Free tools Windows power users keep installed
One-click scans. No signup required.
Use several checks, not one scanner. A reliable WordPress malware check combines visible symptoms, a WordPress-aware application scan, an external remote scan, and—when the evidence warrants it—a database or server-side review. A clean homepage does not prove that the database, scheduled tasks, administrator accounts, or hosting server are clean.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
This guide shows how to check for compromise safely, interpret findings, preserve recovery options, clean an infected installation, remove search warnings, and reduce the chance of reinfection. If the site handles payments, health information, customer accounts, or other high-value data, involve a qualified incident-response professional rather than experimenting on the live site.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What a WordPress malware check can—and cannot—prove
Malware is code, content, accounts, or configuration that an attacker added or changed without authorization. On WordPress, it may live in plugin or theme files, modified core files, the database, uploads, scheduled tasks, server configuration, or another site sharing the hosting account. Different checks see different layers.
Think of the result as a set of evidence rather than a single pass/fail label:
#1 Best Overall
- Symptoms: what visitors, administrators, and search engines can observe.
- Application scan: a scan that understands WordPress core, plugins, themes, and common attack patterns.
- Remote scan: a separate service requesting pages from outside the server, similar to a search crawler or visitor.
- Database and server review: inspection of stored content, users, cron jobs, hosting files, logs, and server software when a file or remote scan cannot explain the behavior.
Mark Maunder, Wordfence founder and CTO, advises: “If you suspect you have been hacked, first make sure that you have actually been hacked.” That caution matters because a warning can be caused by a stale cache, an injected advertisement from a third party, an innocent modified file, or a genuine compromise. Treat every positive signal as actionable, but verify it before deleting files.
Warning signs that justify an immediate check
One sign is enough to start an investigation. Several signs together should be treated as a likely compromise until disproved.
Recommended Free Tools
| Signal | What it may indicate | First check |
|---|---|---|
| Visitors are redirected to an unfamiliar site | Injected JavaScript, PHP, server rules, or a compromised advertising script | Test in a private browser window and from a second network; then scan files and database content |
| Google shows “This site may be hacked” | Google detected spam, malicious downloads, or other unsafe content | Review the affected URLs and security issues in Google Search Console |
| An unfamiliar administrator exists | An attacker may have created persistence through a privileged account | Review all users, roles, creation dates, and recent activity |
| Unknown or modified PHP files appear | Backdoors, loaders, web shells, or altered legitimate files | Compare core, theme, and plugin files with clean vendor copies |
| Spam pages, links, or email are appearing | Database injections, compromised forms, or unauthorized content creation | Search posts, pages, comments, options, user metadata, and mail settings |
| Unexplained slowness, crashes, or resource spikes | Malicious processes, database abuse, traffic floods, or a broken update | Check hosting resource graphs and logs alongside a malware scan |
| Login no longer works or settings changed | Password theft, account takeover, or an attacker changing privileges | Use the host’s recovery process and audit every administrator account |
| A security scanner reports a finding | Possible malware, vulnerability, suspicious change, or false positive | Record the file, line, signature, and scanner explanation before modifying anything |
Do not dismiss a warning because the site looks normal to you. Attackers commonly target only search crawlers, logged-out visitors, mobile devices, or requests containing a particular referrer. A clean-looking front end is evidence about one viewing path, not proof about the whole installation.
Prepare before you scan or remove anything
Rushed cleanup can destroy the evidence needed to identify the entry point or restore the site correctly. Take these steps first.
- Record the current state. Note the time, symptoms, suspicious URLs, affected accounts, scanner messages, recent updates, and hosting changes. Save screenshots and copies of relevant logs if your host permits it.
- Make a separate copy of the current site. Preserve files and a database export for investigation. Store it away from the live document root and label it as potentially infected. Do not overwrite it with a later “clean” backup.
- Do not restore an old backup blindly. Backups can contain the same backdoor or malicious database row. Check the backup date, scan its files and database, and establish that it predates the compromise before using it.
- Limit damage while investigating. If the site is actively redirecting visitors, distributing malware, or exposing customer information, place it behind a maintenance page or ask the host to isolate it. Preserve access for the investigator and keep a record of the change.
- Use a clean device for account work. Change passwords from a computer and network you trust. A compromised workstation can immediately capture replacement credentials.
These precautions preserve two recovery paths: an untouched snapshot for analysis and a verified clean source for rebuilding.
Layer 1: inspect the rendered site and search results
Test as different visitors
Open the site while logged out, in a private browsing window, and on a second device. Follow internal links, submit ordinary forms, and check pages that receive the most search traffic. If the symptom appears only for one browser or location, compare extensions, DNS, caching, and network filtering before concluding that WordPress is infected.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Look for unexpected redirects, pop-ups, fake browser-update notices, downloads, gambling or pharmaceutical text, hidden links, changed contact details, and pages you did not publish. Check the page source and browser developer console for unfamiliar domains or scripts, but do not treat every third-party script as malicious; advertising, analytics, consent, and payment services also load external code.
Use search-engine evidence
Search for your domain and distinctive phrases from your pages. Unexpected indexed URLs, foreign-language titles, doorway pages, or snippets that do not exist on the visible site can indicate database or server-side spam. Google’s “This site may be hacked” warning is a high-priority signal, but it does not identify every infected file. Record the affected URLs and the warning category in Google Search Console before changing content.
Check administrative behavior
Review the user list, roles, email addresses, registration setting, and recent changes. An unknown administrator is more urgent than an ordinary spam comment because it can restore malware after cleanup. Also inspect menus, widgets, reusable blocks, forms, redirects, and settings for changes no legitimate editor made.
Layer 2: run a WordPress-aware application scan
A WordPress-aware scanner can compare core files with known originals, inspect plugins and themes, search for suspicious signatures, and identify risky changes that a visual inspection misses. Run it from an administrator account you trust, and save the full report rather than only the headline result.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How to read the report
- Modified core file: compare it with the matching clean version for the exact WordPress release. A legitimate customization in core is unusual and should be documented.
- Unknown PHP file: determine who created it, when it appeared, whether WordPress references it, and whether it contains executable code. Do not delete a file solely because its name looks random; quarantine a copy first.
- Plugin or theme mismatch: compare against the vendor’s clean package. A changed file may be malware, a legitimate local edit, or a failed update.
- Suspicious database value: inspect the complete option, post, comment, user metadata, or widget record. Short obfuscated strings can be legitimate serialized settings, so preserve the original before editing.
- Vulnerability notice: a vulnerable component is not proof of infection, but it identifies a likely entry point and must be updated, replaced, or removed.
False-positive review is essential. Record the exact path, checksum or signature, line number, and reason the scanner flagged it. If a clean vendor package confirms the file is legitimate, mark the finding as reviewed and keep the evidence.
When the scan cannot complete
A scan may time out because of hosting limits, huge media directories, low memory, or a site that is already crashing. Ask the host about PHP memory, execution-time, and process limits; scan in smaller scopes if the tool supports that; and obtain a server-side scan when the application cannot safely inspect its own files. An incomplete scan is not a clean result.
Layer 3: use an external remote scanner
A remote scanner requests the public site from outside the hosting account. It can reveal redirects, malicious scripts, blocklist status, and content served only to unauthenticated visitors. Because it cannot normally read private files or the database, it complements rather than replaces an application or server-side scan.
External results are affected by caching, geolocation, user-agent targeting, and whether the malicious behavior is currently active. Run the scan more than once if the symptom is intermittent, and compare the requested URL, response, and timestamp. If the remote scan is clean while visitors still see redirects, investigate conditional code, caches, DNS, hosting rules, and database-generated output.
Sucuri reported that 1.15% of 108,122,130 sites scanned in 2023 showed malware in its vendor-reported SiteCheck results. That figure describes those scans and that provider’s detection method; it is not a neutral estimate of the proportion of all WordPress sites that are infected.
Know when to inspect the database and server
File scanners can miss database infections, and remote scanners cannot see private storage. Escalate beyond WordPress files when any of these conditions applies:
- The front end is clean but spam URLs, users, or settings keep returning.
- A scanner identifies injected content in posts, options, widgets, comments, or user metadata.
- Unknown administrator accounts reappear after password changes.
- Redirects occur only for search crawlers, mobile users, or specific referrers.
- Server CPU, memory, mail volume, or disk usage is abnormal.
- Multiple sites in the same hosting account show related symptoms.
- The site uses custom server rules, scheduled jobs, deployment scripts, or a content-delivery layer that can alter responses.
Review database tables and serialized values carefully; malformed edits can break the site. Ask the host for access logs, error logs, file timestamps, process information, cron entries, and evidence of other accounts being accessed. If you cannot distinguish a web shell from application code, stop editing and obtain professional help.
Confirm whether a finding is real
Before cleaning, correlate at least two independent clues. For example, an unfamiliar PHP file is more credible when its timestamp matches a new administrator account and the file appears in a redirect chain. A scanner signature alone may be a false positive; a Google warning alone may refer to a page already removed.
Use this verification checklist:
- Is the file, account, URL, or setting present in a known-clean backup?
- Does the file match the official package for the exact core, plugin, or theme version?
- Does the suspicious code execute, alter output, create users, send mail, or fetch remote instructions?
- Do logs show an upload, vulnerable request, stolen login, or control-panel change near the first suspicious timestamp?
- Does the same indicator appear in the database, another site, or a remote scan?
Keep a written list of confirmed indicators and reviewed false positives. That list becomes your post-cleanup validation test.
Clean a confirmed infection in a controlled order
Cleaning is not simply deleting the file a scanner names. Attackers often add persistence in several locations, so work from a clean source and verify each layer.
- Isolate the site if necessary. Prevent visitors from receiving malicious content while retaining the preserved copy and logs.
- Choose a clean rebuild source. Use a verified backup or fresh packages from the official WordPress source and the legitimate plugin and theme vendors. Do not reuse files from the infected document root without comparison.
- Replace compromised core files. Sucuri recommends replacing compromised core files with clean copies from the official WordPress source. Keep site-specific configuration only after checking it for injected code.
- Replace or remove compromised extensions. Reinstall affected plugins and themes from trusted packages. Remove abandoned, nulled, duplicated, and unused components rather than attempting to preserve them.
- Remove malicious files and content. Delete confirmed backdoors, unauthorized uploads, spam posts, injected links, rogue users, and altered scheduled tasks. Quarantine copies first if they may be needed for analysis.
- Review the database. Search for unauthorized users, options, widgets, posts, comments, form destinations, and redirect values. Validate serialized data after any edit.
- Check hosting scope. Scan neighboring sites, shared directories, control-panel accounts, and server rules. A reinfected WordPress directory often means another infected site or account remains.
- Update everything. Bring WordPress core, themes, plugins, PHP, and other server software to supported versions. Replace components that are no longer maintained.
- Rescan from every applicable layer. Repeat the application and remote scans, then verify the database and server indicators that led to the cleanup.
Do not declare success until the original symptoms stop, confirmed indicators are gone, and no persistence mechanism remains.
Rotate credentials and harden the installation
Cleanup is incomplete while an attacker can log in again. Change credentials from a trusted device for WordPress administrators, hosting and control-panel accounts, FTP or SFTP, SSH, the database, deployment systems, email accounts used for password resets, and any API or payment integration that could expose the site.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteUse unique passwords, enable two-factor authentication wherever available, and remove unused administrator accounts. Review application passwords, security keys, connected services, and recovery email addresses. Invalidate active sessions after changing credentials.
Reduce the attack surface by deleting unused plugins, themes, old WordPress installations, test copies, and writable files that do not need to be writable. Restrict file permissions according to your host’s documented configuration, protect configuration secrets, and ask the host to address unsupported server software. Keep automatic updates where they are appropriate, but test major changes on a staging copy.
Remove a Google hacked-site warning only after cleanup
A warning review is not a substitute for remediation. First fix the infection, remove malicious pages and downloads, update the installation, rotate credentials, and confirm with fresh scans. Then use the security-issue and reconsideration workflow in Google Search Console for the affected property. Explain what was removed and what preventive steps were taken, and monitor for new issues after Google recrawls the site.
The same order applies to antivirus or blocklist operators: diagnose, clean, verify, and only then request review. Submitting a review while the site still serves malicious content can delay trust restoration and expose visitors.
Choosing the right type of scanner
No neutral study in the available evidence establishes that one product detects more malware, runs faster, or costs less than another. Select tools by coverage and by the access you have.
| Capability | WordPress-aware application scan | External remote scan | Server-side or manual review |
|---|---|---|---|
| Rendered pages and redirects | Usually, depending on the tool | Yes, from outside the host | Can verify causes in files, rules, and logs |
| Core, plugin, and theme files | Strongest fit | Not normally visible | Yes, with direct filesystem access |
| Database infections | Only if the tool includes database checks | Only when the infection changes public output | Yes, with database access and careful review |
| Hosting account and neighboring sites | Usually outside scope | No private access | Best fit |
| Cleanup or repair | May offer guided repair; verify every change | Usually reports rather than repairs | Can rebuild, but requires technical skill |
| False-positive investigation | Review signatures, paths, and clean originals | Compare responses and timestamps | Correlate logs, hashes, database records, and backups |
| Speed and cost | Not stated on a neutral basis | Not stated on a neutral basis | Depends on host access and specialist time |
For a small personal site with no warning signs, a scheduled application scan plus occasional remote checks may be sufficient. A business-critical or repeatedly reinfected site needs layered monitoring, tested backups, server visibility, and an escalation plan.
Backups and monitoring that make the next incident survivable
Maintain backups on a schedule that matches how much content you can afford to lose. Keep copies separate from the hosting account, protect them from deletion by a compromised administrator, and test restoring both files and the database. A backup that has never been restored is an assumption, not a recovery plan.
Monitor for new administrator accounts, plugin and theme changes, unexpected file changes, redirects, spam, outbound mail spikes, and resource anomalies. Record the normal baseline for traffic and server usage so a sudden change is visible. Review scan alerts promptly; Wordfence guidance notes that the longer a compromised site remains infected, the greater the risk of data loss, SEO penalties, or further spread.
A practical decision path
- No symptoms and no scanner findings: keep updates current, maintain tested backups, and schedule layered checks.
- One suspicious symptom: preserve the current state, inspect the site and search results, then run both application and remote scans.
- Confirmed file or account change: isolate if needed, rebuild from clean sources, review the database and server, rotate credentials, and rescan.
- Persistent or recurring infection: assume a missed persistence mechanism, shared-host compromise, stolen credential, or vulnerable component; escalate to the host or an incident-response specialist.
- Google or antivirus warning after cleanup: verify that the affected content is gone, then request review through the relevant operator.
Frequently Asked Questions
Can a WordPress site be hacked even if the homepage looks normal?
Yes. Malware can target search crawlers, logged-out visitors, mobile users, particular referrers, database output, or server rules. Combine visual checks with application, remote, and—when indicated—database or server-side scans.
Should I restore my oldest backup immediately?
No. Check the backup for infected files, database records, users, and timestamps first. Preserve the current state for investigation and use only a verified clean backup or fresh vendor files.
What should I do when a scanner flags a WordPress core file?
Save the report, compare the file with the clean package for the exact WordPress version, and review its timestamp and code. Replace it with a clean official copy if it is compromised; document it as a reviewed false positive if it matches the legitimate release.
Why is a remote scanner clean while visitors still see redirects?
The behavior may be conditional, cached, geotargeted, database-driven, or controlled by hosting rules. Check application files, database content, caches, DNS, logs, and server configuration rather than treating the remote result as proof of safety.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When should I ask my host or a professional for help?
Escalate when scans cannot complete, the database or server appears infected, multiple sites share symptoms, credentials keep being compromised, customer data may be exposed, or you cannot distinguish malicious code from legitimate custom code.
When should I request removal of a Google hacked-site warning?
Only after cleaning and updating the site, rotating credentials, verifying the fix with fresh scans, and removing malicious pages or downloads. Then submit the review through Google Search Console.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
