How malware cleanup works

The short answer

Malware cleanup is a four part job: find every piece of malicious code, remove it, close the hole it came through, and confirm it stays gone. Skipping any part is how sites get reinfected.

On WP Alpha every site is scanned daily by Imunify and cleanup is included on every plan, so your first move is to contact support rather than start deleting files yourself. The steps below explain what happens and what you can safely do in the meantime.

What it means

Malware is any code placed on your site to do something you did not intend: redirect visitors, inject spam links, host phishing pages that imitate a bank, send email, or mine cryptocurrency on your server. It arrives as new files, as extra lines added to files you already had, or as entries in the database.

A cleanup works by comparison. WordPress itself, and every plugin and theme from the official directory, has a known clean copy. A scanner compares each file on your site with the clean version and flags anything added or changed. What is left over (uploads, custom code, the database) is inspected by hand or with pattern matching for the tell-tale shapes of malicious code, such as long scrambled strings that decode and run themselves.

Removing the code is the visible part. The part that decides whether the fix lasts is finding how the attacker got in and closing that door: an outdated plugin, a stolen password, a leftover administrator account. A scanner alone does not do that.

Common causes

• A plugin or theme with a known hole that was not updated in time. Most infections start here.
• Stolen or guessed login details for WordPress, SFTP or the database, often reused from another service that was breached.
• Software from untrusted sources, such as pirated premium plugins or themes that already contain a backdoor (a hidden way back in that does not need a password).
• Cross-contamination from another site in the same hosting account that was infected first.
• A backdoor from a previous infection that an earlier cleanup missed.

How to fix it

1. Scan. Run a scan with your host’s scanner or a reputable security plugin. Treat the results as a starting list, not the full picture. (Host independent.)
2. Replace WordPress core. Dashboard > Updates > Re-install Now swaps every core file for a fresh copy. Your content, settings and uploads are untouched.
3. Replace plugins and themes. For each one, delete it under Plugins > Installed Plugins (or Appearance > Themes) and install a fresh copy from Plugins > Add New Plugin. Settings are normally kept in the database and survive this. For paid plugins, download a fresh copy from the vendor.
4. Inspect what the scanner cannot compare. In File Manager, open wp-content/uploads and remove any .php file. Open .htaccess and wp-config.php and look for lines you do not recognise, especially anything mentioning base64 or eval. Check wp-content/mu-plugins, a folder for “must use” plugins that WordPress loads silently and never offers to deactivate.
5. Check the database. In phpMyAdmin, search the wp_options and wp_posts tables for <script tags pointing at domains you do not use. Injected scripts in post content are a common redirect method.
6. Remove unknown access. Users > All Users: delete unknown administrators. Users > Profile: revoke unused Application Passwords. In the management console (Plesk with WP Toolkit), remove any FTP or SSH user you did not create.
7. Change every credential. WordPress passwords, the database password (update it in wp-config.php too), SFTP, and the salts block in wp-config.php, which signs login cookies.
8. Update everything under Dashboard > Updates, and delete any plugin that no longer receives updates.
9. Verify. Re-scan, browse the site in a private window and from a phone, and check Google Search Console under Security Issues. If Google flagged the site, request a review once it is clean.
10. Keep a record of what was found and changed. If anything comes back, that record is the fastest way to find what was missed.

On WP Alpha

Every WP Alpha site is scanned daily by Imunify, and cleanup is included on every plan. When a scan finds something, or when you report a problem, support handles the removal. VERIFY: typical turnaround for a cleanup.

Backups run every two hours and are kept for 30 days, so a known clean copy from before the infection is usually available, and a restore of a single file or the whole site can be queued from the management console (Plesk with WP Toolkit). Updates to WordPress, plugins and themes are tested on a staging copy before they go live, which closes the most common entry route without the risk of an update breaking the site. A business grade web application firewall with brute force protection sits in front of every site, and support is on 24/7 live chat with an urgent escalation form for active infections.