passwords in place creates immediate reinfection risk.
- WordPress admin passwords
- WooCommerce customer support or shop manager accounts
- Database credentials in wp-config.php
- SFTP, SSH, and hosting control panel passwords
- Payment gateway, email marketing, and API tokens
- Security salts and keys in wp-config.php
9. Reinstall trusted versions of WordPress, WooCommerce, and extensions
Reinstall the WordPress core, WooCommerce, and all plugins or themes from verified sources.
Do not reuse files you suspect may have been modified unless they were carefully reviewed and confirmed safe.
How to verify the store is actually clean
Cleaning malware is not complete until you confirm the site is stable and uncompromised.
Run scans again, compare file hashes where possible, and test key customer journeys.
- Log in as an administrator and review users and roles
- Browse product, cart, checkout, and account pages
- Submit test orders with each payment method
- Check source code for unexpected external scripts
- Inspect browser console errors and network requests
- Monitor logs for suspicious POST requests or repeated login attempts
If your site has a security monitoring system, confirm that file integrity alerts stop triggering after cleanup.
When to restore from backup instead of cleaning manually
Sometimes the fastest and safest option is restoring a known-good backup taken before the compromise.
This works best if you know exactly when the infection started and have clean database and file backups from that period.
Use restore instead of manual cleanup when:
- You have a verified pre-infection backup
- The infection is widespread across many files
- The attack affected core checkout behavior or payment scripts
- You do not have confidence in the scope of the compromise
Even after restoring, change all passwords and scan the restored site before reopening the store.
How to prevent WooCommerce malware in the future
Prevention depends on reducing vulnerabilities and shrinking attacker access.
WooCommerce stores stay safer when updates, permissions, and monitoring are managed consistently.
- Keep WordPress, WooCommerce, themes, and plugins updated
- Remove unused plugins, themes, and admin accounts
- Use strong passwords and two-factor authentication
- Limit file permissions and disable PHP execution in uploads
- Choose a hosting provider with server-level malware detection
- Use a Web Application Firewall, such as Cloudflare or Sucuri Firewall
- Monitor file integrity and login activity
- Restrict access to wp-admin by IP where practical
- Audit third-party scripts, chat widgets, and analytics tags
Security reviews should be routine, especially after plugin updates, new payment integrations, or changes to checkout customization.
How to protect customer data after an infection
If the malware may have exposed customer information, treat the incident as a data security event.
Review what data the store stores, what the malware accessed, and whether disclosure obligations apply under laws such as GDPR or relevant state breach notification rules.
Consider whether affected users need to be informed, whether payment processors need to be notified, and whether a forensic specialist should review logs and database access.
Final checks before reopening the store
Before bringing the store back online, verify SSL/TLS is active, confirm checkout and email notifications work, and test every critical page on mobile and desktop.
A clean backup, updated credentials, and continuous monitoring will help keep the WooCommerce site secure after recovery.