A malware cleanup on a small business website is not a single action — it is a sequence of steps that need to happen in the right order. Skipping steps or doing them out of order often leads to re-infection, broken functionality, or a cleanup that looks finished but leaves a backdoor in place. This checklist is a high-level map, not a step-by-step technical guide. Use it to understand the scope of what is involved before you start.
Backups, staging, and file review
Before making any changes, take a snapshot of the current infected state — files and database. This is not the backup you will restore from, but a record of what was present during the infection. Your hosting provider's automated backup (from before the infection date, if you can identify it) is your clean restore point.
If possible, clone the live site to a staging environment. A staging clone lets you test cleanup steps — file deletions, database modifications, plugin deactivations — without affecting what visitors see on the live site. If something breaks during cleanup, you have not broken production.
Use your hosting file manager or SFTP to review files sorted by modification date. Focus on PHP files that were recently modified and were not modified as part of a plugin or WordPress core update. Look specifically in /wp-content/uploads/ (should contain no PHP files), /wp-content/themes/your-active-theme/, and /wp-includes/. Unknown PHP files in these locations are suspicious.
Plugins, themes, and unknown admins
Review every installed plugin — active and inactive — against a list of plugins you intended to install. Attackers sometimes install backdoor plugins with names that resemble legitimate ones. Deactivate and delete any plugin you do not recognise or no longer use. Inactive plugins still present a vulnerability surface even though they are not running.
Check your active theme's files against the original from the theme developer. If the theme is a commercial or custom theme, compare against your last known clean version. Any additions to functions.php, index.php, or header.php that are not part of your normal customisation are suspect.
In the WordPress Users screen, check for admin-level accounts you did not create. Attackers often create a hidden admin account to maintain access after a password change. If you find unknown accounts, record their usernames and email addresses before deleting them — this information can help identify the attack vector.
Post-cleanup hardening and monitoring
After you are confident the site is clean, apply hardening steps before relaunching: update WordPress core, all plugins, and all themes to their latest versions; remove any plugins or themes that are no longer maintained; change all credentials (hosting, WordPress, FTP, database); enable two-factor authentication on admin accounts; and install a security plugin that provides file integrity monitoring and login protection.
- Take a snapshot of the infected state before making changes — for evidence and comparison.
- Clone to staging before cleaning production if your hosting plan supports it.
- Review files sorted by modification date — focus on PHP files in unexpected locations.
- Delete all plugins and themes you do not actively use.
- Audit the WordPress Users list and remove any accounts you did not create.
- After cleanup: update everything, change all credentials, enable 2FA, and set up monitoring.
- Re-scan with a security scanner after cleanup to confirm issues are resolved.
- Request a Google review through Search Console if a Safe Browsing warning was triggered.
Use this as a high-level recovery map before touching production files.
Check hacked website symptoms