Malware removal and recovery

WordPress Malware Removal Plugin: Repair, Quarantine and Recover

WP SecureGate works as a WordPress malware removal plugin once its scanner has found something: it restores modified core and WordPress.org plugin files from the official copies, quarantines or deletes planted files, and removes malicious database options after backing them up. It then walks you through signing everyone out, rotating your keys and scanning again. Each repair is a step you choose.

See plans & pricingAll features
  • ✓ One-click official restores
  • ✓ Quarantine you can undo
  • ✓ Recovery checklist built in

Restore official files

When the malware scanner finds that a WordPress core file, or a plugin file from WordPress.org, no longer matches its official checksum, you can look at the diff and then restore the official file in one click. The modified version is replaced with the copy WordPress.org shipped.

Premium and custom plugins have no official copy to restore from. If one of those is affected, reinstall it from a fresh download from its vendor.

Runs only when you click it, after a scan finding.

Malware quarantine for WordPress: undo, or delete

For a file that shouldn't exist at all, such as a PHP file in your uploads folder, you have two choices. Quarantine takes the file off the site but keeps it, so you can put it back if it turns out to belong to something you use. Delete removes it permanently.

If you aren't sure what a file is, quarantine it first and check the site still works. Delete it once you are sure.

Your choice for each finding. Nothing is quarantined or deleted automatically.

Removing malicious database options

Attackers often store code in autoloaded options, which WordPress loads on every page. When the database scan flags one, you can remove it. The plugin first takes an exact backup of the option, so you can restore it later if needed. Options WordPress needs to run are never removed.

Malware inside posts and pages is different. It is flagged so you know which content is affected, but it is not cleaned. You have to edit each infected post yourself and take out the injected code.

Removal is manual, one option at a time. Post content is only flagged.

The recovery checklist

Removing the files is half the job. Whoever planted them may still hold a session or a copy of your keys. Once an infection is confirmed, the plugin shows a checklist:

  • sign everyone out, so no stolen session cookie keeps working;
  • rotate the security keys (salts), which invalidates every existing login cookie;
  • scan again, to check nothing was missed or put back.

Shown after a confirmed infection.

How to clean a hacked WordPress site for good

A site that was broken into once will be tried again. After the cleanup, close the way in:

  • change the passwords for every administrator, and for your hosting, database and FTP accounts;
  • turn on two-factor authentication for administrators, which can be required by role;
  • switch on the strong-password rules and the leaked-password check, both off by default and offered in Recommended;
  • update WordPress, plugins and themes, and replace any plugin that's closed or abandoned.

When a plugin isn't enough

Be honest with yourself about how deep the damage goes. Malware can sit outside WordPress, in other sites on the same hosting account, in cron jobs or in the server itself, where no WordPress plugin can reach. If infections keep coming back after a full cleanup, ask your host for help or hire a professional.

WP SecureGate doesn't make backups. If you have a clean backup from before the infection, restoring it is often the fastest fix; then update everything and scan again. The activity log can help you date the break-in so you pick a backup from before it.

Part of WP SecureGate: Malware scanner →

Related protection

Malware scannerFile integrity checks, stray PHP detection and a database scan, run daily and after every plugin change.Activity logA tamper-evident log of sign-ins, user changes, settings changes and security events, kept for 90 days.Login securityLockouts, a custom login URL, password checks and 2FA, with a way back in if you ever lock yourself out.HardeningClose the side doors WordPress leaves open, with safe defaults and an undo for every change.

Questions about malware removal

Not always. A plugin can repair what it can see inside WordPress: core files, WordPress.org plugins, stray PHP files and database options. Malware elsewhere on the server needs your host or a professional.

Yes. Quarantine takes the file off the site but keeps it, so you can restore it if something breaks. Delete is the permanent option, best used once you're sure.

No. The database scan flags posts and pages with malware in their content, but it doesn't change them. Open each flagged post and remove the injected code yourself.

If you have a clean backup from before the infection, that's often quicker. WP SecureGate doesn't make backups, so it will come from your host or a backup plugin. Afterwards, run the recovery checklist and a fresh malware scan.

Every feature, in every plan

One licence covers the firewall, malware scanner, login protection, WooCommerce checkout protection and everything else. Plans differ only in the number of sites, and every charge has a 7-day refund.

Choose a planAsk a question