A security checklist tells you what to lock down before anything happens. A full incident-response guide tells you what to do once you’re sure you’ve been breached. This page sits in between: the part where you suspect something is wrong, need to find out for certain, and have to actually locate and remove whatever’s living in your files — using the right tool for the job instead of guessing.

If you’ve already confirmed a breach and need the full ordered response — containment, credential rotation, entry-point patching, clearing Google’s warnings, legal notification — that’s covered start to finish in our website security breach recovery guide. This page goes deep on one piece of it: detecting malware accurately, choosing scanning tools that actually find it, and cleaning it out without leaving something behind.

1. Signs Your Site May Be Infected

Some infections announce themselves with a browser warning. Many don’t — a lot of malware is designed specifically to stay quiet on the front end while doing its work elsewhere. These are the more technical, more specific signals worth watching for beyond the obvious “Google flagged me”:

• Unexpected outbound traffic or resource spikes — a jump in outbound email volume, bandwidth, or CPU usage that doesn’t match your own activity is a classic sign of a site sending spam, mining cryptocurrency, or feeding a botnet
• Unfamiliar files with recent modification timestamps — sorting your file listing by modified date and finding files you didn’t touch, especially in wp-content/uploads, theme directories, or the site root, is one of the most reliable early tells
• Your domain shows up in Google’s index with content you never wrote — searching site:yourdomain.com and finding spam, pharma, gambling, or counterfeit-goods pages is the “Google Search listing hack” pattern, where injected pages are often shown only to Googlebot and hidden from normal visitors (cloaking)
• Browser warnings on your own domain — “Deceptive site ahead,” “This site may be hacked,” or similar, in Chrome or Safari
• Blocklist status — your domain or IP appearing on Google Safe Browsing, Norton Safe Web, or a spam blocklist, sometimes discovered only when a visitor reports it or your email bounces
• Unexplained new admin users, scheduled tasks, or files mimicking legitimate core files — a file named almost identically to a real WordPress core file, off by one character, is a common disguise technique
• Visitors reporting redirects you can’t reproduce yourself — another cloaking pattern, where the redirect only fires for certain visitors (mobile users, or those arriving from search)

Any single item can have an innocent explanation. Several together, or any one paired with an external warning from Google, your host, or a visitor, is worth treating as a real infection until you’ve ruled it out.

2. Confirm It’s Malware, Not Something Else

Before you start ripping out files, it’s worth ruling out the non-malicious explanations that produce similar symptoms — chasing a phantom infection wastes time and, if you delete the wrong thing, can break a perfectly clean site.

• A plugin or theme conflict can produce broken layouts, PHP errors, or unexpected redirects that look alarming but have nothing to do with an attacker — deactivating plugins one at a time on a staging copy is a fast way to check
• A bad update to your CMS core, a plugin, or your PHP version can break functionality in ways that mimic defacement or broken pages
• Caching or CDN issues can serve stale or mismatched content that looks like unauthorized changes but is just an outdated cached copy — clearing your cache before investigating further saves a lot of false alarms
• Scanner false positives happen — heuristic and signature-based scanners occasionally flag legitimate code (minified JavaScript, certain theme frameworks, or plugins that use eval() or obfuscation for legitimate licensing reasons) as suspicious. A single scanner flag on one file, with no other symptoms, warrants a manual look before you conclude you’re compromised

3. Free & Built-In Scanning Tools

Before installing anything or paying for a service, several free tools can confirm or rule out an infection in minutes.

• Google Search Console’s Security Issues report — if Google’s crawlers detected malware, injected spam, or deceptive pages, this report (under Security & Manual Actions) names the specific issue and example URLs. It’s the same report the breach recovery guide covers requesting a review through, once you’ve cleaned up.
• Google Safe Browsing’s site status checker — at transparencyreport.google.com/safe-browsing/search, this checks any domain’s current blocklist status directly, useful when you don’t have Search Console access to a site yet
• VirusTotal — submitting your domain or a suspicious URL runs it against dozens of antivirus and blocklist engines at once, a fast way to see whether multiple vendors are flagging you, not just one
• Host-bundled scanners — many hosting providers (including several this site reviews) run a scanner automatically at the account level, most commonly Imunify360 or its lighter free counterpart, ImunifyAV, integrated into cPanel. Check it first if your host includes one — it’s already scanning on a schedule

4. Security Plugins for WordPress & Other CMS

A dedicated security plugin generally scans more thoroughly and more often than a host’s baseline scanner. Feature splits and pricing on all of these change fairly often, so treat the specifics below as directional and check each vendor’s current plans before deciding.

• Wordfence — free version includes a firewall, a malware scanner checking core files, themes, and plugins against known-good copies, and login-security features like two-factor authentication. The free firewall’s threat updates lag (commonly around 30 days) behind premium’s real-time feed, and premium adds real-time IP blocklisting, country blocking, and more frequent scans.
• Sucuri — the free SiteCheck scanner is a remote, no-install web scan for visible malware, blocklist status, and known spam. The paid Website Security Platform adds server-side file scanning that can see hidden backdoors a remote scan can’t, plus continuous monitoring and a cleanup service; Sucuri advertises unlimited cleanups on every plan and a 30-day guarantee with that paid platform.
• MalCare — built around fast, off-server scanning. Its free tier detects malware but doesn’t remove it — MalCare is upfront that removal requires a paid plan, which also adds instant cleanup, more frequent scans, and virtual patching for known vulnerabilities.
• Kadence Security (the plugin formerly known as iThemes Security, then Solid Security, following Liquid Web’s 2026 consolidation into the Kadence WordPress suite) — leans more toward hardening (brute-force protection, file change detection, backups) alongside scanning, worth comparing if prevention matters more to you than cleanup tooling.

Read the specific file paths and detections each tool reports rather than clicking “clean” blindly — especially before letting an automated tool delete or modify a file you can’t otherwise account for.

5. Server-Level & Command-Line Scanning

With SSH access to a VPS or dedicated server, command-line tools can go places browser-based and plugin-based scanners can’t — worth using even after a plugin scan.

ClamAV

ClamAV is a free, open-source antivirus engine that runs directly on your server. It’s signature-based, so it’s strongest against known malware and weaker against brand-new or heavily custom-obfuscated code — use it alongside, not instead of, the pattern-searching below.

# scan a directory recursively, showing only infected matches
clamscan -r --infected /home/username/public_html

# move anything infected to a quarantine folder instead of deleting outright
clamscan -r --infected --move=/home/username/quarantine /home/username/public_html

WordPress Core File Verification

If you run WordPress and have WP-CLI available, wp core verify-checksums compares your live core files against the official checksums published by WordPress.org — any core file that’s been modified (a common way attackers hide a backdoor inside a file that looks legitimate) will show up as a mismatch.

# verify installed core files against WordPress.org's published checksums
wp core verify-checksums

# output as JSON if you want to script a comparison
wp core verify-checksums --format=json

A clean result prints success; a compromised install lists the specific files that don’t match, which is a direct lead on where to look. Note this only covers WordPress core — it won’t catch malware injected into a plugin, theme, or the uploads directory, which is where infections most often actually live.

Searching for Signature Patterns

A large share of injected PHP malware relies on obfuscation to hide from casual inspection — most commonly, encoding the malicious payload so it doesn’t read as recognizable code, then decoding and executing it at runtime. A widely documented pattern to search for is code that pairs PHP’s eval() function with base64_decode(), since that combination has little legitimate use in typical theme or plugin code:

# search recursively for a common obfuscation pattern
grep -r -l "eval(base64_decode" /home/username/public_html

# broaden to a couple of other commonly abused function pairings
grep -r -lE "eval(|base64_decode(|gzinflate(" /home/username/public_html --include=*.php

6. Common Malware Types & Where They Hide

Knowing what you’re likely looking for narrows the search considerably. These are the patterns website owners run into most often:

It’s common to find more than one of these at once — a backdoor is frequently what let the attacker install the SEO spam or cryptominer in the first place, so finding one type is a strong reason to keep looking for the others rather than stopping at the first thing you clean.

7. Manual Cleanup Steps

This section assumes containment is already handled — the site is offline or in maintenance mode, your hosting password has already been changed, and you’ve preserved a copy of the infected state for reference. If you haven’t done those yet, stop here and complete Steps 1–2 of the breach recovery guide first; credential rotation and entry-point patching from that same guide still need to happen after cleanup, regardless of how the malware itself gets removed.

8. Verifying the Site Is Actually Clean

“I removed everything I found” and “the site is clean” are different claims. Before declaring victory:

• Re-scan with a different tool than the one you cleaned with — don’t trust the same tool to confirm its own work
• Check Google Search Console’s Security Issues report again — a clean result days after cleanup is a stronger signal than an immediate re-check, since some detections take time to update
• Check Safe Browsing and VirusTotal status again a few days later, not just immediately — blocklist status doesn’t always clear the instant the cause is gone
• Monitor for a period afterward — one to two weeks watching resource usage, new file changes, and scan results is a reasonable window to catch a missed backdoor
• Only then request Google’s security review if you were flagged — the breach recovery guide’s Section 8 covers that process; submitting before you’re confident risks a rejected review and a longer wait

9. When to Call a Professional vs. DIY

Professional malware removal services (Sucuri’s cleanup service, MalCare’s paid removal tiers, and similar providers like Astra Security) generally go beyond the free and DIY tools here: server-side scanning across the whole account rather than just the CMS, human review before removal, and often a stated guarantee or unlimited-cleanup commitment if the infection returns within a defined window. Exact guarantees, response times, and pricing vary by provider and change over time, so confirm current terms directly rather than relying on a secondhand summary.

DIY with the tools in this guide is reasonable when the infection is a single, well-identified issue (one flagged file, one injected snippet), you’re comfortable with SSH/file-manager access and can tell legitimate code from injected code, and downtime while you work isn’t critically costly.

A professional service is usually the better call when you’re not confident you’ve found every backdoor (especially after a prior cleanup didn’t hold), the site is business-critical and a second incident would be expensive, or the infection is spread across many files beyond what you’re comfortable investigating yourself.

10. Reinfection Prevention Checklist

The breach recovery guide’s prevention section covers the fundamentals — updates, strong passwords and 2FA, backups, a firewall, removing unused plugins. These are additional, scanning-and-hardening-specific habits worth layering on top:

• Schedule recurring automated scans (weekly at minimum), not just when something looks wrong
• Disable PHP execution in your uploads directory — see our .htaccess file guide, since it closes off one of the most common places backdoors hide
• Set a recurring reminder to check Search Console’s Security Issues report, not just after an incident
• Keep a known-clean file inventory or checksum baseline for core files so future comparisons are fast
• Layer a web application firewall in as ongoing protection, not just a post-incident response — see our WAF guide
• Pair scanning with uptime and integrity monitoring so a spike or defacement is caught in hours, not weeks — see our monitoring guide
• Keep a recent, verified-clean backup on hand so a bad scan result isn’t your only option — see our backup and restore guide

11. Frequently Asked Questions