Blog

Malicious code in WordPress is usually quiet on purpose: it hides in normal-looking files, waits for traffic, and only shows symptoms when the damage is already underway.

If your website is redirecting visitors, sending spam, showing strange files in your hosting account, or suddenly getting security warnings, checking your WordPress files is one of the first places to start. The goal is not just to find “bad code” once. The goal is to understand what changed, how it got there, and whether the attacker left a way back in.

This guide explains how to check WordPress files for malicious code in a practical way, without pretending every business owner needs to become a malware analyst.

Before You Touch Anything: Make a Backup

Before deleting or editing files, take a full backup of the site. That means both the website files and the database.

This might sound backwards. Why back up a hacked site? Because if something breaks during cleanup, you need a restore point. A hacked backup is not ideal, but no backup is worse.

If you already have a clean backup from before the infection, even better. Keep both copies separate and clearly labelled so you do not accidentally restore the infected version later.

Tip: Do not rely only on a WordPress backup plugin if the site is actively compromised. If the attacker has admin access, plugin-generated backups may also be tampered with. A hosting-level backup is safer when available.

Ambrite hosting includes security-focused infrastructure such as LiteSpeed, NVMe SSD storage, and Imunify360 scanning on supported plans. If your current host does not provide reliable backups or malware scanning, it may be time to review your hosting setup. Our cloud web hosting starts at $7.99/month CAD.

Start with the Obvious Signs

Before digging through files, write down what you are seeing. This helps narrow the search.

Common symptoms include:

• Visitors are redirected to spam, gambling, adult, crypto, or fake update pages
• Google shows a security warning for your domain
• Your hosting account contains files you do not recognize
• WordPress admin users appear that you did not create
• SEO titles or descriptions are replaced with spam text
• Your contact forms or WooCommerce emails stop sending properly
• The site becomes unusually slow or uses excessive server resources
• Security plugins report modified core files

If you are still trying to confirm whether the site is actually hacked, see How to Tell If Your WordPress Site Is Hacked. Hidden infections are especially common, so do not assume everything is fine just because the homepage looks normal.

Know What a Clean WordPress File Structure Looks Like

You cannot spot suspicious files if you do not know what normally belongs there.

A typical WordPress installation has three main directories at the site root:

• wp-admin — WordPress dashboard files
• wp-includes — WordPress core system files
• wp-content — themes, plugins, uploads, and site-specific files

There are also core files in the root folder, including files such as wp-config.php, wp-login.php, and index.php.

Most malware hides in places where it can blend in. The most common locations are:

• wp-content/uploads, because uploads are expected to contain many files
• wp-content/plugins, especially old or abandoned plugin folders
• wp-content/themes, especially unused themes
• The site root, beside normal WordPress files
• Random subfolders with names that look technical but do not belong

WordPress core folders should generally not contain custom PHP files that appeared recently. Upload folders should usually contain media files, not executable PHP scripts.

Check Recently Modified Files

One of the fastest ways to find suspicious activity is to sort files by “last modified” date in your hosting file manager, SFTP client, or server tools.

Look for files changed around the time the problem started. For example, if redirects began this week, recently modified PHP files deserve attention.

Be careful, though. Some legitimate files change during plugin updates, cache rebuilds, image optimization, and theme changes. A modified date is a clue, not proof.

Files to Inspect Closely

Pay extra attention to:

• index.php files in unexpected folders
• .php files inside uploads folders
• Files with random names such as long strings of letters and numbers
• Files pretending to be images, such as names ending in unusual double extensions
• Recently modified theme files you did not edit
• New files placed in plugin folders for plugins you have not updated
• Files with permissions that seem unusually open

If you find a suspicious file, do not immediately delete it unless you have a backup. First, download a copy for reference. It may help identify how the infection works.

Compare WordPress Core Files Against a Clean Copy

WordPress core files should match the official WordPress release for your installed version. If a core file has been changed and you did not intentionally modify WordPress core, that is suspicious.

Security plugins and hosting scanners often check this automatically by comparing your files against known clean versions. If you are comfortable with command-line tools, WP-CLI can also verify core file integrity, but use current official documentation for the safest syntax and workflow.

For most small business owners, the practical approach is:

1. Check the WordPress dashboard to identify the installed version.
2. Download a clean copy from the official WordPress source.
3. Compare core folders and files against your live site.
4. Replace modified core files with clean copies where appropriate.

Do not overwrite wp-config.php or wp-content blindly. Those contain site-specific settings, uploads, themes, and plugins.

When not to DIY: If your site handles client files, patient inquiries, legal intake forms, payment data, or other sensitive information, do not experiment on the live site. Get professional help and preserve evidence before making major changes.

Look for Common Malicious Code Patterns

Malware changes constantly, so there is no magic list that catches everything. Still, certain patterns show up often in infected WordPress files.

Suspicious code may include:

• Long unreadable strings of random-looking text
• Code that is heavily obfuscated to hide what it does
• Unexpected use of functions that decode or execute hidden code
• Remote requests to strange domains
• Files that recreate themselves after being deleted
• Code inserted at the very top or bottom of legitimate files

Some malware is obvious. You open a file and see a giant block of scrambled code that clearly does not belong.

Other infections are subtle. A single line may be inserted into a normal theme file, and that line may load malicious instructions from somewhere else.

Be Careful with False Positives

Not every weird-looking line is malicious. Some legitimate plugins use encoded code, remote API calls, scheduled jobs, or complex JavaScript.

This is why context matters. A payment gateway plugin, form plugin, or security plugin may contain code that looks complicated because it is doing complicated work.

If you are not sure, compare the file against a fresh copy of the same plugin or theme from the official source. Do not download “clean” copies from random websites.

Check Themes Carefully

Theme files are a favourite hiding place for malicious code because many site owners rarely inspect them.

Look inside your active theme and any child theme. Commonly modified files include template files, header files, footer files, and theme functions files.

Also check inactive themes. If you are not using a theme, remove it, except for a default fallback theme if you prefer to keep one installed.

Old commercial themes can be a problem if the licence expired and updates stopped. Attackers often target abandoned themes because known vulnerabilities remain open.

Check Plugins, Especially Old Ones

Plugins are one of the most common entry points for WordPress malware. A vulnerable plugin can allow attackers to upload files, inject code, create admin users, or alter database content.

Check your plugin list for:

• Plugins that have not been updated in a long time
• Plugins you no longer use
• Duplicate plugins that do the same job
• Unknown plugins you did not install
• Plugins downloaded from unofficial sources
• Abandoned premium plugins with expired update access

If a plugin folder exists in your files but the plugin does not appear in the WordPress dashboard, investigate it. It could be leftover junk, or it could be intentionally hidden.

For more background on how plugin weaknesses turn into real compromises, read How Hackers Exploit Outdated WordPress Plugins.

Inspect the Uploads Folder

The uploads folder should mostly contain images, PDFs, documents, and media generated by WordPress or plugins.

PHP files in uploads are a red flag. In most normal WordPress sites, uploaded media folders should not need executable PHP scripts.

Watch for:

• PHP files mixed in with images
• Folders with random names
• Files pretending to be cache files
• Recently modified files inside old upload folders
• Unexpected files inside year or month media directories

If a site was infected through a vulnerable upload form, this is often where the payload lands first.

Check wp-config.php and Root Files

The wp-config.php file contains sensitive configuration details, so attackers like to target it. Open it carefully and look for code that does not belong.

Normal wp-config.php content includes database connection settings, security keys, table prefix configuration, and WordPress constants. It should not contain spam links, strange remote scripts, or large blocks of unreadable code.

Also inspect root-level files. Malware often hides in files with harmless-looking names, or in files placed beside legitimate WordPress files so they are easy to miss.

If you see unfamiliar files in the site root, compare them against a clean WordPress installation and your known plugin or hosting requirements.

Search for Backdoors

Finding visible malware is only half the job. Attackers often leave backdoors so they can return after you clean the obvious infection.

A backdoor is code that gives someone unauthorized access later. It may be hidden in a plugin, theme, upload folder, or even a file that looks like part of WordPress.

Backdoors are dangerous because the site may look clean for a few days, then become infected again.

Common warning signs include:

• A suspicious file returns after deletion
• New admin users keep appearing
• Malware comes back after password resets
• Unknown scheduled tasks keep running
• Strange files are recreated in uploads or cache folders

If you suspect a backdoor, read WordPress Backdoors: What They Are and How to Find Them. Backdoor cleanup is one of the areas where professional help is often worth it.

Use Malware Scanners, But Do Not Trust Them Blindly

Security scanners are useful, but they are not perfect.

Tools such as Wordfence, Sucuri, MalCare, Patchstack, and hosting-level scanners can help detect known malware signatures, modified files, vulnerable plugins, and suspicious behaviour. Check each tool’s official site for current pricing, setup steps, and feature details.

A scanner can speed up the investigation, especially if you do not know where to start. But scanners can miss new malware, custom backdoors, and database-injected spam.

They can also flag legitimate code as suspicious. Always review results before deleting files.

Good Scanner Workflow

1. Run a scan from your hosting control panel if available.
2. Run a reputable WordPress security plugin scan.
3. Compare any flagged files against clean originals.
4. Quarantine suspicious files instead of deleting them immediately.
5. Scan again after cleanup.
6. Monitor for reinfection over the next several days.

Ambrite’s WordPress maintenance plans, starting from $49/month CAD, include security-minded maintenance for small businesses that would rather not handle this themselves. You can learn more about our WordPress maintenance and security services.

Do Not Forget the Database

This article focuses on files, but many WordPress infections also affect the database.

Attackers may inject malicious scripts into posts, pages, widgets, options, or plugin settings. That means you can clean every infected file and still have spam scripts loading from the database.

Signs of database infection include:

• Spam links appearing inside posts or pages
• Malicious scripts loading in the site header or footer
• SEO metadata changed to spam text
• Strange admin users created
• Unknown content appearing in widgets or theme settings

Database cleanup requires caution. Do not run broad search-and-replace operations unless you know exactly what they will affect. A careless database edit can break serialized data, plugin settings, or page builder layouts.

Check File Permissions

Bad file permissions can make reinfection easier. They may allow files to be modified when they should not be writable.

WordPress permissions vary depending on the hosting environment, so avoid copying random permission advice from forums without understanding your server setup.

As a general rule, files should not be more writable than necessary, and sensitive configuration files should be protected. If you are not sure what is appropriate for your host, ask your provider.

File permissions alone will not clean malware, but poor permissions can make the problem worse.

Replace Instead of Editing When Possible

If a WordPress core file is infected, replacing it with a clean copy is usually better than trying to manually remove malicious lines.

The same applies to plugins and themes. If you can get a clean current copy from the official source or the original developer, replacement is often safer than hand-editing.

There are exceptions. Custom themes, child themes, and modified plugins may contain legitimate custom work. Replacing them blindly can erase functionality.

Practical rule: Replace standard files from trusted sources. Review custom files carefully before overwriting anything.

When You Should Not Clean It Yourself

DIY cleanup is reasonable for a small brochure site if you have a backup, the infection is simple, and you are comfortable working with files.

It is not a good idea when:

• The site collects personal information through forms
• The site handles payments or WooCommerce orders
• The site belongs to a law firm, clinic, accountant, or other trust-based business
• You see repeated reinfections
• Your host has suspended the account
• Google has blacklisted the site
• You do not know whether customer or client data was accessed

For Canadian businesses, privacy obligations matter. If personal information may have been exposed, you may need to assess whether PIPEDA or provincial privacy rules apply to your situation. Do not guess. Speak with a qualified privacy professional if sensitive data may be involved.

After Cleanup: Close the Door

Removing malicious code is not enough. You need to fix the weakness that allowed it in.

After cleaning the files, take these steps:

• Update WordPress core, themes, and plugins
• Remove unused themes and plugins
• Reset all WordPress admin passwords
• Reset hosting, SFTP, database, and email passwords if compromise is suspected
• Remove unknown admin users
• Enable two-factor authentication for admin accounts
• Review file permissions
• Check for vulnerable plugins or themes
• Scan again after cleanup
• Set up ongoing monitoring

If you are not already using two-factor authentication, make that a priority. Passwords get reused, leaked, and guessed. Two-factor authentication adds a meaningful barrier even when a password is exposed.

What a Professional Review Usually Includes

A proper malware review is more than opening a few files and deleting suspicious code.

A professional cleanup typically includes:

• Full file scan
• Manual review of suspicious files
• Core file verification
• Theme and plugin inspection
• Upload folder review
• Database review for injected content
• Backdoor search
• User account audit
• Password reset recommendations
• Vulnerability assessment
• Post-cleanup monitoring

The most valuable part is often figuring out how the attack happened. If that part is skipped, the site may be cleaned today and hacked again next week.

A Simple Checklist You Can Use

If you want a practical starting point, use this checklist:

1. Take a full backup of files and database.
2. Record symptoms and when they started.
3. Sort files by last modified date.
4. Inspect recently changed PHP files.
5. Check uploads folders for executable files.
6. Compare WordPress core files with a clean copy.
7. Review active and inactive themes.
8. Review all plugins, especially old or unknown ones.
9. Inspect wp-config.php and root files.
10. Run reputable malware scans.
11. Check the database for injected scripts or spam content.
12. Search for backdoors.
13. Replace infected standard files from trusted sources.
14. Update everything after cleanup.
15. Reset passwords and remove unknown users.
16. Monitor for reinfection.

If you get stuck, stop before making irreversible changes. Deleting the wrong file can take a broken hacked site and turn it into a completely offline site.

Need Help Checking WordPress Files?

If you are comfortable reviewing files, scanners, backups, and plugins, you can handle some basic checks yourself.

If the site supports your business, collects leads, accepts orders, or stores sensitive information, it is usually safer to have someone experienced review it. Malware cleanup is not just about removing the visible problem. It is about finding the entry point, closing it, and making sure the attacker does not come back.

Ambrite helps Canadian small businesses with WordPress hosting, maintenance, malware review, and security hardening. If you want help checking suspicious WordPress files, contact us through Ambrite support and we can take a look.

This article was written with the help of AI and reviewed by the Ambrite team. Pricing, features, and technical details may change — always verify with official sources before making decisions.