Step-by-step guide

Website malware removal: find it and get rid of it

Q: How do I remove malware from my website manually?

Take a backup of the infected site, then compare your core, plugin and theme files with fresh copies from the official source and replace any that differ. Delete files you do not recognise, especially PHP files in upload folders. Search the database for script and iframe code you did not add, remove unknown admin users, check rewrite rules and cron jobs, then change every password and key and update everything.

Q: Can I remove website malware for free?

Yes, if the infection is simple and you are comfortable with files, a database and the command line. Free scanners and WP-CLI checksum commands can find modified files. The risk is missing a backdoor: if one file is left behind, the site is reinfected within days. If the site takes payments or holds customer data, paying a professional is usually cheaper than a second incident.

Q: How do I know the malware is really gone?

Core, plugin and theme files match the official copies, there are no unknown PHP files in upload folders, no unknown admin users, no strange rewrite rules or cron jobs, and the site is clean when you load it as a visitor from a Google search result on a phone. Then watch it: scan again after 24 hours and after a week, and check Search Console for new warnings.

Q: Should I restore from a backup or clean the files?

Restoring is faster if you have a backup from before the infection, and you know the date. Restore it, then update everything and close the hole, because the backup contains the same vulnerable code the attacker used. If you do not know when the infection started, or the backup might already be infected, clean the files as well.

Q: Why does the malware keep coming back?

Almost always a backdoor was left behind, the original hole was never closed, or a stolen password is still valid. A common cause is an old plugin that was never updated. Another is a second infected site on the same hosting account that reinfects the first. Cleaning without finding the entry point only buys a few days.

Q: Will removing the malware remove the Google warning?

No. Google keeps showing the warning until you ask for a review. After you clean the site, open the Security Issues report in Search Console, confirm the fixes and request a review. It usually takes from a day to a couple of weeks.

Q: How long does malware removal take?

A single small infected site can be cleaned in a few hours. A site with several backdoors, a hacked database and a warning from Google can take a few days, plus the time Google takes to review. Finding and closing the entry point is the part that decides whether you need to do it again.

If your site redirects visitors, shows spam or got flagged by Google, it probably has malware. Here is how to confirm it, clean it safely and, most important, stop it coming back.

By the Bug Circuit security team · Last updated October 22, 2026

How do you remove malware from a website? Seven steps: 1. contain it (maintenance mode), 2. back up the infected site, 3. find what is infected, 4. clean it or restore a clean backup, 5. update everything and change every password and key, 6. find and close the hole they used, 7. clear any Google warning and keep watching. Step 6 is the one most people skip, and it is why infections return.

Signs your website has malware

Visitors are redirected to spam, casino or pharmacy sites, often only when they arrive from Google or on a phone.
Google or your browser warns people: “This site may be hacked”, “Deceptive site ahead” or a Search Console Security Issues message. See the “may be hacked” warning and the “Deceptive site ahead” warning.
Search results show strange pages or Japanese, Chinese or pharmacy text under your domain, as in the Japanese keyword hack.
Your host suspends the site or your email starts landing in spam folders.
Admin users you did not create, files changed at odd hours, or a sudden jump in server load.

Not sure yet? The free website security check and the is my website hackable guide show what is exposed from the outside.

Where website malware hides

Most infections use a handful of places. Check each one.

Common hiding places for website malware and what to look for
Where	What to look for
Core, plugin and theme files	Files that differ from the official copy, or extra PHP files next to them.
Upload folders	Any .php file in wp-content/uploads or a similar folder. Uploads should hold images and documents only.
.htaccess and config files	Rewrite rules that send search visitors to another domain, or code added at the top of wp-config.php or index.php.
The database	Script or iframe code inside posts, widgets and options that you did not add. Unknown admin users.
Scheduled tasks	Cron jobs or scheduled actions that re-download the malware after you delete it.
Fake plugins and mu-plugins	Plugins with random names, or files in the must-use folder you did not put there.

Step by step: how to remove it

1. Contain it

If visitors are being redirected or served malware, turn on maintenance mode or take the site offline and tell your host. Keeping an infected page live harms your visitors and your search ranking.

2. Back up the infected site

Copy the files and the database exactly as they are. You want this evidence, and it lets you undo a cleanup mistake. Keep your last known-clean backup separate and untouched.

3. Find what is infected

On WordPress, WP-CLI can compare your files with the official copies and list admin users:

wp core verify-checksums and wp plugin verify-checksums --all report files that differ.
wp user list --role=administrator shows admin accounts. Remove any you do not recognise.
find wp-content/uploads -name "*.php" lists PHP files in the uploads folder, which should not exist.
find . -name "*.php" -mtime -14 lists PHP files changed in the last 14 days.
wp db search '<iframe' --all-tables finds injected iframes in the database. Search for <script too.

On other platforms the idea is the same: compare with a clean copy, look at recently changed files, and look for code you did not write. Be careful with search patterns such as eval(base64_decode: some legitimate plugins use them, so check each hit before you delete it.

4. Clean it or restore a clean backup

The safest cleanup is to replace, not edit: reinstall WordPress core with wp core download --force --skip-content, reinstall plugins and themes from their official source, and delete files you cannot account for. If you have a backup from before the infection, restoring it is faster. Either way, the next steps are not optional.

5. Update everything and rotate every secret

Update the CMS, plugins and themes, and delete anything abandoned or “nulled” (pirated). Then change the hosting panel, FTP or SFTP, database, admin and API credentials, and generate new WordPress security keys. Assume any password that was on the server is known.

6. Find and close the entry point

Malware is the symptom. The cause is usually an outdated plugin, a weak or stolen password, or an unsafe upload form. Look at your access logs for the first strange request, and check what changed around that date. This is the step that decides whether the site is clean for good. A manual security audit is built for exactly this: a person looks for the weaknesses an attacker could use.

7. Clear warnings and keep watching

If Google flagged the site, open the Security Issues report in Search Console and request a review once it is clean. Then watch it: scan weekly, check for new files and admin users, and turn on alerts for file changes.

Do it yourself, use a plugin, or hire someone?

Ways to remove website malware compared
	Do it yourself	Scanner plugin	A professional
Best for	A simple infection and a technical owner	Finding modified files quickly	Shops, client sites and repeat infections
Main risk	A missed backdoor	Deleting what it flags without finding the cause	Paying for a cleanup that skips the root cause
Finds the entry point?	Only if you look for it	Rarely	Ask before you hire: it should be included
Time	Hours to days	Minutes to scan, then you still clean	Usually hours to a few days

For typical prices, see what it costs to fix a hacked website. If your site is on WordPress and keeps getting reinfected, read why a WordPress site keeps getting hacked.

How Bug Circuit helps

Circuit, $49 one-time: a security expert audits your site by hand and writes a report of every weakness with the exact fix, so you can close the hole the attacker used.
Signal, $147 every 3 months: everything in Circuit, plus we fix the high and critical issues with you, re-test, run weekly checks and include one hack cleanup a year.
Free check: run the passive scan first to see what is exposed. Nothing touches your site.

See pricing for the details. There is a 14-day money-back guarantee if testing has not started.

Frequently asked questions

How do I remove malware from my website manually?

Take a backup of the infected site, then compare your core, plugin and theme files with fresh copies from the official source and replace any that differ. Delete files you do not recognise, especially PHP files in upload folders. Search the database for script and iframe code you did not add, remove unknown admin users, check rewrite rules and cron jobs, then change every password and key and update everything.

Can I remove website malware for free?

Yes, if the infection is simple and you are comfortable with files, a database and the command line. Free scanners and WP-CLI checksum commands can find modified files. The risk is missing a backdoor: if one file is left behind, the site is reinfected within days. If the site takes payments or holds customer data, paying a professional is usually cheaper than a second incident.

How do I know the malware is really gone?

Core, plugin and theme files match the official copies, there are no unknown PHP files in upload folders, no unknown admin users, no strange rewrite rules or cron jobs, and the site is clean when you load it as a visitor from a Google search result on a phone. Then watch it: scan again after 24 hours and after a week, and check Search Console for new warnings.

Should I restore from a backup or clean the files?

Restoring is faster if you have a backup from before the infection, and you know the date. Restore it, then update everything and close the hole, because the backup contains the same vulnerable code the attacker used. If you do not know when the infection started, or the backup might already be infected, clean the files as well.

Why does the malware keep coming back?

Almost always a backdoor was left behind, the original hole was never closed, or a stolen password is still valid. A common cause is an old plugin that was never updated. Another is a second infected site on the same hosting account that reinfects the first. Cleaning without finding the entry point only buys a few days.

Will removing the malware remove the Google warning?

No. Google keeps showing the warning until you ask for a review. After you clean the site, open the Security Issues report in Search Console, confirm the fixes and request a review. It usually takes from a day to a couple of weeks.

How long does malware removal take?

A single small infected site can be cleaned in a few hours. A site with several backdoors, a hacked database and a warning from Google can take a few days, plus the time Google takes to review. Finding and closing the entry point is the part that decides whether you need to do it again.

Keep reading

My website was hacked: what to doFirst-response steps after a compromise.How to fix a hacked WordPress siteThe WordPress-specific cleanup.Cost to fix a hacked websiteWhat cleanup companies charge.Search Console security issues warningRequest a review once the site is clean.WordPress site keeps getting hackedFind the root cause and stop reinfection.Japanese keyword hack on WordPressFind and remove the spam-SEO injection."This site may be hacked" warningWhat Google means and how to clear it.

Find out how they got in

Run the free passive check on your domain. No login, no card, nothing touches your site.

Ready for the full manual audit? See pricing