How to Remove Malware from WordPress Without a Plugin
Malware on a WordPress site can hide in theme files, database entries, or rogue admin accounts, and many site owners need a manual way to clean it up.
This guide explains how to remove malware from WordPress without plugin tools so you can restore control and reduce the chance of reinfection.
What malware usually looks like on WordPress
WordPress malware rarely announces itself clearly.
Common signs include unexpected redirects, spam links, unfamiliar admin users, modified core files, warnings from Google Search Console, and sudden performance issues.
Attackers often target weak passwords, outdated plugins, vulnerable themes, exposed wp-admin endpoints, and compromised hosting accounts.
The cleanup process works best when you assume the infection may be spread across files, the database, and credentials.
- Injected JavaScript or iframe spam
- PHP backdoors in theme or upload directories
- Database-based spam content
- Hidden administrator accounts
- Modified .htaccess or wp-config.php files
Before you start: isolate and preserve the site
First, take the site offline or place it in maintenance mode if possible.
If your hosting provider offers a staging clone, use it for inspection and cleanup so the live site stays protected while you work.
Create a full backup of the infected site before changing anything.
You do not want to overwrite evidence too early, especially if you need to compare clean and infected files later.
If your host has file-level backups, download one copy for safety and keep it separate from the active server.
How to remove malware from WordPress without plugin tools
The safest manual approach is to identify suspicious files, replace compromised core files, clean the database, and reset every credential that could have been exposed.
Work methodically so you do not miss hidden persistence mechanisms.
1. Scan the file system from the server side
Use FTP, SFTP, SSH, or your hosting file manager to inspect the WordPress installation.
Focus on locations where malware commonly hides: wp-content/uploads, wp-content/themes, wp-content/plugins, the root directory, and any custom folders added by the site.
Look for unfamiliar PHP files, recently modified files, oddly named scripts, and code that is heavily obfuscated with functions such as base64_decode, gzinflate, str_rot13, eval, or preg_replace with the /e modifier.
Also check for files that do not belong in uploads, since PHP files there are often suspicious.
2. Replace WordPress core files
Download a fresh copy of the exact WordPress version currently installed, or the latest stable version if you plan to update immediately after cleanup.
Replace all core files except wp-config.php and the wp-content directory.
This step removes injected code from wp-includes and wp-admin, which are common targets after compromise.
If the infection touched core files, a clean replacement is usually faster and safer than trying to repair each file line by line.
3. Inspect themes and plugins manually
Open the active theme’s functions.php, header.php, footer.php, and any custom template files.
Compare them with a known-good copy from the vendor or a clean backup.
Malware often inserts malicious includes, hidden redirects, or encoded payloads into theme files because those files run on every page load.
Do the same for installed plugins, especially custom or abandoned ones.
If a plugin file contains code you did not add, restore the plugin from a clean source or remove it entirely if it is no longer needed.
4. Clean the uploads directory carefully
The wp-content/uploads folder should normally contain media assets, not executable PHP.
Search for .php, .phtml, .php5, or other executable extensions inside uploads and remove anything that should not be there.
Also inspect image files with strange filenames, unusually small sizes, or double extensions such as image.jpg.php.
Attackers sometimes disguise malware as media uploads to preserve access after the initial breach.
5. Check .htaccess and other configuration files
Review the .htaccess file in the root directory and any additional .htaccess files inside subfolders.
Malicious rules may redirect visitors, block crawlers, or force unwanted downloads.
If you are not using advanced rewrite rules, compare the file against a clean WordPress default.
Inspect wp-config.php for unfamiliar includes, remote URLs, or injected PHP.
Also check server configuration files if your hosting stack uses them, such as nginx site configs or custom Apache rules.
6. Clean the database entries
Use phpMyAdmin or another database tool to inspect posts, pages, widgets, options, and user tables.
Search for suspicious scripts, spam links, or hidden text in the wp_posts and wp_options tables.
Malware may inject code into the active theme settings, widget content, or plugin configuration records.
Pay close attention to options that load automatically on every request, especially if they contain long encoded strings or external domains.
Remove only the content you can verify as malicious, and avoid deleting unknown but legitimate theme or plugin settings without a backup.
7. Remove unknown admin users and reset roles
Check the WordPress users list for unfamiliar accounts, especially ones with administrator privileges.
Attackers often create a backup admin account to regain access even after file cleanup.
Delete unauthorized users, then review user roles for suspicious changes.
If a lower-privilege account has become an administrator, restore the correct role and investigate how the elevation occurred.
8. Reset every credential
Change the WordPress admin password, hosting control panel password, database password, FTP or SFTP credentials, and any connected email or CDN accounts.
If attackers obtained one credential, they may have used it to create backdoors or alter files repeatedly.
Regenerate WordPress security salts in wp-config.php so existing sessions are invalidated.
This forces all logged-in users, including any attacker sessions, to sign in again with fresh credentials.
How to verify the cleanup worked
After removal, revisit the site files and database to make sure no malicious code remains.
Reopen the pages that previously showed redirects, spam, or injected content and compare them against a clean browser session and an incognito window.
Use server logs, browser developer tools, and Search Console reports to look for remaining suspicious requests.
If your site was blacklisted, request a review only after you have confirmed the infection is gone.
- Check the homepage and key landing pages
- Review recent post revisions for injected spam
- Confirm no new unknown users were added
- Test forms, logins, and checkout flows
- Watch logs for repeat requests to suspicious files
How to prevent reinfection
Manual cleanup is only part of the job.
If the original entry point remains open, malware can return quickly.
- Update WordPress core, themes, and plugins immediately
- Remove unused themes and plugins entirely
- Use strong passwords and two-factor authentication
- Restrict file permissions and disable PHP execution in uploads
- Keep regular off-site backups
- Choose a hosting provider with malware monitoring and account isolation
It also helps to audit the site periodically for file changes, database anomalies, and new administrator accounts.
A simple review process is often more effective than waiting for another visible infection.
When manual cleanup is not enough
If malware keeps returning after cleanup, the compromise may extend beyond WordPress itself.
In that case, the hosting account, a local workstation, a deployment pipeline, or a third-party integration may be infected or exposed.
Sites with high traffic, ecommerce transactions, or regulatory obligations may need a deeper forensic review.
At that point, involving your host, a security specialist, or a professional incident response team can save time and reduce business risk.