What WordPress index.php malware looks like
If you are trying to figure out how to clean WordPress index php malware, the first step is recognizing what that infection usually looks like.
Attackers often hide malicious code inside index.php files to redirect visitors, inject spam, or reinfect the site after cleanup.
The goal is usually persistence and stealth.
A hacked index.php can look almost normal at a glance, but it may contain obfuscated PHP, base64-encoded payloads, strange redirects, or file include calls that load remote code.
Common signs of compromise
- Unexpected redirects to phishing, gambling, or adult sites
- Warnings from Google Safe Browsing or search console security alerts
- Spam pages or cloaked content appearing in search results
- Unknown PHP functions such as
eval(),base64_decode(), orgzinflate() - Recent file changes in
index.phpor other core files - Login failures, new admin users, or missing plugin files
Because index.php exists in multiple WordPress directories, the infection can appear in the site root, theme folders, or plugin directories.
That is why cleanup needs both file inspection and broader security checks.
Where to check for infected index.php files
Before you delete anything, locate every relevant index.php file.
In a WordPress installation, these files are often legitimate and may be present in the root, wp-admin, wp-content, and theme directories.
Prioritize these locations
/public_html/index.phpor the site root/wp-admin/index.php/wp-includes/index.php/wp-content/themes/[theme]/index.php/wp-content/plugins/[plugin]/index.php
A normal WordPress index.php file is usually short and simple.
For example, the root file typically loads the WordPress environment rather than containing business logic.
If you see a long block of encoded text or unrelated PHP functions, treat it as suspicious.
How to clean WordPress index.php malware safely
The safest approach is to isolate the site, identify the malicious code, restore clean files, and then verify that the backdoor is gone.
If you skip any of those steps, reinfection is common.
1. Put the site in maintenance mode
Take the site offline or restrict access during cleanup.
This reduces risk to visitors and prevents the malware from continuing to spread or trigger malicious redirects while you work.
2. Create a full backup before changing files
Make a complete backup of files and database before editing anything.
Even if the site is compromised, a backup is useful for forensic review and recovery if a cleanup step goes wrong.
3. Compare infected files with known-clean WordPress core files
Download the same WordPress version from WordPress.org and compare the suspicious index.php files against the originals.
WordPress core files should match the expected content unless the site is using a heavily customized theme or plugin file.
If the root index.php differs from the official version, replace it with a clean copy.
If a theme or plugin index.php file is infected, replace it from a trusted source or reinstall the entire theme or plugin package.
4. Remove malicious code and hidden payloads
Open suspicious files in a text editor that shows plain text clearly.
Look for code that is compressed, encoded, or intentionally obscured.
Common indicators include:
eval(base64_decode(...))- Long unreadable strings with repeated symbols
- Remote URL fetches using
file_get_contents()orcurl - Unexpected function names near the top or bottom of the file
- Injected JavaScript output inside PHP echo statements
If the file is small and should only contain a WordPress loader, replacement is usually safer than manual editing.
Manual cleanup is better suited to theme files where you can identify the exact malicious addition.
5. Check for reinfection sources
Malware in index.php is often only one part of the compromise.
Attackers commonly add backdoors in other files, scheduled tasks, or writable directories.
- Search for modified files with recent timestamps
- Inspect
wp-config.phpfor strange includes or extra code - Review
.htaccessfor redirect rules - Check
wp-content/uploadsfor PHP files, which are unusual and often malicious - Review active plugins and themes for unfamiliar code
Use your hosting file manager, SSH, or a trusted malware scanner to search for suspicious PHP patterns sitewide.
How to verify the site is clean
After replacing infected files, verify that no malicious behavior remains.
This matters because malware frequently uses secondary payloads or hidden admin access to restore itself.
Run a trusted malware scan
Use a reputable scanner such as Wordfence, Sucuri, or your hosting provider’s security tools.
These can help identify remaining suspicious code, file changes, and known malicious signatures.
Test browser behavior and source code
Open the site in a private browser window and inspect the page source.
Confirm that no unauthorized scripts, redirects, or injected iframes are loading.
Also check key pages like the homepage, login page, and contact forms.
Check WordPress users and authentication
Review all administrator accounts in the WordPress dashboard.
Remove any accounts you do not recognize, and reset passwords for every user with elevated access.
Security cleanup after index.php malware removal
Removing the infected file is not enough on its own.
A proper cleanup should include credential resets and updates to close the attack path that allowed the compromise.
Reset credentials and keys
- Change all WordPress passwords
- Change hosting control panel and FTP/SFTP passwords
- Reset database credentials if there is any doubt about exposure
- Regenerate WordPress security keys and salts in
wp-config.php
Update all software
Update WordPress core, themes, and plugins to the latest stable versions.
Outdated software is a common entry point for malware infections, especially when vulnerabilities allow file upload, privilege escalation, or remote code execution.
Remove unused components
Delete inactive plugins and unused themes instead of leaving them installed.
Even inactive code can become a future attack vector if it contains vulnerabilities.
How to harden WordPress against repeat infection
Once you have cleaned the malware, hardening the site reduces the chance that the same type of attack returns.
WordPress security is strongest when file permissions, updates, and access controls are all aligned.
Use safer file permissions
Set permissions so that PHP files cannot be edited by unauthorized users.
In many hosting environments, directories use 755 and files use 644, though exact settings depend on server configuration.
Disable file editing in the dashboard
Add the following constant to wp-config.php to prevent dashboard-based file edits:
define('DISALLOW_FILE_EDIT', true);This does not stop malware by itself, but it removes one common method attackers use after gaining admin access.
Limit write access where possible
Restrict write access to only the directories that need it, such as uploads.
Avoid giving broad write permissions to core, plugin, or theme directories unless your workflow requires it.
Use a Web Application Firewall
A Web Application Firewall can block malicious requests before they reach WordPress.
Services such as Cloudflare, Sucuri, or a managed host WAF can reduce brute-force attempts, exploit probes, and known attack patterns.
When to restore from a clean backup instead
If the infection is widespread, it may be faster and safer to restore a clean backup from before the breach.
This is especially true if multiple core files, themes, or plugins have been altered, or if the attacker created hidden accounts.
Choose restoration when you can confirm the backup predates the compromise and the backup itself has been stored securely.
After restoration, still patch the vulnerability and reset credentials so the same issue does not recur.
Practical checklist for cleaning index.php malware
- Take the site offline or restrict access
- Back up files and the database
- Locate all relevant
index.phpfiles - Compare against clean WordPress versions
- Replace infected core, theme, or plugin files
- Scan for backdoors and suspicious PHP code
- Check users, passwords, and scheduled tasks
- Update WordPress, themes, and plugins
- Harden file permissions and disable file editing
- Monitor logs and scan regularly for reinfection
Following this workflow gives you a structured way to clean WordPress index php malware without leaving behind hidden payloads or reopening the same security gap later.