How to Clean WordPress functions.php Malware

If your WordPress site is redirecting visitors, injecting spam links, or showing strange admin behavior, the malware may be hiding in functions.php.

This guide explains how to clean WordPress functions.php malware safely and how to check for related backdoors.

Why functions.php Is a Common Malware Target

The functions.php file is part of your active theme and runs on nearly every page load, which makes it attractive to attackers.

Because it is often edited for custom snippets, malicious code can blend in with legitimate theme logic and go unnoticed for weeks.

Attackers commonly use functions.php to:

• Inject JavaScript into the front end
• Create hidden administrator accounts
• Load remote PHP from a malicious domain
• Redirect visitors based on browser or referrer
• Reinsert malware after cleanup through a backdoor

Signs Your functions.php File Is Infected

You do not need a full forensic report to spot many infections.

Several patterns strongly suggest malware in the theme file or nearby files.

• Unexpected redirects to spam, casino, or phishing pages
• Unknown code added near the bottom of functions.php
• Obfuscated PHP using base64_decode, gzinflate, str_rot13, or long encoded strings
• Files modified at odd times without a known change history
• New admin users, especially with generic names
• Warnings from Google Safe Browsing, Wordfence, Sucuri, or hosting alerts

Before You Edit Anything

Cleaning malware is safer when you preserve evidence and create a recovery path.

If possible, work from a full backup and avoid editing directly on a live site until you know what changed.

Take these first steps

• Put the site in maintenance mode if it is actively harming users
• Create a full backup of files and database
• Change passwords for WordPress, hosting, SFTP, SSH, and database access
• Update security keys in wp-config.php if credential theft is suspected
• Record the current file hash or copy of functions.php before editing

How to Inspect functions.php for Malware

Open the file in a code editor such as VS Code, Sublime Text, or a secure SSH session.

Search for recently added code, unfamiliar function names, and any block that looks compressed, encoded, or unrelated to theme behavior.

Pay special attention to code that does not match normal theme patterns, such as:

• Remote requests using wp_remote_get, curl, or raw socket functions
• eval, assert, or dynamic function creation
• Calls to file_get_contents fetching external URLs
• Hooks added to init, wp_head, admin_init, or template_redirect that do not belong
• Hidden code wrapped in comments to look harmless

If you are unsure whether a block is malicious, compare the file with a clean copy from the theme vendor or a fresh download of the same theme version.

Safe Removal Process for Infected Code

The safest way to clean WordPress functions.php malware is to replace suspicious code with a known-good version, not just delete random lines.

If the theme is custom, remove only the malicious block and preserve legitimate customizations.

Recommended cleanup workflow

1. Back up the infected file.
2. Compare functions.php against a clean theme copy using a diff tool.
3. Remove malicious snippets and any code that reappears after refreshes.
4. Save the file and test the site in a staging copy first if available.
5. Check the front end, admin dashboard, forms, and login pages for regressions.

If the file contains heavily obscured malware and you cannot confidently separate good code from bad code, replace the entire theme with a clean copy and reapply only verified customizations.

Look for the Backdoor, Not Just the Payload

Removing the visible malware is only part of the job.

Many WordPress infections include a persistence mechanism elsewhere on the server, so the malicious code may return after the next cron run or page load.

Search the theme directory, uploads folder, and plugins directory for files with:

• Recent modification dates
• Random file names such as class-cache.php, wp-vcd.php, or similarly misleading names
• Code stored inside image, text, or PHP files in unusual locations
• PHP files inside wp-content/uploads, which should generally not be there

Also inspect wp-config.php, mu-plugins, scheduled tasks, and the database for injected scripts or malicious redirects.

Verify Core, Theme, and Plugin Integrity

Malware in functions.php often travels with compromised plugins or an outdated WordPress core file.

Replace any modified core files with fresh copies from WordPress.org and reinstall premium or custom plugins from trusted sources only.

Use these checks to narrow the infection:

• Run a malware scan with a security plugin such as Wordfence, Sucuri, or MalCare
• Compare WordPress core files to the official release
• Disable and inspect recently installed or nulled plugins
• Review theme files beyond functions.php, especially header.php, footer.php, and index.php

Clean the Database and User Accounts

Some infections inject scripts into posts, widgets, options, or page builders instead of only files.

Check the database tables for suspicious content, especially where sitewide scripts or widget HTML are stored.

Review these areas carefully:

• wp_options for injected site URL, home URL, or widget settings
• wp_posts for hidden iframe or script tags
• wp_users and wp_usermeta for unknown administrators
• Scheduled events in WP-Cron for suspicious jobs

If you discover rogue admin accounts, remove them after confirming they are not legitimate developer users.

Harden the Site After Cleanup

Once the infection is removed, hardening reduces the chance of reinfection.

Malware often returns through weak passwords, outdated software, stolen FTP credentials, or vulnerable plugins.

• Update WordPress, plugins, themes, and PHP to supported versions
• Use SFTP or SSH instead of plain FTP
• Restrict file permissions so theme files are not writable unless necessary
• Disable theme and plugin editing in the dashboard with DISALLOW_FILE_EDIT
• Install a firewall and file integrity monitoring
• Enable MFA for admin and hosting accounts

When to Restore from Backup Instead

Restoring from a clean backup is often faster and safer than manual cleanup if you have a recent backup taken before the compromise.

This is especially true when multiple files, the database, and user accounts are affected.

Choose restore over manual repair when:

• You have a verified clean backup from before the infection
• The theme codebase is heavily altered or unmaintained
• Malware appears in many unrelated files
• You cannot determine the original customizations confidently

How to Prevent functions.php Malware in the Future

Prevention depends on reducing access, minimizing attack surface, and detecting changes early.

A small amount of maintenance can prevent a large cleanup later.

• Limit who can edit theme files
• Avoid installing nulled themes or plugins
• Keep an off-site backup schedule
• Review file changes regularly
• Use a staging environment for custom theme edits
• Monitor for unknown admin users and unusual outbound requests

If you need to customize theme behavior, prefer child themes or custom plugins over editing the parent theme directly.

That keeps your changes isolated and easier to audit when something goes wrong.

What a Clean functions.php Should Look Like

A normal functions.php file contains theme setup, enqueue calls, support registrations, and custom business logic tied to the site.

It should not contain unexplained encoding, remote payload retrieval, or code that hides its intent.

As a practical rule, every block in functions.php should answer one clear question: what does this code do for the theme?

If the answer is unclear, temporary, or unrelated to the site, treat it as suspicious until verified.