Scanning and removing website malware: a complete guide
Removing malware from your site is an urgent task that you cannot put off. Every day your website is infected, your visitors are at risk and your position in Google drops. In this complete guide you learn how to remove malware from your site, how to detect an infection and which steps to take to get your site clean and safe again. We cover both manual and automated methods for detecting and removing malware.
What is website malware and how does your site get infected?
Website malware is malicious code that is placed on your website without your knowledge. This code can have various goals: stealing data from visitors, spreading spam, redirecting traffic to other sites, or using your server for cryptocurrency mining. It is crucial to treat removing website malware as a priority as soon as you discover an infection.
Common infection methods
- Outdated software - un-updated WordPress, plugins or themes with known vulnerabilities
- Weak passwords - brute-force attacks on FTP, SSH or admin panels
- Insecure plugins - plugins from unreliable sources with backdoors
- Cross-site scripting (XSS) - vulnerabilities in forms or input fields
- SQL injection - attacks on unsecured database queries
- Compromised FTP details - through malware on your own computer
Most infections stem from outdated software. Regularly updating WordPress is therefore one of the most important preventive measures.
Symptoms: how do you recognise website malware?
Removing website malware starts with recognising an infection. Sometimes malware is clearly visible, but often it operates invisibly in the background. Watch out for these warning signs:
Visible symptoms
- Your website shows unknown content, pop-ups or advertisements
- Visitors are redirected to other (often dubious) websites
- Google shows a warning "This site may harm your computer"
- Your browser blocks your website as unsafe
- Your website loads much slower than normal
- Unknown user accounts in your CMS
Hidden symptoms
- Unexplained spikes in server usage (CPU, memory)
- Unknown files or folders on your server
- Modified core files of your CMS
- Suspicious database entries
- Unusual outgoing connections from your server
- Spam emails being sent through your server
Scanning your website for malware: the best tools
Before you can remove website malware, you have to locate the infection. There are several tools available for scanning your website for malware:
| Tool | Type | Cost | Functionality |
|---|---|---|---|
| Sucuri SiteCheck | Online scanner | Free | Basic malware scan, blacklist check |
| Wordfence (WordPress) | Plugin | Free/Premium | In-depth scan, firewall, real-time protection |
| MalCare | Plugin/SaaS | Paid | Automatic detection and removal |
| VirusTotal | Online scanner | Free | Multi-engine scan of URLs |
| Google Search Console | Online tool | Free | Security issues and warnings |
| Imunify360 | Server-level | Paid | Server-wide malware detection |
Removing website malware: a step-by-step guide
Now that you know how to detect malware, it is time to put removing website malware into practice. Follow these steps carefully and in the right order:
Step 1: Make a backup before you begin
Before you change anything, make a full backup of your website including files and database. Although the backup is infected, you need it as a reference and if you have to undo changes. Read our guide on making a website backup for more information.
Step 2: Put your website in maintenance mode
Put your website in maintenance mode or temporarily block all access. This prevents visitors from being exposed to the malware while you are cleaning up. You can do this through your .htaccess file or through a maintenance plugin.
Step 3: Change all passwords
Change immediately all passwords related to your website. This includes: FTP/SFTP passwords, database passwords, CMS admin passwords, hosting panel passwords and SSH keys. Use strong, unique passwords for each account.
Step 4: Scan and identify infected files
Use the tools mentioned earlier to carry out a thorough scan. Pay special attention to recently modified files, files in upload folders and files with suspicious names. Also check whether there are unknown files present in the core folders of your CMS.
Step 5: Remove the malware
There are two approaches to actually removing website malware: manually or automatically.
Removing website malware manually
With manual removal you download all files through FTP and compare them with a clean installation of your CMS. Remove or replace all files that differ. Search files for suspicious code patterns such as:
- base64_decode - often used to obscure malicious code
- eval() - executes arbitrary code
- gzinflate - used for compressed malicious code
- preg_replace with the /e modifier - can execute code
- Unknown iframe tags - load external content
Removing website malware automatically
Tools such as Wordfence Premium and MalCare can automatically detect and remove malware. This is faster and more reliable than manual removal, but it does cost a subscription. For WordPress sites, Wordfence is the most-used option.
Step 6: Clean up the database
Malware can also be present in your database. Use phpMyAdmin to find and remove suspicious entries. Search specifically for:
- Unknown admin accounts
- Suspicious JavaScript code in posts or pages
- Modified site URL or admin URL settings
- Unknown cron jobs or scheduled tasks
Step 7: Update everything
After removing the malware, update all software to the latest version: your CMS, all plugins, themes and any frameworks. Also remove all unused plugins and themes, because these form an unnecessary attack surface.
Step 8: Check and restore your reputation
If Google has blocked your site, request a review through Google Search Console. Also check whether your IP address or domain is on blacklists through tools such as MXToolbox. It can take several days before all warnings disappear.
Prevention: prevent future malware infections
After successfully removing website malware, it is essential to take measures that prevent future infections. Prevention is always better and cheaper than cure.
Technical measures
- Always keep all software up to date
- Use an SSL certificate for encrypted connections
- Install a Web Application Firewall (WAF)
- Limit file permissions to the minimum necessary
- Disable directory listing
- Use SFTP instead of FTP
- Implement two-factor authentication
Operational measures
- Make automatic backups daily
- Scan your website for malware weekly
- Monitor your website for unusual activity
- Use strong and unique passwords
- Train employees in cyber security
- Keep an incident response plan
WordPress-specific malware prevention
Because WordPress is the most-used CMS, it deserves special attention in the area of malware prevention. Here are WordPress-specific tips that help prevent infections:
- Download plugins and themes only from wordpress.org or reliable sources
- Never use nulled (illegally cracked) themes or plugins
- Limit the number of login attempts with a plugin like Limit Login Attempts
- Change the default wp-admin URL
- Protect wp-config.php with extra file permissions
- Disable file editing in the dashboard (DISALLOW_FILE_EDIT)
Also read our extensive guide on WordPress maintenance for a complete overview of all security and maintenance measures.
When do you call in a professional?
Although you can remove a lot of malware yourself, there are situations in which it is wise to call in a security expert. This applies especially to complex infections that keep coming back, when your server is used as part of a botnet, in the event of data breaches involving personal data, or when you are not technically skilled enough to analyse files.
Professional malware removal services cost between 100 and 500 euros, depending on the complexity. This may seem like a lot, but the costs of a prolonged infection in terms of lost traffic, reputation damage and possible fines are usually much higher.
Summary and action points
Removing website malware is a process that requires thoroughness and system. By following the steps in this guide, you can successfully clean up most infections. The most important thing is to act quickly as soon as you discover an infection, to scan all files and the database thoroughly, to take preventive measures after cleaning up and to regularly check whether your website stays clean. With the right knowledge and tools you can effectively protect your website against malware and intervene quickly when necessary.
Frequently asked questions about removing website malware
Many questions come up when removing website malware. Below we answer the most frequently asked questions so that you are well prepared.
How long does it take to remove malware?
Removing malware takes on average 1 to 4 hours, depending on the complexity of the infection. Simple malware such as injected scripts can be removed in less than an hour. Complex infections with backdoors and modified core files can take a whole day. Automatic tools such as Wordfence can speed up the process considerably, but manual checking remains necessary for a thorough cleaning.
Can I prevent malware with only a security plugin?
A security plugin is an important first step, but on its own it is not sufficient. Effective malware prevention requires a layered approach: regular software updates, strong passwords, a firewall, limited file permissions and regular backups. Consider a security plugin as part of your total security strategy, not as the only measure.
How do I know if my website is hacked?
The most common signs are: unknown files on your server, modified core files, unknown administrators in your CMS, a sudden drop in search traffic, Google warnings in Search Console, and spam being sent from your server. Regular malware scans help to detect infections early, often before visible symptoms occur.
Malware types that affect websites
To be able to fight malware effectively, it is useful to know the different types that affect websites. Backdoors are hidden access points that hackers leave behind to return later, even after you have cleaned up the original infection. Spam scripts send unwanted emails through your server, which harms your IP reputation. Cryptominers use the computing power of your server or the browsers of your visitors to generate cryptocurrency. Defacement malware replaces your website content with a message of its own. SEO spam injects invisible links or redirects to dubious websites to improve their search position at the expense of your domain authority. Recognising the type of malware helps in choosing the right removal method and implementing targeted preventive measures.
Removing website malware: step-by-step forensic investigation
Before you start removing website malware, a thorough forensic investigation is essential. This not only helps with the cleanup, but also prevents reinfection. Start by identifying the type of malware and the infection route.
Common malware types and their characteristics
| Malware type | Symptoms | Risk | Removal difficulty |
|---|---|---|---|
| Backdoor scripts | Unknown PHP files, strange uploads | Full server access | Medium |
| SEO spam injection | Hidden links, redirects to spam | Search engine blacklisting | High |
| Cryptominer scripts | High CPU usage, slow website | Performance and reputation | Low |
| Phishing pages | Fake login pages in subdirectories | Legal liability | Low |
| Database injection | Malicious code in database records | Data theft | Very high |
With an infection, always check the server access logs. Look for unusual POST requests, uploads to unexpected directories and requests to files that should not be there. With targeted log analysis you find commonly used obfuscation patterns that hide malware in seemingly innocent files.
Automatic malware scanners versus manual checking
There are two main approaches to detecting and removing website malware: automatic scanners and manual checking. Both have advantages and disadvantages that you have to weigh.
Automatic scanners such as Sucuri SiteCheck, VirusTotal and Wordfence scan your website for known malware signatures. They are fast and effective for known threats, but often miss custom-made malware or advanced backdoors written specifically for your website.
Manual checking is more time-consuming but more thorough. Compare files with the original source code, check database tables for suspicious input and analyse .htaccess files for unauthorised redirects. Especially with WordPress websites, comparing core files with the official version is an effective method.
- Download a clean copy of WordPress, your theme and plugins
- Compare file sizes and checksums with the originals
- Pay extra attention to wp-config.php, .htaccess and index.php files
- Check the wp_options table for unknown entries
- Search for unknown admin users in the database
Preventing reinfection after removing malware
Removing malware is only half the work. Without structural measures, reinfection is only a matter of time. Follow this action plan to keep your website clean for good:
- Change all passwords - FTP, database, admin accounts, hosting panel and SSH keys. Use a password manager for strong, unique combinations.
- Update everything - CMS, theme, plugins and server software. Outdated software is the main cause of infections.
- Install a firewall - a website firewall blocks malicious traffic before it reaches your website.
- Enable two-factor authentication - protect admin accounts with two-factor authentication as an extra security layer.
- Set up file monitoring - tools such as OSSEC or Wordfence warn you of unauthorised file changes.
- Make regular backups - keep at least three recent backups in an external location, separate from your web server.
Also consider using server monitoring tools to detect abnormal behaviour early. A sudden rise in CPU usage or outgoing traffic can indicate a new infection. Good WordPress security plugins offer real-time monitoring and automatic blocking of suspicious IP addresses.
When to call in professional help with malware
Not every malware infection can be solved yourself. In certain cases professional help is necessary to prevent further damage. Call in a specialist when:
- The malware returns after several cleanup attempts
- Your website is on the Google Safe Browsing blacklist
- There are indications that customer data has been stolen (notification obligation under the GDPR)
- The infection has spread to several websites on the same server
- You no longer have access to your own hosting account
Professional malware removal services cost on average between 150 and 500 euros, depending on the complexity. This usually includes a complete scan, cleanup, hardening and monitoring for a certain period. With a hosting plan with managed security, such problems are often handled by the provider, which is an important advantage of managed hosting over unmanaged solutions.
Removing website malware: a preventive security policy
The best time to think about removing website malware is before it is needed. A preventive security policy considerably reduces the risk of infection and speeds up recovery when it does go wrong. Implement these preventive measures as a standard procedure for every website you manage.
Set up a security schedule that includes the following periodic tasks: daily automatic backups to an external location, weekly malware scans with a reliable scanner, monthly checking of all user accounts and their rights, quarterly updating of all passwords for critical systems, and half-yearly penetration tests to identify vulnerabilities before attackers find them.
Limit the attack surface by removing unused plugins and themes, not only deactivating them. Every extra plugin is a potential vulnerability. Use the principle of least privilege: give users only the minimal rights they need for their work. An editor does not need admin rights, and a guest author does not need to be able to install plugins. Document who has access to which systems and check this regularly.
The cost of a malware infection for businesses
The real cost of a malware infection goes far beyond the direct cleanup costs. When you calculate the full impact, it becomes clear why prevention is always cheaper than recovery. The direct costs include professional cleanup services, revenue loss during downtime and possible fines for a data breach under the GDPR. The indirect costs are often even greater: reputation damage with customers and search engines, loss of search engine rankings after blacklisting by Google, and the time loss for internal staff involved in the recovery. For online stores there is also the loss of customer trust, which can take months to recover. So invest in prevention: a good hosting plan, regular updates and professional security tools cost a fraction of what a successful attack costs.
Checklist for removing website malware
Use this step-by-step checklist when you suspect that your website is infected with malware. Working systematically prevents you from skipping steps that could cause reinfection later when removing website malware.
- Make a full backup of the current (infected) state for forensic investigation
- Immediately change all FTP, SSH and database passwords through a clean device
- Scan all files with at least two different malware scanners
- Compare suspicious files with the original source files of your CMS and plugins
- Check the database for suspicious input, particularly in user tables and options
- Remove all detected malware and replace affected files with clean versions
- Update all software including CMS core, theme, plugins and server software
- Check and restore file permissions to the correct values
- Submit a review request to Google if your website is on the blacklist
- Monitor the website intensively for at least four weeks after the cleanup
Keep the logs and documentation of the incident for at least a year. This is valuable for future reference and may be needed for legal purposes or insurance claims.
Sources and references
- WordPress.org - Official documentation (wordpress.org)
- Wordfence - WordPress Security Report (wordfence.com)
- Sucuri - Website Security Research (sucuri.net)
- Dutch Data Protection Authority - GDPR information (autoriteitpersoonsgegevens.nl)
