WordPress Malware Removal — Clean & Un-flag Your Site

unflagdomain Team·UPDATED June 23, 2026

WordPress malware removal means finding and deleting the malicious files attackers injected, then closing the hole they used to get in. You can do it three ways: a security plugin, manual cleanup, or a professional service. After your site is clean, you still have to clear any security blocklist flags separately.

TL;DR: WordPress runs about 43.4% of all websites (W3Techs, 2025), and the vast majority of infected CMS sites Sucuri cleaned were WordPress (Sucuri, 2023). To remove malware: scan with a plugin, delete injected files, harden logins and update everything, then request reviews to lift any blocklist flags. There's no instant fix.

This guide is written for site owners, not developers. You won't need to touch much code — a good security plugin handles most of the work. We'll cover the three removal methods, then how to clear the warnings that follow a hack. Let's get your site clean and trusted again.

What is WordPress malware and why is your site infected?

WordPress malware is malicious code attackers inject into your files or database — spam pages, hidden redirects, phishing forms, or backdoors. Your site is infected because WordPress is the web's biggest target: the vast majority of infected CMS sites Sucuri cleaned ran WordPress (Sucuri, 2023). It's not carelessness — it's the predictable cost of running the most popular CMS.

The single biggest entry point is out-of-date software. Patchstack reported that 97% of the vulnerabilities it added in 2023 came from plugins, with themes adding more — WordPress core itself accounted for under 1% (Patchstack, 2024). An abandoned plugin you forgot you installed is the most common way in.

Most owners assume "I keep WordPress updated, so I'm safe." But core updates aren't the problem. The risk lives in the dozen plugins and the theme you stopped thinking about years ago. A single dormant, unpatched plugin is enough. In our experience running unflag, by the time a site reaches us it's almost never WordPress core that triggered the flags — it's a forgotten add-on that let the injected code through.

So an infection isn't a verdict on your habits. It's what happens when widely-used software meets attackers who automate their hunting. The good news: the same predictability means the cleanup is well-understood. For the bigger picture on what a hack looks like across your whole site, see our guide on how to clean a hacked website step by step.

What are the signs your WordPress site has malware?

Common signs include browser warnings, unexpected redirects, spam pages in Google, and a sudden traffic drop. The clearest signal is an external one: Google Safe Browsing protects billions of devices and shows warnings on flagged sites (Google Safe Browsing, 2025). If visitors see a red "deceptive site" screen, your site is almost certainly compromised.

Watch for these symptoms:

  • Browser or search warnings. A red full-page screen, or a "This site may be hacked" label under your listing in Google results.
  • Strange redirects. Visitors land on pharma, gambling, or scam sites instead of your pages.
  • Unfamiliar content. New pages or posts you didn't create, often in another language.
  • Admin users you don't recognize. A classic backdoor attackers leave behind.
  • A sudden traffic collapse. Search engines de-rank or warn on flagged sites fast.

In our experience running unflag, the redirect is the symptom people notice last — because it often only fires for visitors from search engines or mobile, not for a logged-in admin checking the homepage. When we scan a domain across our catalog of 124 security vendors, we routinely see a site flagged by a dozen blocklists while its owner still swears the homepage looks fine. Always test in an incognito window from your phone.

If you're seeing the red warning specifically, our focused walkthrough on the deceptive site ahead warning on WordPress covers exactly that screen and how to clear it.

How do you remove malware from WordPress?

You remove WordPress malware in three ways: a security plugin (easiest), manual cleanup (free but technical), or a professional service (fastest for serious infections). Whichever you pick, the work is the same — find the malicious code, delete it, and remove backdoors. With WordPress making up the vast majority of infected CMS cleanups (Sucuri, 2023), the tools are well-tuned for it.

Before you start, back up your site. Even an infected backup is worth having if a cleanup step goes wrong. Then choose your method below.

Method 1: Use a WordPress security plugin

A security plugin is the right starting point for most owners. Install a reputable one — Wordfence, Sucuri, or MalCare are common choices — and run a full malware scan. The scanner flags injected PHP files, modified core files, suspicious redirects, and unfamiliar code in your theme's functions.php or header.php.

Most of these plugins include a one-click cleanup or quarantine feature. Let it remove or isolate what it found, then re-scan to confirm the site comes back clean. Write down what it flagged — you'll need that record when you request blocklist reviews later. This path needs no coding and clears the majority of common infections.

Method 2: Remove the malware manually

Manual removal is free but technical, and best if you're comfortable in your hosting file manager and database. The principle is simple: replace anything you can with known-good copies. Delete WordPress core and reinstall it fresh from the dashboard, then reinstall plugins and themes from official sources rather than trusting the existing files.

Then hunt the leftovers:

  • Scan custom files in wp-content/uploads and your theme for injected scripts.
  • Check the database — the wp_options and wp_posts tables for injected links or scripts.
  • Delete unknown admin users in the Users screen.
  • Inspect .htaccess for malicious redirect rules.

In our experience running unflag, the step owners skip most often is the database. People reinstall core, feel done, and miss an injected row in wp_options that re-infects within hours. We see the downstream effect of this directly: a domain comes back to us flagged again across the same blocklists, because the underlying site was never fully cleaned. If a reinfection keeps happening, the database is where to look — we clear blocklist flags, but a dirty database will simply earn them back.

Method 3: Hire a professional cleanup service

A professional service is the fastest route for a serious or repeat infection. Companies like Sucuri or Wordfence will clean the site for you, usually within hours to a day, and many guarantee removal of the malware itself. This is worth it if the site earns revenue, the infection keeps returning, or you simply don't want to touch server files.

Expect to pay an annual fee rather than a one-off charge in most cases. The trade-off is speed and confidence: they do this all day, and they handle the database and backdoor hunting that owners tend to miss.

How do you keep WordPress malware from coming back?

You prevent reinfection by closing the hole the attacker used — because cleaning alone doesn't fix the vulnerability. Since plugins and themes account for the overwhelming majority of WordPress vulnerabilities (Patchstack, 2024), updating and trimming them is the highest-impact thing you can do. A clean site running the same outdated plugin is an open invitation.

Work through this hardening checklist after every cleanup:

  • Update everything. Core, every plugin, every theme to the latest version.
  • Delete what you don't use. Inactive plugins and themes still get exploited — remove them entirely.
  • Remove nulled (pirated) plugins. These are a frequent malware source; replace them with legitimate copies.
  • Reset all passwords. WordPress admins, hosting, FTP, and the database.
  • Turn on two-factor authentication for every admin account.

Think of this as the part that actually keeps malware gone. Cleaning removes today's infection; hardening prevents the next one. Skip it, and a reinfection is a matter of time — and so is another round of blocklist flags.

How do you clear the blocklist flags after cleaning WordPress?

Once your site is genuinely clean, you have to ask each security vendor to re-check it — flags don't lift on their own. For Google, this is manual: open Google Search Console, find the Security Issues report, confirm the problems are fixed, and submit a review request. There's no button that clears it instantly and no automated API.

Google re-crawls on its own schedule, usually within a few days for a clean site. But Google is rarely the only one flagging a hacked WordPress site. Antivirus vendors, browser filters, and reputation services each maintain their own blocklists — and each has a separate review process. Chasing every form by hand is slow and easy to get wrong.

The trap here is thinking "I cleared Google, I'm done." Owners often clean the site, lift the Search Console warning, then discover weeks later that a different vendor is still blocking their email or a corporate firewall is still warning visitors. The flags are independent; you have to clear each source. In our experience running unflag, this is the single most underestimated part of recovery — when we scan a hacked domain we typically find it flagged across multiple vendors at once, spanning antivirus engines, web blocklists, and search-engine filters, each with its own separate review channel.

That's the gap this tool fills. After you've cleaned and hardened your site, unflagdomain emails every flagging vendor a removal request for €39, with your own address as the reply-to. We don't scan or clean your site — this guide is the cleanup — but once it's done, we make sure the request reaches each vendor and re-send it if it bounces. No one can guarantee a vendor will delist, but we guarantee the request is sent. To understand the wider flagging picture first, our overview of how to remove a website from blocklists walks through who flags sites and why.

A clean site is a trusted site again

WordPress malware feels alarming, but the path out is well-worn. Scan with a plugin, delete the injected files, then harden your logins and update everything so it can't happen again. With WordPress behind the vast majority of infected CMS cleanups (Sucuri, 2023), you're walking a path thousands of owners have already cleared.

The last mile is reputation. A clean site still wears its old warnings until each vendor re-checks it — Google through a manual Search Console review, and every other blocklist through its own process. Clean thoroughly, harden properly, then make sure the removal requests reach everyone flagging you. Do all three and your site is trusted again, not just fixed.

// FAQ

  • Use a free security plugin like Wordfence to scan, then remove what it flags. For deeper cleanup, reinstall WordPress core and all plugins from official sources, delete unknown admin users, and check your database and .htaccess for injected code. Free, but technical and time-consuming if the infection is serious.

  • Often yes for common infections. Plugins like Wordfence, Sucuri, or MalCare scan and quarantine injected files automatically. They can miss database injections and backdoors in serious cases, though. Always re-scan after cleanup and check for unknown admin users. For repeat infections, a professional service is more reliable.

  • Most professional services charge an annual fee rather than a one-off, typically a few hundred euros or dollars per year, often bundled with monitoring. Companies like Sucuri and Wordfence clean the site for you, usually within hours to a day, and many guarantee removal of the malware itself.

  • No — they're separate. Cleaning removes the malware, but Google's warning stays until you request a review. Open Google Search Console, find the Security Issues report, confirm the fixes, and submit a review request. It's manual, with no instant button, and Google re-crawls on its own schedule, usually within a few days.

  • Re-scan with your security plugin until it reports zero issues, then test your site in an incognito window from a phone to catch search-only redirects. Check for unfamiliar admin users and new content. If symptoms or flags keep returning, an injected database row or backdoor is likely still present.