How to Remove Malware From a Website Without Losing Your Data

Last updated: August 2026

Stage 1: Identify what you're dealing with

Run three scans, because each sees different things: a remote scanner (Sucuri SiteCheck, sees what visitors and Google see), a server-side scanner (Wordfence, or your host's scanner, sees the files themselves), and Google's own verdict (Search Console → Security Issues, which lists the exact URLs Google flagged).

Malware hides in predictable places: recently modified core files (compare dates), PHP files sitting inside the uploads folder (uploads should contain no PHP, this alone catches many infections), plugin/theme files that differ from the official versions, unfamiliar admin users, and injected code at the top of index.php, wp-config.php, or .htaccess.

Stage 2: Back up the infected site (yes, really)

Before touching anything, download the complete infected site, files and database. Two reasons: if cleanup goes wrong you can start over instead of losing the site, and the infected copy lets you (or a professional) trace how the attacker got in. Also change every password now, hosting, admin, database, FTP, from a clean device. Cleaning files while the attacker still holds a valid password is mopping the floor with the tap running.

Stage 3: Clean

The reliable method is replacement over surgery:

1. Download fresh copies of WordPress core, and of every plugin and theme, in your exact versions, from official sources
2. Replace /wp-admin and /wp-includes entirely with the fresh copies
3. Replace each plugin and theme folder with its fresh copy (your settings live in the database and survive this)
4. What can't be replaced, wp-config.php, .htaccess, uploads, must be inspected by hand: compare wp-config against the sample file, regenerate .htaccess, and delete any PHP found in uploads
5. In the database, remove injected script tags from posts (searchable via the admin or phpMyAdmin) and delete rogue admin accounts

Then re-run the server-side scan until it comes back clean twice.

Stage 4: Close the door they used

An unclosed entry point guarantees reinfection, and repeat infections are what turn a bad week into a lost quarter. The usual suspects, in order of frequency: an outdated plugin/theme with a known vulnerability (update everything, remove abandoned ones), stolen or weak passwords (you changed them in stage 2; now add two-factor), nulled/pirated themes (delete them, they ship pre-infected), and cross-contamination from another site in the same hosting account (every site on the account needs the same cleanup, or the clean one gets reinfected from its neighbor).

Finish by hardening: firewall on, file editing disabled in wp-admin, PHP execution blocked in uploads.

Stage 5: Clear your name

If Google flagged the site: Search Console → Security Issues → Request Review, with a short honest description of what you cleaned. Reviews typically resolve within about 72 hours. If browsers or antivirus tools still warn, check the site against other blocklists (Sucuri's checker shows several at once), each has its own delisting process. Rankings usually recover over the following 2-8 weeks.

When to stop DIYing

Call in help if: the infection returns after cleanup (hidden backdoor), the site takes payments, Google flagged you and every day costs revenue, or the scans disagree and you can't tell clean from infected. Professional cleanup runs $150-$1,000 flat in the US market; ours is quoted flat after a look at the scans, and every maintenance plan we sell exists to make this article something you never need twice.

FAQ

Can I just restore a backup instead of cleaning? Only if the backup predates the infection with certainty, and you still must do stage 4, or the same hole gets re-exploited within days. Many infections run silently for weeks before showing symptoms, which contaminates recent backups.

Will my host clean malware for me? Some do (managed WordPress hosts often include it); budget hosts typically just suspend the infected account and hand the problem back to you, sometimes with a paid "SiteLock" upsell.

How do I know the cleanup is really complete? Clean results from both a remote and a server-side scanner, no unexplained admin users, no PHP in uploads, a passed Google review, and no reinfection after 30 days. Set a calendar check.

Do I need to tell customers? If customer data may have been accessed (the site stores accounts, orders, or form submissions), notification laws in most US states and Canada may apply. When in doubt, get legal advice, quietly hoping is not a compliance strategy.