WordPress malware clean-up: a considered recovery plan

Contain the immediate problem

If the site is exposing visitors to malicious content, work with your host to restrict access or serve a safe maintenance page. Note the symptoms, affected pages and timing. Coordinate the response with the people who manage the website.

This is an overview of the recovery process. The exact work depends on the installation and the scope of the incident.

Preserve a separate incident copy

Keep a restricted copy of the affected files, database and relevant logs before clean-up changes the evidence. Label it clearly as compromised and keep it separate from trusted backups. It is evidence to inspect, not a recovery image to put straight back online.

Work out what was affected

Review accounts, components and changes across the site. Look beyond the obvious page or file: a compromise may involve database content, scheduled tasks or another site sharing the environment.

Do not treat a particular function name or unfamiliar file as proof on its own. Compare against trusted versions and understand what the code is doing.

Choose a recovery route

A known-clean backup can be useful if you can establish when the compromise began. Otherwise, replacing affected software from trusted sources and carefully reviewing the remaining content may be necessary.

Either route still needs an investigation into the entry point. Restoring the same vulnerable setup can leave the original problem in place.

Remove persistence and address the cause

Review unauthorised accounts, modified files and other ways access might be retained. Update or replace vulnerable components and remove software you no longer need. Obtain WordPress and third-party packages from their official or otherwise trusted distribution sources.

Coordinate credential changes, session revocation and access reviews with the people responsible for the environment. Use a trusted device and a secure handover process.

Test before reopening

Check the public site, administration and important journeys such as enquiries, purchases and email. Review the recovered state with appropriate integrity and security checks. If a provider has issued a warning, follow its review process after addressing the issue.

A clean scan is useful evidence, but it does not by itself prove every problem has been found.

Make the next incident easier to handle

Agree who owns updates, monitoring and recovery. Keep protected backups, check that restoration works and limit account access to what each person needs. A practical maintenance routine is more useful than a collection of tools with nobody looking after them.

Document the work completed and any remaining concerns. Security measures reduce risk; they cannot promise a site will never be compromised again.

Further reading: WordPress security hardening ↗ and incident guidance ↗.