- Article
- Intermediate
- 2 minutes read
- Reviewed August 4, 2026
Malware can modify files, database content, users, scheduled tasks, server configuration and external integrations.
One scanner can detect known patterns, but a complete investigation compares several forms of evidence.
Possible Symptoms
Warning signs include:
- Search spam or unknown pages.
- Redirects to another site.
- New administrators.
- Modified core files.
- Unknown plugins.
- Unexpected scheduled tasks.
- High resource use.
- Antivirus or browser warnings.
- Outgoing spam.
- Security-provider alerts.
- Changes returning after cleanup.
A symptom can also have a non-malicious cause, so preserve evidence and investigate.
Isolate and Preserve
Before destructive cleanup:
- Record the time and symptoms.
- Preserve relevant logs.
- Create a forensic copy where possible.
- Restrict access if users are at risk.
- Avoid overwriting evidence with repeated scans or updates.
- Contact the host when server compromise is possible.
Compare Files
Compare WordPress core with a known-good package.
Review themes and plugins against trusted vendor releases or version control. Unknown or modified files require investigation, but custom code and caches can create legitimate differences.
Review the Database
Check:
- Administrator users.
- Options and active plugins.
- Scheduled tasks.
- Injected scripts.
- Spam posts.
- Modified widgets and templates.
- Unexpected API credentials.
Use Scanners Carefully
Combine:
- Endpoint or server scanning.
- File-integrity checks.
- External URL scanners.
- WAF reports.
- Host analysis.
- Manual review.
A clean result does not prove absence of compromise.
Find the Entry Point
Cleaning visible malware without fixing the cause leads to reinfection.
Investigate vulnerable software, stolen credentials, exposed services, weak permissions and supply-chain events.
Frequently Asked Questions
Can I trust a single security plugin scan?
It is useful evidence but not definitive proof.
Should I delete every unfamiliar file?
No. Preserve evidence and compare against known sources before removal.
Continue Learning
Previous: [Security Logs and Monitoring](/resources/wordpress-manual/security/security-logs-monitoring/)
Next: [What to Do When a WordPress Website Is Hacked](/resources/wordpress-manual/security/wordpress-hacked-response/)