Your Rankings Cratered Overnight? Here’s Your WordPress Malware Cleanup Guide

You wake up, check Search Console out of habit, and there it is: a manual action notice, or worse, a chunk of your organic traffic just gone overnight. Somewhere on your WordPress site, a stranger has been running their own business — payday loan spam, fake pharmacy pages, a redirect to a phishing kit — and Google noticed before you did.

That lag is the actual danger. Most WordPress hacks aren’t loud. Nobody defaces your homepage with a skull GIF anymore; that stopped being profitable a decade ago. Modern compromises are quiet, patient, and built to survive a surface-level cleanup, which is exactly why so many site owners “fix” the problem twice.

The last cleanup we did for a client started with a support ticket that just said “some of our pages look weird in Google.” It turned out to be an IndoXploit webshell sitting in an old uploads subfolder, quietly serving a second, invisible version of the site to search bots while human visitors saw the normal one. This guide is the process we used to actually get rid of it — and keep it gone.

How to Tell If You’ve Actually Been Hacked

The obvious signs

Some compromises announce themselves: a defaced homepage, a full-page redirect to a gambling or pharmacy site, or a browser warning that says the site ahead contains malware. If you’re seeing any of those, skip ahead — you already know, and the question is just how deep it goes.

The sneaky ones

Most active hacks aren’t visible to you at all, because they’re built to hide from the site owner and show up only to Google or to visitors coming from search results. Watch for these instead:

• New pages in Search Console you never wrote, usually in a language you don’t publish in
• A sudden spike in indexed pages that doesn’t match anything in your CMS
• Cloaked content — the page looks normal in your browser but a “fetch as Google” or a curl request returns spam text or a redirect
• Outbound links to sketchy domains buried in your footer, a widget, or an old post nobody’s touched in years
• Unfamiliar admin users, or an existing admin account logging in from a country you’ve never done business in

If any of that rings a bell, don’t just delete the one weird page you found. Cloaking and spam injections are almost never a single file — they’re usually a small network of backdoored files that regenerate each other.

First Response: Contain the Damage Before You Clean Anything

Don’t delete the site or reinstall from scratch yet. You want a snapshot of the infected state first, in case you need to figure out how the attacker got in later. Copy the whole site — files and database — to a separate location before you touch anything.

Take it offline the right way

Pulling the domain entirely can make things worse: it can look suspicious to Google mid-review, and it doesn’t stop the attacker if they still have another way in. A better first move is putting the site into maintenance mode for logged-out visitors while you work, so search bots and real visitors stop hitting the infected pages.

Rotate every credential, not just one

Change your WordPress admin passwords, your database password, your SFTP/SSH credentials, and your hosting account login. If you use a caching or CDN service, rotate that API key too. Attackers who get in once often leave more than one way back in, and a fresh admin password does nothing if they still have your SFTP login sitting in a config file somewhere.

Find and Remove the Malware

Compare against a known-clean baseline

The fastest way to spot injected code is a diff, not a read-through. Download a fresh copy of WordPress core and your theme/plugin files from their official sources, then compare file-by-file against what’s actually on your server. Any core file that doesn’t match byte-for-byte is either a customization you forgot about or something that shouldn’t be there.

Know where the malware hides

It rarely sits somewhere obvious. Common spots we check first:

• The uploads directory — it’s writable and rarely audited, which makes it a favorite drop zone for PHP shells disguised as images
• wp-config.php and .htaccess — a single injected line can redirect specific traffic (like Googlebot’s user agent) without touching anything a human would notice
• Theme files like functions.php, especially on themes downloaded from somewhere other than WordPress.org or a paid marketplace
• The wp_options table — malicious code can live in a serialized option value and get pulled into a page without ever touching a file on disk

The IndoXploit shell we found was sitting in an uploads subfolder with a filename that looked like a cache file. It wasn’t flagged by a quick file-count check because the attacker had also planted a second, near-identical copy elsewhere as a fallback — pull one and the other quietly re-creates it. That’s the norm with this class of malware, not the exception, so a single found-and-deleted file is not proof the site is clean.

Why It Keeps Coming Back (Reinfection Vectors)

Backdoors survive a surface cleanup

A backdoor is code whose only job is letting the attacker back in after you’ve cleaned everything else — a tiny file that accepts a hidden password, or a modified core file that looks legitimate at a glance. If you remove the visible spam pages but leave the backdoor standing, the same hack comes back within days.

Nulled and outdated plugins are the front door, over and over

A huge share of WordPress compromises trace back to two things: a plugin or theme with a known, unpatched vulnerability, or a “nulled” (cracked, pirated) premium plugin downloaded from outside the official marketplace. Nulled plugins are frequently pre-infected on purpose — you’re not getting the paid plugin for free, you’re getting malware wearing the plugin’s name.

After the Cleanup: Verify and Harden

Confirm it’s actually gone

Run at least one reputable malware scanner across the file system and database after your manual pass, and request a review in Google Search Console if you were flagged. Google’s review process checks the live site again before lifting any warning, so don’t request it until you’re confident the backdoors are gone too, not just the visible symptom.

Now go do the hardening work

Cleanup fixes today’s problem. It doesn’t fix the door that let the attacker in, which is a separate project — updating everything, removing unused plugins, enforcing strong unique passwords, and turning on two-factor auth for every admin account. We wrote a full walkthrough of that hardening process if you haven’t done it yet: our WordPress security hardening checklist guide covers it step by step.

Frequently Asked Questions

If you’re dealing with an active infection right now and want a second set of eyes on it, that’s exactly the kind of mess we like untangling — reach out and we’ll help you figure out how deep it goes.

Built by amplifi.studio — see also our WordPress security hardening checklist guide.