Among the most frustrating things a WordPress user can experience are hacks and malware infections. However, taking a methodical approach will help you detect and remove the threat quickly and efficiently, saving your time and sanity along the way.
Malware infection on your website is a good indicator that your database may also be infected. If this is the case, it won’t be enough just to clean up the site. You will still find malware no matter how thorough you are. Below is our step-by-step guide on how to confirm a database breach, identify the malware, and remove it.
Potential vulnerabilities in WordPress security
Lack of updates
A good first step is to update WordPress as soon as a new version is available. The latest version will be available at https://wordpress.org/, and only there. Downloads from anywhere else are not considered official releases. We advise avoiding them for security reasons.
Starting with version 3.7, WordPress now features automatic updates, which make this process even simpler. You can find information about new updates on your WordPress Dashboard or by visiting this page.
Themes and plugins
Though they are essential for building anything on WordPress, themes and plugins remain the most abused attack points for spreading malware. It’s important to note that these vulnerabilities are usually a result of developer oversight, as many developers are not highly versed in security.
If they discover such vulnerabilities, the developers usually patch them in the next update. But if a theme or a plugin hasn’t been updated for some time, chances are there are still some unpatched vulnerabilities. In that case, we advise uninstalling them.
If you’re set on using a theme or plugin that has been due for an update in a while, try contacting the developer directly to get further security information.
Steps to take before scanning for malware
Stay calm and document what you can
So, you’ve discovered your WordPress has been infected by malware. The first and most important thing is to take a step back and collect yourself. Your brand reputation might suffer. But by carefully following the steps outlined below, you’ll surely clean up your WordPress and seal any security breaches as soon as possible.
You must document this stage in as much detail as you can:
- What made you suspicious of malware in the first place?
- Take note of the setup you’re using, when you first noticed the issue (including your local time zone);
- Did you make any recent changes to your WordPress? (such as changing the theme, installing a plugin, or modifying a widget)
By writing these down, you are essentially creating a ticket you can submit to WordPress support.
You can also use this to tap into the community – maybe someone has had a similar issue and knows how to fix it. A good first stop for this is the WordPress forum.
Look into factors outside WordPress
Before you scan your web page, it might be a good idea to run a scan of your local machine first. In many cases, the infection originated from your own device.
For instance, trojans can pick up your WordPress login credentials and create an opportunity for a hack. Running a full scan for viruses and malware will help you detect hidden threats (and if not, try scanning with multiple AV apps).
You should also make sure to check with your web host, in case the malware has infected pages other than your own. They may be able to tell you whether it’s really a hack or if the service was just temporarily lost. Or, they could already be taking steps to fix the situation themselves.
Create a backup
You should already have a backup of your web page, but if not, now might be a good time to make one. Even with a hack, a backup will be an essential reference in restoring your web page in case of a catastrophic failure. You can also use the infected copy to determine the type and source of the malware later on.
Reset and upgrade your access controls
As soon as you identify a hack, you should lock your web page down to prevent the further spread of malware.
You can do this by resetting all passwords, including those of both users and administrators. Don’t forget to force all the active users off your page when resetting the passwords. Then, create a new set of passwords by using a key generator for WordPress. Use those to overwrite your wp-config.php file.
Make sure the new passwords are long, complex, and unique. Also, don’t forget to change all the access points, such as FTP / SFTP, WP-ADMIN, CPANEL, and MYSQL.
Scanning for malware
First places to look
Run a quick scan of your site
A good place to start is with a quick scan of your web page. Using free tools like SiteCheck can sometimes be enough to get an idea of what you’re dealing with and where the malware could be. Another useful feature is the notification that pops up if your page has been blacklisted by Google or another service.
If one of these services did blacklist your page, you can use their diagnostic tools to check your security status. With tools like Google’s Safe Browsing Site Status, you can review their report on any malicious redirects, spam, or downloads. It would also be a good idea to create accounts on the following free monitoring tools:
If you are running multiple web pages on the same server, you should scan all of them to prevent cross-site contamination.
Check recently modified files
As we said earlier, new or recently modified files have a good chance of being the source of infection. You can either check these files manually or by using terminal commands. On Linux, you can type:
$ find /etc -type f -printf ‘%TY-%Tm-%Td %TT %p\n’ | sort -r .
This lets you review any changes in the last 7-30 days.
Check the integrity of core files
As most core WordPress files aren’t meant to be modified, you can look into any changes made in the wp-admin, wp-includes, and root folders. Do this by either using the diff command in the terminal or via SFTP.
Manually searching the code for malware
To start a manual search, you will first need to export your WordPress database as a text file. You can do this by using the database tool your web host has provided.
In the following example, we will show you how to do this using PhpMyAdmin:
- To access your cPanel dashboard, type either http://www.yoursite.com:2082 or https://www.yoursite.com:2083, depending on whether your URL begins with http or https.
- Once the login page loads, use the credentials you received from your web host. You can usually find these in the welcome emails you receive when signing up.
- On the cPanel dashboard, scroll down to the ‘Databases’ section and click on ‘PhpMyAdmin’.
- On the left-hand side, you will find a list where you need to select your database.
- Once you’ve selected your database, click on ‘Export’ at the top of the screen.
- Set your export method to ‘Quick’, format to ‘SQL’, and click on ‘Go’.
Once the download is complete, you can use Notepad to access the content and search for malware. There are two main indicators of a malware infection:
- PHP functions that are easily exploitable, and thus frequently used by hackers
- Any unknown code sections, iframes, or links in your site.
Easily exploitable PHP functions
It’s important to remember that these are not bad in and of themselves. In fact, developers sometimes use them with no ill intent. Some of these functions can be:
- base64_decode: Used to decode data encoded with base64, this function is highly unlikely to contain any encoded information. If this function is present in your database, it could indicate someone is using it to hide malicious code.
Search for “base64_decode( ” or “base64_decode (”
- gzinflate: Similar to the previous note, this function is used for decoding and should not include any information.
Search for “gzinflate(” or “gzinflate (”
- eval: The purpose of this function is to process any string as a valid PHP code. Since developers discourage its use, if you find eval in your code, it’s likely infected.
Search for “eval(” or “eval (”
- error_reporting(0): If this function is set up with a parameter of 0, that means that any code errors will not be displayed or logged. Its presence usually indicates that a hacker is trying out various codes and taking steps to hide the error reports from you to avoid detection.
Search for “error_reporting(0)” or “error_reporting (0)
- shell_exec: This function is useful for executing commands at the server level, and is thus a prime target for hacking attempts.
Search for “shell_exec(” or “shell_exec (”
Please note that this is not an exhaustive list of vulnerable PHP functions. Consider researching further about this topic if you suspect your database might be endangered on this front.
Malicious iframes and redirect links
Here, the best method of finding suspicious content is to manually review your code. You can use a tool such as cURL Builder. It will help prevent spreading the malware to your local machine or server.
While searching the code, pay close attention to any suspicious text. This can include redirect links to pages that have nothing to do with your website. You can speed up this process by searching for all ‘iframe’ tags. Make sure you keep careful notes of any suspicious iframes, links, and HTML sections.
If, during your search, you discover that your database is in fact infected, you should take immediate steps to clean it. The quickest and easiest way to do this is to restore your database to a point before the infection. Use your backups, unless the malware spread to them as well, or they are significantly out of date. In that case, contact your web host for help.
You can also clean any suspicious content in your database manually, although you should note that this requires some advanced knowledge. Using PhpMyAdmin as an example, the clean-up process would look like this:
- On the left-hand side of the PhpMyAdmin screen, select your database from the list.
- Click ‘Search’ at the top of the screen.
- Use the ‘Words or Values’ input box to enter the search text. Make sure you set ‘Find’ to ‘ at least one of the words’ and select all the tables in the ‘Inside Tables’ list. Click on ‘Go’.
- If a match is found, the search results will let you either browse or delete the record. If you decide to browse the record, you can manually edit out the malicious text, although simply deleting it is a safer bet. Repeat this process for every positive search result.
Scanning your database with dedicated tools
Aside from manual scanning and deletion of potential malware, there are several 3rd party services available that can run this process for you, thus saving time and possible frustration.
Please note, however, that none of these services is 100% guaranteed to find malicious code. Sometimes they can overlook hidden and archived files and pages, or fail to recognize new and innovative hacking methods.
Some of the most frequently used tools of this kind include:
- CyberScanner: Frequently updates with new malware info. This tool will actively check a range of databases, scripts, and code injections. By signing up, you will get a weekly report explaining any security issues your website might have. Aside from WordPress, you can also use CyberScanner on Joomla and Drupal.
- Sucuri: We already mentioned how Sucuri’s free SiteCheck functionality can be useful in providing a quick, rough scan of any potential issues. Upgrading to the paid version will not only scan but also remove any malware it finds. I will also remove your IP from any blacklist tools that may have picked it up.
- CodeGuard: This program will let you quickly and easily set up automated backup and restore operations. It will also regularly check your site and report any recent changes to the website.
Using WordPress plugins to scan your database
Plugins are another handy option for detecting and fixing any malware issues. Many of them not only scan for threats but also include a full pack of security features. Some of the most popular plugins include:
- MalCare Security and Firewall: With the results of analyzing over 240,000 WordPress sites, MalCare can potentially detect more complex malware that other plugins may overlook. The premium version also offers automatic malware cleanup, IP blocking, login protection, and security hardening.
- Wordfence: A free and open source security suite for your site. Wordfence not only scans for malware but also checks for backdoors, phishing URLs, trojans, and suspicious code. It scans regularly in hourly intervals. The premium API key also offers scheduled scans, country blocking, and other additional features.
- iThemes Security: One of the most popular security plugins on WordPress, with over 800,000 downloads. The free version of iThemes Security (formerly Better WP Security) offers a one-click security sweep, malware scans, password generator, database backup, brute force protection, and more. The premium version goes for $80 a year and offers added features like scheduled malware scans, 2-factor authentication, and password expiration.
- All In One WP Security & Firewall: This plugin offers many security features in a user-friendly and easy-to-set-up interface. You can also set up email notifications whenever code is added by anyone other than you. For malware-specific scanning, you need to upgrade to the premium version ($9.95 per month).
Conclusion
Whether you choose to go the manual route or use any of the tools and plugins we mentioned above, please take care of what you change or delete. Tempering with WordPress core files can hurt more than help, so if you’re not sure if something is safe, Google is your friend.
Are there other tools or solutions you have used for removing malware from your database? If so, please share them in the comments.
FAQ
How do I know if malware has spread to my WordPress database?
If malware keeps reappearing after cleaning your website files, your WordPress database may be infected. Suspicious redirects, hidden iframes, unknown admin users, and injected PHP functions like eval or base64_decode in your SQL export are strong indicators of a database breach.
What is the safest way to check a WordPress database for malicious code?
Export your database via PhpMyAdmin, review the SQL file offline, and search for exploitable PHP functions, spam links, injected scripts, and suspicious iframes. Combine manual inspection with trusted malware scanning tools for a more reliable security assessment.
Why should I update WordPress themes and plugins regularly?
Outdated themes and plugins often contain unpatched security vulnerabilities that hackers exploit to inject malware into your website and database. Regular updates reduce attack surfaces and protect your WordPress installation from known threats.
What should I do immediately after discovering a WordPress hack?
Reset all passwords (WP-ADMIN, FTP, cPanel, MySQL), force logout active users, create a full backup, scan your local machine, and contact your hosting provider. Securing access points prevents further malware spread during cleanup.
Is manual database cleanup better than using WordPress security plugins?
Manual cleanup gives full control but requires advanced knowledge to avoid damaging core files. Security plugins like Wordfence or MalCare automate malware scanning and removal, but combining both approaches often provides the strongest protection.
