Is Your WordPress Website Redirecting, Hacked, or Suspended?

Step-by-Step Manual WordPress Malware Cleanup

If your site is hacked, you can attempt to locate and clean the malware manually using these steps. Be sure to take a complete backup of your files and database before attempting any modifications.

1. Identify Hacked Files and Code Injections

Check your server logs and look at modified files. Hackers often inject code into crucial system files:

• index.php
• wp-config.php
• wp-settings.php
• .htaccess (often used to inject redirects)
• Files within the wp-content/themes and wp-content/plugins directories

Look for obfuscated PHP functions such as eval(), base64_decode(), or gzinflate(). These are heavily used to hide backdoor access scripts.

2. Clean the Core Files

The cleanest way to restore a compromised core is to replace all core files with fresh, clean downloads from the official WordPress repository:

1. Download a zip of the exact same WordPress version you are running.
2. Extract the zip on your computer.
3. Delete the existing wp-admin and wp-includes folders on your server via SFTP or CPanel.
4. Upload the fresh wp-admin and wp-includes folders to your server.
5. Do NOT delete your wp-content folder or wp-config.php file, as these contain your website’s media, themes, plugins, and database connection settings.

3. Clean the wp-content Directory

• Plugins: Note down your active plugins, delete the plugin folders entirely, and reinstall them fresh from the WordPress directory.
• Themes: Delete old or unused themes. For your active theme, compare the files with a fresh copy to verify no malware script has been appended to functions.php or header files.
• Uploads: The uploads folder (typically organized by year/month folders) should only contain media files (images, PDFs, videos). Manually search for any .php files inside the uploads directory and delete them immediately.

4. Secure the Database

Check your database using phpMyAdmin for spam links or injected scripts:

• Inspect the wp_users table for unauthorized administrator accounts.
• Search for suspicious script tags inside your post contents in wp_posts.
• Review site URLs in the wp_options table to ensure they point to your own domain.

5. Harden WordPress Configuration

Once cleaned, apply these configuration edits to make it significantly harder for hackers to return:

• Add security salt keys in wp-config.php.
• Disable file editing in the WordPress admin by adding define('DISALLOW_FILE_EDIT', true); to your wp-config.php file.
• Implement a security firewall plugin (e.g., Wordfence or Cloudflare WAF).

Still feeling overwhelmed? Manually editing code can accidentally break database structures or leave hidden backdoors active. If you want a guaranteed fix, we highly recommend hiring our verified expert Alex Carter who will restore your website securely.