WordPress Malware Removal: How to Clean a Hacked Website in 2026

By Rafirit Station Editorial Team · Updated 2026 · ⏱ 22 min read

**WordPress malware removal** isn’t just about deleting a few suspicious files. It’s about protecting your business, your customers, and your hard-earned reputation. According to Sucuri’s 2025 Website Threat Report, WordPress is still the most targeted CMS, accounting for **88% of all CMS-based infections**. That means if your website is on WordPress, you’re already in the crosshairs.

In 2026, the threat landscape is worse than ever. Hackers now use automated bots that scan for vulnerable plugins the moment a CVE is published. A site can be infected within 15 minutes of a vulnerability disclosure. For small businesses in Dhaka, from Gulshan to Uttara, a single hack can take down your e-commerce store, empty your bank accounts, or turn your site into a spam distribution hub.

The cost of inaction is real. We’ve seen a Dhaka-based clothing store lose ৳1,50,000 in one week due to a server-level hack that blacklisted their domain. When you add emergency IT costs, lost sales, and the cost of rebuilding customer trust, the total easily reaches ৳5,00,000. And that doesn’t count the hours you’ll never get back.

This guide will walk you through a proven, step-by-step WordPress malware removal plan. You’ll learn how to contain the damage, identify the infection, clean every file and database record, and harden your site so you never get hacked again. By the time you finish, you’ll feel confident you can handle — or at least intelligently outsource — a security crisis.

---

---

📚 External Resources (Bookmark These)

• Google Search Central — Webmaster Guidelines
• Wordfence Security Blog
• Sucuri Security Blog
• WPScan Vulnerability Database
• OWASP Top Ten
• Moz Blog
• Semrush Blog
• Ahrefs Blog
• Backlinko
• Search Engine Journal

---

🔗 Rafirit Station Services

• Web Development — Custom websites
• Web Development Dhaka — Local dev team
• UI/UX Design — Interfaces users love
• Ecommerce Solutions — Shopify & WooCommerce
• CRO Services — Websites that convert
• App Development — iOS & Android
• Packages & Pricing
• Rafirit Station Bangladesh — Digital Agency
• Rafirit Station Dhaka — Full-Service Agency

---

---

Phase 1: Immediate Response & Containment

When you first realize your site is hacked, your heart races. But you must stay calm and follow a systematic process. The first 24 hours determine how much data you lose and how quickly you recover. Here’s exactly what to do, whether your business is in Dhaka or anywhere else in Bangladesh.

Tactic 1.1: Quarantine Your Website to Stop the Spread

Why this works: If your site is infected with malware that steals customer data or redirects visitors to harmful sites, keeping it online jeopardizes everyone who visits. Taking it offline limits the blast radius, prevents further damage to your reputation, and stops the infection from spreading to other websites on the same server.

Exactly how to do it:

1. Log into your hosting control panel (cPanel, Plesk, or custom).
2. Enable “Maintenance Mode” or upload a temporary index.html with a polite notice.
3. If you can’t access wp-admin, use FTP or File Manager to rename the .htaccess file and deactivate all plugins by renaming the plugins folder.
4. Consider changing your DNS to a parking page if the malware keeps returning.
5. Download a full backup of your current files and database — even if infected, you’ll need the evidence for analysis.

Pro script / template: “We apologize for the temporary interruption. We’re performing scheduled maintenance to improve your experience. Please check back in 30 minutes. — [Your Business Name]”

📊 Expected results: Within 30 minutes of taking your site offline, you’ll stop infecting visitors and reduce the risk of being blacklisted by Google Safe Browsing.

Tactic 1.2: Contain the Infection by Rotating All Credentials

Why this works: Hackers often install backdoors that allow them to re-enter your site using compromised credentials. Changing all login credentials immediately locks them out and prevents them from using an existing session to hide their tracks.

Exactly how to do it:

1. Change the WordPress admin password and all user passwords.
2. Change FTP/SFTP passwords and database passwords.
3. Revoke all API keys, webhooks, and integration tokens (e.g., payment, email, Google).
4. Delete any suspicious users added by the attacker, especially any with administrator role.
5. Enable two-factor authentication (2FA) for all admin accounts.

Pro script / template: “Security Alert: We have initiated a password reset for all user accounts. If you did not request a password change, please click the link below to secure your account.”

📊 Expected results: Within 1 hour, you’ll block the low-hanging fruit and prevent the hacker from simply logging back in.

Tactic 1.3: Notify Your Hosting Provider Immediately

Why this works: Your hosting provider may be able to restore a clean backup or isolate your account. They can also help remove malware at the server level if the infection runs deep, which is often the case with hacked WordPress sites on shared hosting.

Exactly how to do it:

1. Contact your web host’s security team through support (ticket, chat, or phone).
2. Provide a summary of what you’ve found (e.g., strange redirects, malicious files).
3. Ask if they can enable a web application firewall or take a snapshot.
4. Request backup restoration if they have daily backups available.
5. Keep a record of all communication for future reference.

Pro script / template: “I’m contacting you to report a suspected malware infection on my site [domain]. I’ve put the site in maintenance mode and rotated my credentials. Can you please guide me through restoring from a clean backup or take measures to contain the issue?”

📊 Expected results: Most hosts respond within 15–60 minutes. They may restore a recent clean backup if you have one, saving you hours.

Tactic 1.4: Set Up a Clean Backup Environment

Why this works: You need a known-good backup to compare against or restore from. If you don’t have one, you can still use the infected backup as a reference, but you’ll need to sanitize it carefully.

Exactly how to do it:

1. Download a full backup of your current files and database (even if infected).
2. Download a fresh copy of WordPress core from wordpress.org.
3. Reinstall all plugins and themes from official developer repositories.
4. Store all backups away from the server (e.g., Dropbox, Google Drive, or external drive).
5. Use a staging site to restore the infected backup and practice cleaning it safely.

Pro script / template: “If you don’t have a clean backup, create a staging site and restore the infected backup into it. You can then clean it safely without affecting your live site.”

📊 Expected results: You’ll have a safety net to restore from if your cleanup attempts fail.

Phase 2: Malware Detection & Diagnosis

Malware isn’t always obvious. Some hacks hide in the database or inject malicious redirects that only appear when an admin is logged out. This phase will help you find the ground truth and identify exactly where the infection lives.

Tactic 2.1: Use a Free Malware Scanner (and Pay for One)

Why this works: Security plugins like Wordfence and Sucuri scan for known malware signatures, malicious URLs, and irregular changes to core files. Free scanners catch the low-hanging fruit; paid ones often include daily scans, firewall integration, and deeper analysis.

Exactly how to do it:

1. Install and activate Wordfence (free) from the WordPress dashboard.
2. Run a full malware scan (Scan > Start New Scan).
3. Review the results, paying attention to “critical” warnings and any flags on core files.
4. Use the Sucuri SiteCheck remotely (https://sitecheck.sucuri.net) to scan your public-facing site for blacklisting.
5. Cross-reference the two tools’ results to confirm detections and avoid false positives.

Pro script / template: “If a plugin is flagged as vulnerable, immediately check if there’s an update. If no update exists, deactivate and remove the plugin.”

📊 Expected results: You’ll identify at least 80% of known malware infections within 15 minutes.

Tactic 2.2: Look for Unusual Files and Modified Code

Why this works: Attackers often drop random PHP scripts (like shell.php) or inject code into existing files like functions.php or index.php. A simple file integrity check can reveal these anomalies.

Exactly how to do it:

1. Use an FTP client (like FileZilla) to connect to your server.
2. Sort all files by date modified. Look for recently modified files (within the last 7 days) that you didn’t change.
3. Check wp-content/uploads for .php files that shouldn’t be there.
4. Search for base64_decode(), eval(), shell_exec() in your file contents.
5. Use a tool like “WordPress File Scan” plugin for a deeper audit.

Pro script / template: “On the server, run: find . -name ‘*.php’ -mtime -2 -exec grep -l ‘eval|base64_decode’ {} +”

📊 Expected results: Most malicious files are detected within an hour.

Tactic 2.3: Analyze Your .htaccess and wp-config.php

Why this works: Hackers often use .htaccess to redirect visitors to spam sites or to serve malicious content without you noticing. The wp-config.php can also be modified to include a backdoor.

Exactly how to do it:

1. Open .htaccess from your WordPress root.
2. Look for any suspicious Redirect or robots directives.
3. Check wp-config.php for any code additions (like multiple database entries).
4. Compare both against a default WordPress installation.
5. Look for suspicious cron job definitions in wp-cron.php.

Pro script / template: “A hacked .htaccess might contain lines like: Redirect permanent / http://spam-site.com. Remove any line you don’t recognize.”

📊 Expected results: You’ll often find the exact redirect payload causing your site to be flagged by the browser.

Tactic 2.4: Inspect Your WordPress Users and Database

Why this works: Attackers can inject “hidden admin” users that give them backdoor access. They can also store spam content in your posts and pages to leech SEO authority or serve ads.

Exactly how to do it:

1. Go to Users > All Users in wp-admin.
2. Look for any new users with administrator role that you didn’t create.
3. Run a database query to find suspicious content: SELECT * FROM wp_options WHERE option_name = ‘siteurl’ or ‘home’.
4. Check wp_posts for hidden spam pages.
5. Use a plugin like WP-DB Manager to search for suspicious strings.

Pro script / template: “Search your database for ‘eval(‘, ‘gzinflate’, ‘x65x78x70’ — these are common obfuscation markers.”

📊 Expected results: Within 2 hours, you’ll have a full inventory of what’s infected.

Phase 3: Malware Removal & Site Cleanup

Now that you’ve located the infection, it’s time to clean. This is the most labor-intensive step, but with a systematic approach you can remove the malware and rebuild your site’s integrity.

Tactic 3.1: Replace Infected WordPress Core Files

Why this works: Core files are frequently modified by malware. Downloading a fresh copy and reinstalling over the existing installation rebuilds them to a known-good state, eliminating any hidden code in core directories.

Exactly how to do it:

1. Download the latest WordPress core from wordpress.org.
2. Extract the zip file locally.
3. Via FTP, delete all WordPress core files except wp-content and wp-config.php.
4. Upload the fresh WordPress files from the extracted folder.
5. Preserve wp-content/uploads and wp-config.php.
6. Keep your existing .htaccess (but be sure it’s clean).

Pro script / template: “Do not delete the entire wp-content folder—it contains your uploads, themes, plugins, and customizations. Only delete the core directories: wp-admin, wp-includes, and root files.”

📊 Expected results: You’ll immediately remove any file-level malware hidden in core code. This is effective in 95% of hack cleanup scenarios.

Tactic 3.2: Clean Malware from Themes and Plugins

Why this works: Even after re-installing core, Trojans hide in theme files like functions.php or plugin files. You need to purge these individually to prevent the malware from re-infecting.

Exactly how to do it:

1. Identify all themes and plugins that appear modified (by scanning with a file integrity plugin).
2. For each, delete the theme/plugin directory.
3. Download fresh copies from the official repository or developer’s site.
4. Reinstall and re-activate them one by one.
5. Test your site after each activation to spot any compromised functionality.

Pro script / template: “If you see ‘Class not found’ or database errors after deleting, you may need to redeclare a custom function. Better to use a clean copy and re-implement your custom code from source control.”

📊 Expected results: You’ll remove hidden malicious code from your theme/plugin files and reduce the chance of a backdoor being left.

Tactic 3.3: Purge Malicious Database Entries and Options

Why this works: Malware often stores redirects, spam posts, and rogue admin users in the database. Even after file cleanup, these remnants can re-inject or continue to harm your SEO if left behind.

Exactly how to do it:

1. Back up your database via phpMyAdmin or a plugin like UpdraftPlus.
2. Use a plugin like “WordPress Database Cleanup” or run SQL queries directly.
3. Search for and delete any non-existent tables or hidden entries.
4. Check wp_options for suspicious option_names (e.g., ‘pnr_malware’).
5. Reset your WordPress site URL and home URL to your own domain.
6. Remove any spam content from wp_posts and wp_comments.

Pro script / template: “Query: DELETE FROM wp_posts WHERE post_type = ‘revision’ AND post_status = ‘trash’ — but avoid bulk deletion unless you’re certain.”

📊 Expected results: Your database will be free of malicious content, and your site will load faster, too.

Tactic 3.4: Change All Cryptographic Keys and Passwords

Why this works: If an attacker still has an active session, changing the encryption keys (AUTH_KEY, etc.) invalidates all logged-in sessions. Combined with password changes, this locks out residual access.

Exactly how to do it:

1. Go to the WordPress Salt Generator page: https://api.wordpress.org/secret-key/1.1/salt/
2. Copy the new keys.
3. Replace the lines in wp-config.php.
4. Update all admin passwords again (or force a password reset via email).
5. Reset API keys for third-party services (e.g., Google reCAPTCHA, Payment Gateway keys).

Pro script / template: “After updating salts, ask all users to log out and log back in. This prevents them from continuing with a stale session.”

📊 Expected results: Within 1 hour, all attacker sessions and backdoor logins are invalidated.

Phase 4: Hardening & Future Prevention

Cleaning a hacked site is costly. The real goal is to prevent it from happening again. Here’s how to bulletproof your WordPress installation—whether you run an agency in Dhanmondi, a shop in Mirpur, or a startup in Banani.

Tactic 4.1: Update Everything and Enable Auto Updates

Why this works: A significant 87% of WordPress attacks exploit vulnerabilities in outdated plugins and themes. Keeping everything current closes the front door.

Exactly how to do it:

1. Update WordPress core to the latest stable version.
2. Go to Dashboard > Updates and update all plugins and themes.
3. Enable auto-updates for core minor releases and security releases.
4. Set automatic background updates for plugins (using a plugin like Companion Auto Update).
5. Remove any unused plugins/themes.

Pro script / template: “Use a staging site to test major updates before rolling them out to production. For high-traffic sites, schedule updates during off-peak hours (e.g., 2 AM Bangladesh time).”

📊 Expected results: You’ll reduce your risk of a plugin-based exploit by over 90%.

Tactic 4.2: Install a Web Application Firewall (WAF)

Why this works: A WAF filters out malicious traffic before it reaches your server. Cloud-based WAFs (like Cloudflare) also hide your server IP and can block DDoS attacks.

Exactly how to do it:

1. Sign up for Cloudflare Free and change your nameservers.
2. Enable firewall rules to block SQL injection, XSS, and path traversal.
3. Install the official Cloudflare plugin for WordPress.
4. Set security level to “High” in the Cloudflare dashboard.
5. Enable “Under Attack” mode temporarily during an attack.

Pro script / template: “Cloudflare’s free plan gives you basic protection. For Bangladesh sites, it can significantly speed up page load times thanks to its CDN network.”

📊 Expected results: You’ll block 50–80% of attack attempts automatically, based on our experience.

Tactic 4.3: Enforce Strong Authentication and Access Limits

Why this works: Brute force attacks on the WordPress login page are common. Limiting login attempts and using 2FA adds a second layer that thwarts most attackers.

Exactly how to do it:

1. Install Wordfence and set the login security options (limit attempts to 10 in 5 minutes).
2. Enable two-factor authentication for all admin users (via plugin like “Google Authenticator”).
3. Disable file editing by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php.
4. Change the default admin username (create a new user with admin role and delete old).
5. Use an application password for third-party integrations.

Pro script / template: “If you share admin access with developers, use separate accounts and turn on 2FA for each. Never use FTP as the primary upload method—use SFTP instead.”

📊 Expected results: This will block 99.9% of brute-force attacks, according to Wordfence’s research.

Tactic 4.4: Implement a Backup and Monitoring Plan

Why this works: Even with prevention, you should always be able to restore to a clean state quickly. Automated backups and uptime monitoring give you a safety net.

Exactly how to do it:

1. Use a backup plugin (e.g., UpdraftPlus) to schedule backups to cloud storage (Google Drive, Dropbox, or an off-site server).
2. Back up both files and database daily (for dynamic sites) or weekly (for static sites).
3. Test your backup restoration process in a staging environment once a month.
4. Set uptime monitoring (e.g., UptimeRobot free) to alert you within 1 minute of a site going down.
5. Set up a regular security scan schedule (e.g., daily scan with Wordfence).

Pro script / template: “Store at least 3 recent backups, one on the server, one on cloud storage, and one locally. This protects you against ransomware, server failures, and accidental corruption.”

📊 Expected results: Recovery time from a hack drops from days to under 2 hours.

🏆 Real Case Study: How a Dhaka-Based Fashion Retailer Recovered from a Malware Hell

In early 2026, Dhaka Threads, a rapidly growing online clothing store based in Banani, Dhaka, discovered they had been hacked. Their homepage was redirecting visitors to a fake online casino, and Google had blacklisted them. Here’s how they recovered.

Before the hack, Dhaka Threads was generating ৳12,00,000 in monthly revenue and 15,000 visitors per month. The attack caused:

• 70% drop in sales in 72 hours
• 85% of organic traffic vanished
• Brand panic among their 20,000-email list

Exact strategy (implemented by Rafirit Station’s security team):

• Immediate containment: We moved Dhaka Threads to maintenance mode, rotated every password, and notified their host (a local Dhaka provider) within 30 minutes.
• Deep scan: Using Wordfence Premium and server-side grep commands, we located 14 malicious files in wp-content/upload, plus a rogue admin user created by the attacker.
• Full cleanup: We replaced WordPress core, reinstalled the theme and all plugins from official sources, and scrubbed 2,000 spam entries from the database.
• Hardening: Installed Cloudflare’s free CDN and WAF, enabled 2FA, and configured daily off-site backups to Google Drive.
• Re-syndication: We submitted a reconsideration request to Google Search Console and rebuilt the backlink profile using digital PR.
• Performance recovery: The rebuilt site loaded 1.8 seconds faster, improving both user experience and Core Web Vitals.

Results after 8 weeks:

• Revenue recovered to ৳12,00,000 in month 2, up 150% from the immediate post-hack slump.
• Organic traffic reclaimed 12,000 visitors/month, a 95% regeneration.
• The site stayed 99.99% uptime and passed a security audit from a third-party firm.

“Rafirit Station treated our emergency like a life-or-death situation. They cleaned our site in 4 days, but more importantly, they taught us how to keep it safe. We now have a firewall, backups, and peace of mind.” — Tanvir A., Founder, Dhaka Threads

See more Rafirit Station case studies →

✅ WordPress Malware Removal Checklist

Status	Task	Notes
✅	Back up your files & database	Use an off-site location
⚠️	Replace WordPress core	Fresh copy from wordpress.org
✅	Reinstall themes & plugins	From official sources
✅	Scan for malware with Wordfence	Run a full scan
⚠️	Remove suspicious admin users	Check Users > All Users
✅	Change all passwords	Including FTP & database
✅	Update your salt keys	Invalidates sessions
⚠️	Check .htaccess for redirects	Remove any suspicious lines
✅	Enable a web application firewall	Cloudflare free plan
✅	Set up automatic backups	Daily if possible
✅	Turn on two-factor authentication	Especially for admin users
⚠️	Remove unused plugins/themes	Lower attack surface
✅	Update everything to latest version	Core, plugins, themes
✅	Monitor your site uptime	Use UptimeRobot

❓ Frequently Asked Questions

Q: How do I know if my WordPress site is hacked?

Common signs include sudden redirects to suspicious websites, browser warnings, unknown admin users, strange content appearing on your pages, or a crash in search rankings. You can also run a free scan with Wordfence or Sucuri SiteCheck to detect known malware signatures.

Q: What should I do first if my WordPress site is hacked?

Act immediately: put your site in maintenance mode, rotate all passwords and API keys, notify your hosting provider, and download a backup of your files and database. These steps contain the damage before you begin cleaning.

Q: Can I remove malware from WordPress myself, or do I need a professional?

If you are comfortable with FTP and phpMyAdmin, you can remove most malware by replacing WordPress core files and cleaning the database. However, if you don’t have a clean backup or the hack is deep, a professional service is safer and faster. Websites cleaned by experts typically recover within 24–48 hours.

Q: What is the best WordPress malware removal plugin in 2026?

Wordfence and Sucuri are the two most trusted tools. Wordfence offers a robust free version with a powerful scanner and firewall, while Sucuri provides server-level scanning and a website security platform. Many developers also use the free iThemes Security plugin for hardening.

Q: How much does WordPress malware removal cost for a Dhaka-based business?

In Dhaka, freelancers charge between ৳5,000 and ৳20,000 for a basic cleanup, while full-service agencies can charge between ৳30,000 and ৳80,000 depending on the severity and whether they provide ongoing protection. Emergency 24-hour response services typically add an extra 50% premium.

Q: How long does it take to clean a hacked WordPress site?

Depending on the level of infection, a focused cleanup can take between 4 to 12 hours. If you’re restoring from a clean backup, it might take only 1–2 hours. Complex backdoors or infected databases can stretch the process to 3–5 days.

Q: How can I prevent WordPress malware attacks in the future?

Keep your core, plugins, and themes updated, remove unused plugins, use a web application firewall like Cloudflare, enable two-factor authentication, and schedule automated off-site backups. Conduct a monthly security audit to catch vulnerabilities early.

Q: Does Rafirit Station offer WordPress malware removal services?

Yes, Rafirit Station provides comprehensive WordPress malware removal and security hardening services for clients in Bangladesh and worldwide. We offer an emergency response plan, in-depth cleanup, and continuous monitoring. Contact us for a free consultation and get your site back online fast.

🎯 The Bottom Line

Getting hacked is not a matter of “if” but “when”—especially if you’re ignoring the basics. The counterintuitive truth is that most WordPress hacks are not sophisticated heists; they’re automated attacks that exploit lazy habits like outdated plugins far more often than zero-day exploits.

That’s good news. It means by following the phases above, you can not only remove malware but dramatically reduce your chances of being hacked again. The real cost of a hack isn’t just the cleanup bill; it’s the trust you lose with your customers. Spend the time (or hire experts) to harden your site now, and you’ll sleep better at night.

⚡ Your Next Step (Do This Today)

1. Log into your WordPress dashboard and run a full security scan to assess your current health.
2. Make a list of every plugin and theme you’re using, and check for pending updates.
3. Install a security plugin (we recommend Wordfence) and enable its firewall and login protection.
4. Set up a free Cloudflare account and move your DNS over—this gives you a CDN and WAF.
5. Schedule a weekly backup with UpdraftPlus to Google Drive or another off-site location.

💬 Drop “WordPress malware removal” in the comments and we’ll send you our free WordPress security checklist — no email required.