WordPress malware removal

What we find on hacked WordPress sites

In the incidents we have cleaned up, the visible symptom was rarely the whole problem. Alongside the obvious malware we have found:

• Hidden administrator accounts that do not show in the Users screen and recreate themselves when deleted.
• Fake plugins with believable names that remove themselves from the Plugins list while they keep running.
• Injected scripts in theme files, plugin templates and the database, often only shown to some visitors.
• Fake browser checks that tell visitors to press a key combination or paste a command, which installs malware on their own computer.
• Credential stealers that capture logins, and scheduled tasks that reinstall everything overnight.
• Hidden spam links pushed off-screen inside page content, invisible to visitors and editors but read by search engines.

That last one is the case we wrote up in detail: how we removed a hidden SEO spam infection from BenchmarkTitle.net, from the page-builder forensics to the database cleanup and the compromised plugin that let it in.

A scan-and-delete cleanup misses most of this, which is why sites get reinfected.

Evidence first

Before anything is deleted, we keep a copy of it. You get a record of what was on the site, and nothing legitimate is lost because it was mistaken for malware.

Staying clean

After a cleanup we can keep watching the site with Guardian Shield Lite, the security plugin we built from these incidents. It blocks new code from running until it is approved and alerts us to new administrators, changed files and known malware.