Remove Malware From a Hacked Website

Before You Start

This guide shows you how to remove malware from a hacked website, covering the files, database, accounts and server settings an attacker may have changed. It is for site owners and administrators who have confirmed an infection and can reach the site files, the database and the hosting control panel. Before you begin, save a copy of the infected site for investigation and confirm that any clean backup predates the compromise.

Find and Remove Every Infection

1. Restrict access while you work. Stop visitors reaching infected pages using your host's maintenance option or a temporary restriction. Keep the saved copy for investigation.
2. Scan the whole site. Run a malware scanner against all files, not only the main folders. Scanners miss some infections, so treat the results as a starting point. How scanners work explains their limits.
3. Replace core, theme and plugin files. Reinstall the software from official sources at the versions you use. This replaces modified code in those files, but it does not clean the database or uploads.
4. Check upload and cache folders. Look for script files where none should exist, and remove them. Look for backdoors and web shells placed in rarely visited folders.
5. Clean the database. Search content, options and settings tables for injected scripts or unfamiliar links. Remove them carefully, and back up the database first.
6. Review accounts, tasks and server settings. Delete unknown administrator accounts, remove unfamiliar scheduled tasks and check redirect rules in server configuration files.

Close the Entry Point and Verify

1. Change every password and key. Reset passwords for hosting, database, email and site accounts, and replace any keys the site uses. Do this after cleaning, so an attacker cannot return with the old details.
2. Update everything. Apply updates to core software, plugins, themes and the server environment. Remove unused plugins and themes entirely rather than leaving them installed.
3. Verify the result. Scan the site again, inspect page source for injected code and test key pages from several devices to confirm no unexpected redirects remain.
4. Monitor after cleanup. Watch for new file changes, unfamiliar accounts and unusual traffic for several weeks, because a surviving foothold can cause reinfection.

Common Mistakes and When to Ask for Help

• Deleting only the visible malicious file while copies and backdoors remain.
• Restoring an old backup that was taken after the infection began.
• Changing passwords before cleaning, which leaves hidden access points in place.

Ask your host for help if you cannot locate the infection, if the site keeps being reinfected, or if the server shows signs of compromise beyond the website. A specialist can check server-level changes that are hard to inspect from the site itself.

Can I remove malware by reinstalling my website?

Not safely on its own. Reinstalling core files and plugins replaces infected code in those files, but it does not clean the database, the uploads folder or hidden backdoors. The vulnerability that let the attacker in may still be present, so reinstalling should be one step in a full cleanup.

Why does a website get hacked again after cleaning?

The most common reason is that the entry point stayed open or a backdoor survived the cleanup. Work that targets visible symptoms rather than every foothold often leads to reinfection. Checking for web shells, updating software and changing every credential give a much better chance of a lasting result.

Should I restore a backup to remove malware?

Only if you can confirm the backup was made before the compromise began. A backup taken after the infection will bring the malware back. Check the backup's dates and contents, then update the software before putting the site back online.