How to Scan Your WordPress Site for Hidden Malware

WordPress core is well maintained and patched quickly. Nearly every compromised WordPress site gets that way through an outdated plugin or theme, a weak or reused password, or an already-exposed hosting account. Once in, malware hides: injected code in theme files, fake admin users, redirects that fire only for search-engine visitors, or PHP files disguised as images in the uploads folder. This guide covers how to find it, remove it, and stop it returning.

Last updated: 2026. Plugin names and scanning behaviour verified against current versions.

Signs your site may already be infected

• Search results for your domain show spam titles (pharmacy, casino, replica goods) that do not exist on the site.
• Visitors arriving from Google are redirected elsewhere while you, logged in, see the site normally.
• Search Console shows a “Security issues” notice or the browser flags the site as deceptive.
• Admin users you did not create, or plugins and files you did not install.
• Sudden spikes in outbound mail or your host warning about resource usage.

None of these is proof on its own, but any of them justifies a full scan today rather than next week.

Download and install an anti-malware protection plugin

Every site should run one security plugin with a firewall and login protection. Two free options cover most needs: Wordfence Security (endpoint firewall, malware scanner, brute-force protection) and Solid Security (formerly iThemes Security; two-factor authentication, file-change detection, login hardening). Run one, not both. Hosting-level protection is a good complement but cannot see inside WordPress.

Prevention beats cleanup, but no plugin blocks everything, so the next step is a deliberate scan even on a protected site.

Perform a scan using a firewall & malware scan plugin

Start with an external check that does not depend on your site being honest with you: Sucuri SiteCheck fetches your pages as a visitor and reports blocklist status, injected scripts and outdated software. Then run the internal scan. In Wordfence, go to Wordfence > Scan > Start New Scan. It compares core, theme and plugin files against the wordpress.org originals, flags differences, and looks for known malicious patterns in files, posts and comments. Jetpack Protect is a lighter vulnerability checker, and MalCare scans off-server, which matters on shared hosting where heavy scans time out.

Also check manually: any .php file in wp-content/uploads (there should be none), long encoded strings or eval() calls in wp-config.php or your theme’s functions.php, and unfamiliar administrators under Users > All Users.

Deleting the malware

A good scanner ranks findings by severity. Deal with anything marked critical or high first; these are usually backdoors that let the attacker return after cleanup. Wordfence offers Repair for modified core or plugin files (restoring the wordpress.org original) and Delete for files that should not exist. Prefer repair where offered; deleting a modified core file breaks the site.

Before you delete anything, take a fresh backup of the current state and store it off the server, labelled as infected, so you can recover a file if the cleanup removes something the site needed. If you have a clean backup from before the infection and know roughly when it happened, restoring that and then updating everything is often faster than picking through files. For database infections (spam links in posts, redirect code in options), remove the injected code rather than the whole post.

Updating your WordPress account

Cleaning without closing the entry point means reinfection within days. After removal:

• Update WordPress core, every theme and every plugin. Delete plugins and themes you no longer use; deactivated code is still attackable.
• Reset all passwords: WordPress admin, database (update wp-config.php to match), hosting panel, SFTP. Rotate the salts in wp-config.php so existing sessions are logged out.
• Remove any users you do not recognise and enable two-factor authentication for every administrator.
• Confirm the site runs PHP 8.2 or newer and enable auto-updates for minor core releases (on by default in WordPress 6.x).
• Request a review in Google Search Console if the site was flagged, and check that your host has not suspended outgoing mail.

Afterwards, scan on a schedule (weekly is reasonable for a small site), act on update notifications, and check the user list monthly. Most malware that returns does so because a step above was skipped.

Which Canyon theme fits

A theme is part of your attack surface. Ours are reviewed by the wordpress.org theme team, bundle no premium plugins that fall out of date, and update through the normal WordPress updater. If you are rebuilding after a compromise, Bloge for a blog or Business Way for a business site are both maintained for current WordPress and PHP 8.x.