How to Fix WordPress Malware Infection: Complete Guide for

“Hey, my website got a virus! It keeps redirecting to a gambling site. I didn’t do anything — how did this happen?”

That was the call I got from one of my shared hosting customers. She was panicking — her online skincare store was popping up gambling ads every time someone opened it from their phone. What made it worse: Google Chrome was displaying a big red warning: “Deceptive site ahead — this website may harm your computer.”

This customer was completely non-technical. She only knew how to open WordPress in a browser, write articles, and upload product photos. She never installed plugins herself, never edited code. So she was genuinely confused: “How did I get a virus if I didn’t do anything?”

I answered with a simple analogy: “Think of it this way — your house didn’t get robbed because you left the door unlocked. Your house got robbed because your apartment neighbor had a problem — and because you live in the same building, the burglar could get into your unit too.”

And that was exactly right. After checking, the hosting server that held this customer’s website was indeed hit by mass malware — dozens of other cPanel accounts on the same server were also infected. It wasn’t my customer’s fault. She didn’t click any suspicious links or install pirated plugins. She became a victim because she shared a server with infected accounts.

In this article, I’ll explain everything from start to finish: what WordPress malware is, how it gets in, how to fix it step by step (including fresh WordPress upgrade), and how to prevent it from happening again. I’ll use everyday analogies throughout to make it easy to understand — even if you’re completely non-technical.

Difficulty: Beginner
Last Updated: July 2026
Tested On: WordPress 6.x, cPanel/WHM + CloudLinux, Monarx Security, Imunify360

What Is WordPress Malware? Real-Life Analogies

Before we discuss how to fix it, let’s understand what malware is using simple analogies.

Analogy 1: Your Home Was Burglarized

Your website is like a house. You have furniture (article content, product images), a safe with money inside (customer data, admin password), and an entrance (WordPress login page).

Malware is like a burglar or home intruder. This burglar enters your house and does various things:

• Plants hidden cameras → steals your customer data (credit cards, emails, passwords)
• Opens the door for more burglars → infects WordPress files so other attackers can enter anytime
• Changes your house’s appearance → adds gambling ads, redirects to scam sites, suspicious pop-ups
• Steals your house key → takes your admin password, so the burglar can enter even after you “change the locks”

Analogy 2: Fire in an Apartment Building (Shared Hosting)

Now imagine you live in an apartment building — there are many units (cPanel accounts) in one building (server). Each unit has its own door, but the walls between units aren’t fireproof.

Malware in shared hosting is like fire in an apartment building. If one unit catches fire and the firefighters aren’t fast enough, the fire can spread to other units through ventilation, ceiling, or thin walls.

So if another cPanel account on the server is infected with malware, and the server’s firewall isn’t sophisticated enough to block it, the malware can spread to your account too — even though you didn’t do anything wrong.

This isn’t an excuse. It’s a technical fact that happens frequently in shared hosting. And that’s why I’ll also discuss prevention from your side, even though the main threat comes from your server neighbor.

How Does Malware Get In? 7 Main Entry Points

Many customers ask: “I didn’t do anything, so how did this happen?” Here’s a complete explanation of how malware can enter a WordPress website:

1. Server / Shared Hosting (Most Common for Non-Technical Users)

Analogy: You live in an apartment. Your upstairs neighbor leaves the gas stove on, the fire spreads through the ventilation, and your apartment catches fire too.

In shared hosting, all cPanel accounts sit on the same server. If another account gets infected — whether from installing pirated plugins, weak passwords, or another vulnerable CMS — malware can spread horizontally to other accounts.

This is the #1 cause for customers who “didn’t do anything.”

2. Pirated Plugins or Themes (Nulled)

Analogy: You buy a designer bag for $3 at a flea market. It looks great on the outside, but inside there’s a hidden pocket that anyone can access without your knowledge.

“Nulled” (pirated) plugins and themes often contain malware from the start. The creators intentionally embed backdoors so they can access thousands of websites that install the pirated plugin. You think you got it “free” or “cheap,” but you actually opened the front door for burglars.

3. Outdated WordPress / Plugins / Themes

Analogy: Your house door uses an old lock whose keys are widely available on the internet. Burglars just need to find the right key — and they already have it.

Every WordPress, plugin, or theme update usually contains security patches — fixes for known security holes. If you don’t update, those holes stay open and burglars can enter through them.

4. Weak or Reused Passwords

Analogy: You use “123456” as your house password. Or you use the same password for your house, office, and car. If a burglar knows one password, they can get into everything.

Passwords like “admin”, “password”, or your name + birth year are extremely easy to guess. And if you use the same password for email, Facebook, and WordPress — once your email is hacked, your website goes down with it.

5. Insecure File Manager / FTP

Analogy: You hide your spare house key under the doormat. Anyone walking by can grab it.

The File Manager in cPanel can be accessed by anyone with the cPanel password. If your cPanel password is weak, or you once logged into cPanel from a public computer without logging out — someone else could upload malware-infected files directly to your WordPress directory.

6. Logging into WordPress from an Insecure Network

Analogy: You discuss confidential matters on the phone in a public place. Someone next to you is listening and writing down everything you say.

Logging into WordPress without HTTPS, or logging in from public Wi-Fi (cafes, airports) — your login data can be intercepted by attackers exploiting the same network (Man-in-the-Middle attack).

7. Database SQL Injection

Analogy: The burglar doesn’t enter through the front door. They climb through an unlocked second-floor window — because there’s a hole in the wall you didn’t notice.

Websites using comment forms, contact forms, or URLs with parameters (e.g., ?page=news&id=5) can be targets for SQL Injection. Attackers inject malicious code through these forms to access and manipulate the WordPress database.

How to Detect Malware — Signs Your Website Is Infected

Before we discuss how to fix it, recognize the signs that your website has malware:

Signs Visible to Visitors

• 🔴 Automatic redirects to gambling, porn, or scam sites
• 🔴 Pop-up ads appearing constantly on every page
• 🔴 Google Chrome/Firefox warning: “Deceptive site ahead” or “This site may harm your computer”
• 🔴 Website appearance changes — strange text, unfamiliar banners, or altered footer
• 🔴 Website suddenly very slow — even though it was fine before

Signs You Can Check from WordPress Login

• 🟡 Unknown admin users in Users → All Users
• 🟡 Plugins or themes you never installed in the Plugins or Appearance menu
• 🟡 Weird WordPress notification emails — “Someone reset your password” when you didn’t
• 🟡 Modified WordPress files — new files that shouldn’t exist (usually in /wp-content/ or /wp-includes/)

Signs You Can Check from cPanel

• 🟠 Weird file sizes — PHP files that should be 10KB suddenly become 500KB (malicious code injected)
• 🟠 Changed file timestamps — files showing as “modified” when you didn’t change anything
• 🟠 Sudden disk usage increase — without you adding new content
• 🟠 Weird cron jobs — scheduled tasks you never created

How to Fix Malware-Infected WordPress — Step by Step

Now for the most important part: how to fix it. I’ll explain two methods:

Method 1: Scan & Clean (for mild malware)

Analogy: The doctor gives you antibiotics for a mild flu — just take the medicine, rest, and recover.

Method 2: Fresh Upgrade (for severe malware — RECOMMENDED)

Analogy: Your house has extensive flood damage. Instead of renovating room by room, it’s more efficient to: move out all furniture, clean the floors, and put back new, clean furniture.

Method 2 is the most effective and what I recommend for all malware cases. Why? Because malware can hide malicious code anywhere — even in WordPress core files that look normal. A fresh upgrade ensures all files are clean.

Method 1: Scan & Clean (Server Antivirus)

Before doing a fresh upgrade, always scan first using the antivirus on the server. The purpose is:

1. Detect what type of malware has infected the site
2. Clean infected files
3. Get an idea of how severe the infection is

On our server, we provide two antivirus tools:

A. Monarx Security

How to scan:

1. Login to customer’s cPanel
2. Find the Monarx Security menu (usually in Security or Software section)
3. Click “Scan” or “Scan Now”
4. Wait for the scan to complete (5-30 minutes depending on website size)
5. Review results — Monarx will show infected files
6. Click “Clean” or “Fix” to clean infected files

B. Imunify360

How to scan:

1. Login to customer’s cPanel
2. Find the Imunify360 menu (usually in Security section)
3. Click “Scan” in the Malware Scanner section
4. Wait for results — Imunify360 will show malicious files
5. Click “Clean” to remove malware from infected files

Important: Antivirus scanning helps clean malware known to the antivirus database. But some sophisticated malware types (advanced persistent threats) might not be detected by regular scans. That’s why a fresh upgrade is still necessary as the definitive step.

Method 2: Fresh WordPress Upgrade (DETAILED STEPS)

This is the most effective method. Follow the steps in order.

Step 1: BACKUP EVERYTHING (MANDATORY!)

This is the most important step before doing anything.

Analogy: Before renovating your house, move all your valuable furniture to a safe warehouse. If the renovation fails, you still have backups.

Backup via cPanel:

1. Login to cPanel
2. Click “Backup” or “Backup Wizard”
3. Click “Download a Full Website Backup”
4. Choose backup location (home directory)
5. Click “Generate Backup”
6. Once complete, download the backup file (.tar.gz) to your computer

Manual backup (if Backup Wizard isn’t available):

1. Login to cPanel → File Manager
2. Open the /public_html folder (or your WordPress directory)
3. Select all files → click “Compress” → choose “Zip Archive”
4. Download the zip file to your computer
5. Export database via phpMyAdmin → select database → click “Export” → “Go”

Important note for database backup:

• Save the .sql file from the export on your computer — this is your website’s database
• Remember: all article content, comments, users, and WordPress settings are in the database, not in files

Step 2: DOCUMENT ALL INSTALLED PLUGINS AND THEMES

Before deleting anything, write down all installed plugins and themes.

Analogy: Before demolishing a house, photograph all the furniture first so you know what to buy/reinstall later.

How to document:

1. Login to WordPress admin
2. Go to Plugins → Installed Plugins
3. Screenshot or write down all active plugin names
4. Go to Appearance → Themes
5. Screenshot or write down the active theme name
6. Special note: If there are paid (premium) plugins/themes — like Elementor Pro, WPForms Pro, Yoast SEO Premium — write them down separately. We’ll check if they’re original licenses or pirated (nulled).

Step 3: DELETE ALL WORDPRESS FILES (EXCEPT wp-content AND wp-config.php)

This is the critical step. Be careful — don’t delete the wrong things.

Analogy: You’re demolishing the entire house but keeping all the furniture (wp-content) and the house key (wp-config.php). Everything else gets rebuilt from scratch with new, clean materials.

How to delete via cPanel File Manager:

1. Login to cPanel → File Manager
2. Open the /public_html folder (or your WordPress directory)
3. SELECT ALL FILES AND FOLDERS inside (Ctrl+A or click “Select All”)
4. Click “Delete”
5. ⚠️ UNCHECK “Skip Trash” if you want to be safe (files go to trash first, can be restored)
6. Click “Delete Files”

What MUST stay (DO NOT DELETE):

• ✅ /wp-content/ — this folder contains all plugins, themes, image uploads, and cache. This is your “house furniture” that must be preserved
• ✅ wp-config.php — this file contains your database connection (username, password, database name). Without it, your website can’t connect to the database. This is your “house key”

What should be deleted (and MUST be deleted):

• ❌ /wp-admin/ — WordPress admin folder (will be replaced with new one)
• ❌ /wp-includes/ — WordPress core folder (will be replaced with new one)
• ❌ /wp-content/plugins/ — ⚠️ DELETE the contents of the plugins folder, not the folder itself. The /wp-content/ folder must stay, but empty the /wp-content/plugins/ contents
• ❌ /wp-content/themes/ — ⚠️ DELETE the contents of the themes folder too. You’ll reinstall a clean theme
• ❌ /wp-content/upgrade/ — temporary upgrade folder, can be deleted
• ❌ All root files: index.php, wp-login.php, wp-settings.php, etc. — all will be replaced

After this step, your WordPress directory should only contain:

/public_html/
├── wp-content/
│   ├── uploads/       ← DO NOT DELETE (contains uploaded images)
│   ├── plugins/       ← EMPTY (delete all contents of this folder)
│   ├── themes/        ← EMPTY (delete all contents of this folder)
│   └── [other folders can be deleted]
└── wp-config.php      ← DO NOT DELETE

Step 4: DOWNLOAD AND EXTRACT LATEST WORDPRESS

1. Go to https://wordpress.org/download/
2. Click “Download WordPress” (latest version)
3. The file wordpress-x.x.x.zip will download to your computer
4. Extract the zip file — you’ll get a wordpress folder
5. Open the extracted wordpress folder — select everything (Ctrl+A)
6. Upload everything to the /public_html/ folder via cPanel File Manager (click “Upload” in toolbar)

Note: The upload process may take several minutes depending on your internet speed and file size. Make sure the upload is 100% complete before proceeding.

Step 5: REINSTALL PLUGINS FROM SCRATCH

Do NOT reinstall plugins from your backup files. This is important — because old plugin files could also be infected.

Analogy: You just bought a new wardrobe. Don’t put moldy old clothes back inside. Wash them first or buy new ones.

How to reinstall plugins:

1. Login to WordPress admin (https://domain.com/wp-admin)
2. Go to Plugins → Add New
3. Search for each plugin you documented earlier
4. Install and activate them one by one

⚠️ ATTENTION FOR PREMIUM PLUGINS/THEMES:

If any of the plugins/themes you documented are paid (premium), follow these steps:

1. Check if you bought the premium plugin from the official site (original developer) or from a pirated/nulled site?
2. Original Plugin (Bought from Original Developer):
   • Re-download from the original developer’s site (codecanyon.net, official developer website, etc.)
   • Install from the newly downloaded file
   • Enter your purchased license key
3. Pirated Plugin (Nulled):
   • DELETE and do NOT reinstall
   • Pirated plugins almost certainly contain malware or backdoors
   • Buy an original license from the developer, or find a similar free alternative

Common premium plugins that are often pirated:

• Elementor Pro → buy from elementor.com
• WPForms Pro → buy from wpforms.com
• Yoast SEO Premium → buy from yoast.com
• Slider Revolution → buy from codecanyon.net
• WP Rocket → buy from wp-rocket.me

If you’re not sure whether a plugin is original or pirated:

• Check if you have a purchase email from the developer
• Check if there’s a license key you can activate
• If you can’t prove it’s original → treat it as pirated and don’t reinstall

Step 6: REINSTALL THEME FROM SCRATCH

Same as plugins — reinstall your theme from WordPress.org or from the official developer:

1. Login to WordPress admin
2. Go to Appearance → Themes → Add New
3. Search for and install the theme you documented earlier
4. Or if it’s a premium theme, download from the official developer and upload manually

Step 7: VERIFICATION & HARDENING

After the fresh upgrade is complete, run verification:

1. Check the website — open it in a browser, make sure the layout is normal
2. Login to WordPress — make sure you can login, check all menus are functional
3. Check for suspicious files — in File Manager, make sure no suspicious files have appeared
4. Change ALL passwords:
   • WordPress admin password
   • cPanel password
   • FTP/database password (if changeable)
   • Email password associated with the hosting account
5. Install a security plugin — Wordfence, Sucuri, or iThemes Security
6. Enable auto-updates for WordPress core, plugins, and themes
7. Remove unknown admin users you don’t recognize in the Users menu

Effects of WordPress Malware — From Mild to Severe

Many customers dismiss malware: “It’s just ads, no big deal.” The effects can be serious. Here’s a breakdown from mildest to most severe:

Mild Effects — “Just a Small Nuisance”

• Slow website — malware uses server resources to run malicious scripts, making the site slow
• Pop-up ads appear — visitors see gambling, porn, or scam ads. They close the site immediately and never return
• SEO affected — Google may lower your site’s ranking because it considers it harmful

This is “still tolerable” — but DON’T underestimate it. If left alone, mild effects will become severe.

Moderate Effects — “Harming Your Business”

• Google Safe Browsing warning — Chrome/Firefox displays a red warning: “Deceptive site ahead.” Visitors flee immediately. Traffic drops dramatically
• Customer emails go to spam — emails from your domain (e.g., info@yourstore.com) end up in spam folders because your domain is on a blacklist
• Customer data leaks — if malware accesses the database, customer data (names, emails, passwords, transaction data) can be stolen and sold on the dark web
• Website suspended by hosting — some hosting providers will suspend infected websites to protect other server accounts

Severe Effects — “Critical, Could Close Your Business”

• Complete data loss — malware can delete or encrypt your entire website content (ransomware)
• Admin password hijacked — attackers can login anytime and do anything — delete the website, change content, or install more malware
• Website used for other attacks — your site becomes a “zombie” for attacking other websites (DDoS) or used for phishing (fake bank sites)
• Permanent blacklist — if malware isn’t addressed quickly, your domain can be permanently blacklisted by Google, email blacklists (Spamhaus), and even blocked by browsers
• Legal liability — if customer data leaks and it’s proven to be due to security negligence, customers may pursue legal action

Effects Summary Table

Severity	Effect	Business Impact	Repair Cost
🟢 Mild	Slow site, pop-up ads	Visitor fluctuation, bounce rate increases	Low (scan + clean)
🟡 Moderate	Google warning, email spam, SEO drop	50-80% traffic loss, reputation damage	Medium (fresh upgrade + SEO recovery)
🔴 Severe	Data breach, site hijacked, ransomware	Business halted, customer loss, potential lawsuits	High (fresh upgrade + data recovery + legal)

Prevention — How to Protect WordPress from Malware

“Prevention is better than cure” — this saying is especially true for website security. Here are preventive measures you can take:

1. Update WordPress, Plugins, and Themes Regularly

Analogy: Vaccination. Just like you get vaccinated to prevent illness, WordPress updates are “vaccines” for your website.

• Enable auto-update for WordPress core: Settings → General → Automatic Updates
• Update plugins and themes at least once a week
• If there’s a security update, update IMMEDIATELY — don’t delay

2. Use Strong, Unique Passwords

Analogy: House keys should be complex — don’t use everyday keys that are easy to duplicate.

• Passwords should be at least 16 characters with a mix of uppercase, lowercase, numbers, and symbols
• Don’t use the same password for WordPress, email, and social media
• Use a password manager (Bitwarden, 1Password) to store passwords securely

3. Don’t Install Pirated Plugins/Themes (Nulled)

Analogy: Don’t buy counterfeit goods from the black market — you don’t know what’s hidden inside.

• Only install plugins/themes from official sources: WordPress.org, official developer websites, or trusted marketplaces (Codecanyon, ThemeForest)
• If someone offers a “free” or “cracked” premium plugin — it definitely contains malware
• Use the free tier of premium plugins — it’s usually enough for basic needs

4. Back Up Your Website Regularly

Analogy: Insurance. You hope you never need it, but when something goes wrong, you’re grateful you have it.

• Automatic weekly backups through cPanel → Backup
• Download backups to your computer monthly
• Store backups in a different location from the server (external hard drive, cloud storage)

5. Install Security Plugins

Analogy: CCTV and alarm systems for your house. They don’t 100% prevent burglars from entering, but they greatly help in detection and prevention.

• Wordfence (free) — firewall, malware scan, login security
• Sucuri Security (free) — security audit, malware scan, file integrity monitoring
• iThemes Security (free) — brute force protection, file change detection

6. Restrict Login Access

• Change WordPress login URL from /wp-admin to a custom URL (WPS Hide Login plugin)
• Use Two-Factor Authentication (2FA) — login requires password + code from phone
• Limit failed login attempts (brute force protection)
• Logout from WordPress after finishing work, especially from public computers

7. Don’t Login from Insecure Networks

• Avoid logging into WordPress from public Wi-Fi (cafes, airports, hotels)
• If you must login from a public network, use a VPN
• Ensure your website uses HTTPS (SSL certificate active)

8. Clean Up Unnecessary Files

• Remove plugins and themes you no longer use — the more plugins installed, the higher the vulnerability risk
• Delete old backup files on the server (save them on your computer, not the server)
• Clean the /wp-content/uploads/ folder from unused files

Frequently Asked Questions by Customers

“How did malware get in if I didn’t do anything?”

The most honest answer: in shared hosting, you live in the same “building” as hundreds of other accounts. If another account gets infected — from installing pirated plugins, weak passwords, or another vulnerable CMS — malware can spread to your account too. It’s not your fault. But you still need to know how to fix it.

“If I scan and clean, won’t malware come back?”

Scanning and cleaning only addresses the malware present at that moment. Malware can return if the root cause isn’t addressed. For example: your server neighbor is still infected, or you continue using pirated plugins. Prevention (updates, backups, strong passwords) is the key.

“Doesn’t a fresh upgrade delete all my content?”

No. A fresh upgrade only deletes the WordPress core files (wp-admin, wp-includes, etc.) and replaces them with new ones. Your content (articles, images, comments, users) is in the database, not in WordPress files. As long as you don’t delete the database, all your content is safe.

“Can I do a fresh upgrade myself?”

Yes, you can. But if you’re unsure or uncomfortable doing it yourself, ask your hosting support team. We usually help with this process — including scanning, backup, and fresh upgrade. The cost varies depending on the severity of infection.

“How long does a fresh upgrade take?”

For a normal-sized website (without complications), a fresh upgrade usually takes 30-60 minutes. But if the website is very large or the infection is severe, it may take longer.

“What effect does malware have on my website’s SEO?”

Google takes malware very seriously. If your site is infected: (1) Google may lower your search ranking, (2) Chrome/Firefox displays warnings that scare visitors away, (3) Your site may be blacklisted by Google. SEO recovery after malware takes weeks or even months.

Conclusion

WordPress malware isn’t the end of everything — but it’s also not something to take lightly. By understanding how malware gets in, recognizing the signs, and knowing how to fix it (including fresh WordPress upgrade), you can protect your online business from greater losses.

Remember three pillars:

1. Prevention: Regular updates, strong passwords, no pirated plugins, regular backups
2. Detection: Recognize malware signs (redirects, pop-ups, Google warnings, slow site)
3. Response: Scan with server antivirus → Fresh WordPress upgrade → Verification & hardening

Malware doesn’t come because you were “careless.” Sometimes it’s because of external factors you can’t control (mass malware on the server). What you can control is how quickly you respond and how well you prevent.

If your website is currently infected, don’t panic. Contact your hosting support team — we’re ready to help scan, clean, and recover your website.

Author: NOC Engineer — Syslog Solutions
Credentials: 5+ years handling WordPress malware on shared hosting cPanel/CloudLinux. Specializing in server security, malware remediation, and WordPress hardening.