Not many people have time, or want to Install wordpress offline (local setup) and download a bunch of malware plugins and scanners to play around, or have fun and see which plugins are best.
Malware removal tips at a glance
- Delete old themes and plugins
- Replace two of the three major WordPress folders
- Backup website often so you can easily restore PRE hack
- Review users on wordpress website, double-check and delete any extra admin users
- *upgrade latest version of plugins and wordpress core (non beta)
- updates can break perfectly working websites, be careful…
- Download entire wordpress website to your PC, perform local virus / malware scan and re-upload
- Drag & drop old (potentially infected folder) into a subfolder outside of
public_html - FTP into website and make sure you don’t have folder OR file permission set to 777
- Submit website to google for malware detection[1]
- Perform integrity check using WP Cerber Addon
- Download fresh wordpress.org download and replace existing install then swap credentials in wp-config.php file and finally change password to database and WP Admin
Frequently asked questions
How do I remove malware from my WordPress site myself?
Start by backing up, then delete unused themes and plugins and remove any admin users you don't recognize. Replace core WordPress folders with a fresh copy from wordpress.org, check that no files or folders are set to 777, and change your database and admin passwords.
Should I delete old WordPress themes and plugins after a hack?
Yes. Old themes and plugins you aren't using are an easy way in, and they can hide infected files. Delete them, then update the ones you keep to the latest stable version. Just be careful, because updates can sometimes break a site that was working fine.
How do I check for hidden admin users after a WordPress hack?
Open the Users list in WordPress and review every account with admin rights. Delete any admin users you didn't create or don't recognize. Attackers often leave an extra admin behind so they can get back in after you think the site is clean.
Can I scan my WordPress files for malware on my own computer?
Yes. Download the entire WordPress site to your PC, run a local virus and malware scan, then re-upload the clean files. Move the old, possibly infected folder into a subfolder outside public_html so it can't run while you work.
What's the easiest way to recover from a hacked WordPress site?
Restore a backup from before the hack. That's why backing up often matters. If you have a clean copy, you can roll back quickly instead of hunting for every bad file. If you don't, call or text (720) 722-3227 for a free quote on cleanup.
Sources
- Security issues report — Search Console Help. Accessed October 30, 2026. ↩
