If your WordPress site is slow, redirecting strangely, or flagged by Google, you may need to clean it carefully on shared hosting.
This guide shows the safest way to remove infections, restore trust, and reduce the chance of another compromise.
Why shared hosting makes WordPress cleanup harder
Shared hosting places multiple websites on the same server, which means resource limits, restricted server access, and shared risk if another account is compromised.
You usually cannot rely on root-level tools like a dedicated server administrator would, so cleanup must happen from within your hosting account, WordPress dashboard, file manager, and database access.
Common symptoms of a compromised WordPress site on shared hosting include unfamiliar admin users, injected spam links, new PHP files in uploads folders, suspicious redirects, email sending abuse, and warnings from Google Safe Browsing or antivirus scanners.
The key is to identify what changed, remove malicious code, and then patch every weak point.
What you need before you start
Before you touch files or the database, gather a few essentials so you can work methodically and avoid making recovery harder.
- A full backup of files and database, even if the site is infected
- FTP or SFTP credentials
- cPanel or hosting file manager access
- phpMyAdmin access to the WordPress database
- A clean copy of the same WordPress core version if possible
- Access to your domain registrar and DNS settings
If you suspect active malware, change hosting and WordPress passwords only after securing access to your cleanup tools.
Otherwise, you may lock yourself out before you can inspect the site.
How to clean WordPress on shared hosting
The safest cleanup process is to isolate the infection, remove malicious files, verify database integrity, and then harden the site.
Work in order and avoid deleting files blindly.
1. Put the site in maintenance mode or restrict access
If visitors are being redirected or served malware, reduce exposure immediately.
Use a maintenance plugin, password-protect the site directory through your host, or temporarily block public access with a .htaccess rule if you understand the implications.
The goal is to stop further damage while you inspect the site.
2. Back up everything before deleting anything
Create a complete backup of the website files and database, including wp-content, wp-config.php, and any custom directories.
Keep a copy offline.
Even infected backups are valuable because they let you compare timestamps, file contents, and database changes later.
3. Scan the files for suspicious changes
Review file timestamps and look for recently modified PHP files in places where PHP usually should not exist, such as wp-content/uploads, cache folders, and image directories.
Malware often hides in files with names that resemble core WordPress files or uses random names like class-api.php, update-temp.php, or functions-old.php.
Pay special attention to these locations:
- wp-content/uploads
- wp-content/cache
- wp-content/mu-plugins
- wp-includes and wp-admin, if modified
- Root-level .php files that were not part of your theme or plugin stack
Open suspicious files and look for obfuscated code such as base64_decode, eval, gzinflate, str_rot13, or long strings of encoded text.
Those functions are not always malicious, but they are common in webshells and backdoors.
4. Replace WordPress core files with clean copies
Download a fresh copy of WordPress from wordpress.org and replace the wp-admin and wp-includes folders completely.
Replace root files like index.php, wp-login.php, and xmlrpc.php only if they differ from the official release.
Do not overwrite wp-content, because that contains your themes, plugins, and uploads.
This step removes many common core file infections, especially if an attacker modified login or include files to keep persistence.
5. Reinstall trusted plugins and themes
Delete any plugin or theme you do not actively use, then reinstall the rest from their official sources.
If a premium plugin came from a vendor portal, download a fresh package rather than reusing files from the compromised server.
A tampered plugin can reintroduce the infection even after the core is clean.
For themes, keep only the active theme and a default WordPress theme such as Twenty Twenty-Four as a fallback.
Remove old child themes and abandoned custom themes unless you are certain they are safe.
6. Inspect wp-config.php and .htaccess carefully
These two files are frequent hiding places for malicious redirects and PHP loaders.
Compare them against a known-good version and look for unfamiliar include statements, strange redirect rules, or recently appended code blocks.
- In wp-config.php, verify database credentials, security keys, and table prefixes
- In .htaccess, review redirect rules, rewrite conditions, and injected malware filters
- Remove any line you do not understand and can confirm is unnecessary
If you are unsure about a line, search for it in the original plugin or theme documentation before deleting it.
7. Clean the database for injected content
Malware is not always file-based.
It can inject spam links, fake admin accounts, malicious iframes, or JavaScript into posts, widgets, and options.
Use phpMyAdmin to inspect the wp_users table for unknown admins and the wp_options table for suspicious siteurl, home, or active_plugins values.
Search post content and widgets for patterns such as hidden text, encoded scripts, or outbound links to unfamiliar domains.
Also inspect the following tables if your site uses them:
- wp_posts
- wp_postmeta
- wp_options
- wp_users and wp_usermeta
Delete unknown admin users, remove suspicious scheduled tasks, and restore clean content from backup if necessary.
8. Check for hidden persistence mechanisms
Attackers often leave backdoors so they can return after a cleanup.
Look for PHP files with recent timestamps, hidden folders, oddly named cron jobs, and code that creates admin users or fetches remote content.
On shared hosting, the attacker may also use legitimate-looking plugin files to reload malicious code on every page load.
Review wp-cron activity, hosting cron jobs, and any custom scripts in your account.
If a file keeps reappearing after deletion, it usually means another file or scheduled task is reinfecting the site.
How to harden WordPress after cleanup
Once the infection is removed, focus on closing the most common entry points.
Cleanup without hardening often leads to a repeat incident.
- Change all passwords: WordPress admins, hosting panel, FTP/SFTP, database, email, and registrar
- Reset WordPress salts in wp-config.php
- Remove unused users, plugins, themes, and staging copies
- Update WordPress core, themes, and plugins to current versions
- Disable file editing from the WordPress dashboard with define(‘DISALLOW_FILE_EDIT’, true);
- Use SFTP instead of FTP whenever possible
- Limit login attempts and enable two-factor authentication for admins
Also review file permissions.
On shared hosting, overly permissive settings such as 777 can make it easier for attackers to write files or modify directories.
In most cases, 644 for files and 755 for directories is a safer baseline, though your host may recommend specific values.
How to tell whether the site is fully clean
A clean site should behave normally across multiple checks, not just in the browser.
Re-scan the files, confirm that no unknown admin accounts remain, and verify that search engines no longer flag the domain.
If you use security tools such as Wordfence, Sucuri SiteCheck, or your host’s malware scanner, run them again after the cleanup.
Test these areas carefully:
- Homepage loads without redirects
- Login page works and no new admins exist
- Posts and pages do not contain injected links or scripts
- Email sending is normal and not abused for spam
- Core files match official WordPress checksums where possible
If Google Search Console still reports security issues, request a review only after you are confident the malicious code is gone and the site has been rescanned.
When to ask your host for help
Shared hosting providers can sometimes help with server-side logs, malware scans, account isolation, and restore points.
Contact support if you see reinfection across multiple sites in the same account, repeated file creation you did not authorize, or signs that the host environment itself may be affected.
Ask for information about recent login activity, infected files detected by the host, and any server-level blacklisting that might affect mail delivery or indexing.
If your site shares an account with multiple domains, consider separating them after cleanup so one compromised site does not put the others at risk.
Common mistakes to avoid during cleanup
Many WordPress owners make the same errors when they try to clean a compromised shared hosting account.
Avoid these problems to reduce downtime and prevent accidental data loss.
- Deleting random files without a backup
- Leaving abandoned plugins or themes installed
- Changing passwords before securing your cleanup access
- Trusting a site just because the homepage looks normal
- Forgetting the database, scheduled tasks, and .htaccess file
- Restoring from a backup made after the infection started
A disciplined file-by-file and table-by-table review is slower, but it is far more reliable than a quick reset.