When a WordPress site gets hacked, one of the first recommendations is usually:
- run a malware scanner,
- reinstall WordPress,
- update plugins,
- change passwords,
- and install a security plugin.
Those steps can be useful.
But after working on real compromised WordPress sites, I kept seeing incidents that did not fit neatly into that checklist.
A site could look completely normal on desktop while mobile visitors were redirected to spam.
A malware scanner could report nothing while malicious JavaScript was stored inside the WordPress database.
The WordPress Users screen could show one administrator while another privileged account was hidden by malicious code.
A clean-looking plugin could be legitimate software but still contain an unauthorized code snippet stored through its database settings.
And sometimes the WordPress files were clean because the real problem was outside WordPress entirely—in the server, DNS, CDN, or hosting account.
That is why I started writing WordPress Malware Removal for Developers & Site Owners.
It is a practical, evidence-led field guide built around real malware cleanup cases.
Why I Wanted to Write This Book
There is already a huge amount of WordPress security information online.
The problem is that a lot of malware-removal content stops at detection.
You are shown suspicious files, common malware signatures, security plugins, or a list of folders to check.
But in a real investigation, finding a suspicious file is often only the beginning.
You still need to answer questions like:
- Is this file actually malicious?
- What caused the behavior the visitor reported?
- Is the malware stored in a file or in the database?
- Why does the redirect appear only on mobile devices?
- Why did the malware return after it was deleted?
- Is an unfamiliar administrator actually unauthorized?
- Is a plugin fake, modified, or simply custom?
- Did a checkout script actually steal card data, or do we only have evidence that it could?
- Did the attacker enter through WordPress at all?
- What else needs to be cleaned before the site can be trusted again?
Those are the questions I wanted the book to focus on.
The goal is not to teach readers to search for scary-looking PHP functions.
The goal is to teach them how to follow the evidence.
WordPress Malware Removal Is More Than Cleaning Files
One of the main ideas in the book is that a hacked WordPress site has several different layers.
Malware may exist in:
- WordPress core files,
- plugins,
- themes,
-
mu-plugins, - uploaded or hidden PHP files,
- the WordPress database,
- user accounts and permissions,
- scheduled tasks,
- server configuration,
- hosting accounts,
- DNS records,
- CDN rules,
- or another website sharing the same hosting environment.
That is why simply deleting the first malicious file you find can fail.
The file may only be the visible payload.
Something else may still be able to recreate it.
Real Cases Instead of Generic Malware Examples
A large part of the book is based on real cleanup and research cases.
The examples are used to explain how an investigation develops—not just to show screenshots of malicious code.
Conditional WordPress Redirect Malware
In one case, the site owner could browse the website normally from a desktop computer.
Visitors using phones were redirected elsewhere.
The difference turned out to matter more than the first malware scan.
The malicious rule checked the visitor's device before deciding whether to redirect them.
That case became part of the chapter on finding and removing WordPress redirect malware.
Malware Hidden in the WordPress Database
WordPress malware does not have to exist as a .php file.
Scripts, redirects, spam, malicious snippets, and other unauthorized values can be stored in normal WordPress database records.
The book covers how to search the database, identify which WordPress feature owns a suspicious value, and decide whether it should be repaired or removed without destroying legitimate site data.
Hidden WordPress Administrators
One investigation contained an administrator account that existed in the database but did not appear normally in the WordPress Dashboard.
Malicious code altered the user query and displayed counts so the account was harder to notice.
This is why one of the recurring lessons in the book is:
Do not let one WordPress screen become your only source of truth.
The hidden-administrator chapter follows the account through the database, the code hiding it, its permissions, sessions, and the cleanup process.
Fake Plugins and Hidden Backdoors
Attackers do not always create files with obvious names.
A malicious plugin may use a believable name, description, author, and version number.
It may even remove itself from the normal Plugins screen.
The book shows how to compare what WordPress displays with what actually exists in the filesystem, verify plugin identities against trusted sources, and investigate suspicious behavior before deleting anything.
Checkout Skimmers and Payment-Page Malware
E-commerce compromises require extra care.
A suspicious script appearing on a WooCommerce checkout page can have much more serious consequences than the same script appearing on an ordinary blog page.
The book includes a real investigation involving a checkout-targeted remote JavaScript loader.
But there is an important distinction:
The evidence showed that remote code could run on the checkout page.
The retained evidence did not prove that credit-card data had actually been stolen.
That difference matters.
A security investigation should say what the evidence supports—not what makes the most dramatic headline.
SEO Spam and Hacked URLs
Another common WordPress compromise appears through search engines rather than the visible website.
A site owner may see:
- casino pages,
- pharmaceutical keywords,
- Japanese product spam,
- unfamiliar indexed URLs,
- or Search Console traffic for topics completely unrelated to the business.
Removing the spam from WordPress is only part of the recovery.
The book also looks at how those URLs remain visible in search engines and how to verify what the compromised site is still serving.
Server, DNS, and CDN Compromise
Sometimes repeatedly scanning WordPress will never find the problem.
In one type of incident, visitors may be reaching the wrong server because a DNS record was changed.
A CDN rule, hosting redirect, server configuration, or compromised hosting account can also affect what visitors receive before WordPress has a chance to run.
That is why the book does not treat WordPress as an isolated application.
Malware That Keeps Coming Back
Reinfection is one of the most frustrating WordPress malware problems.
A site gets cleaned.
The malicious file disappears.
Then it comes back.
Instead of repeatedly deleting the same payload, the investigation has to find what can restore it:
- another malicious file,
- a hidden plugin,
- a scheduled task,
- a compromised account,
- another infected website,
- a database value,
- or something outside WordPress.
The book treats recurrence as evidence.
A Site Can Look Hacked Without Being Hacked
The opposite lesson matters too.
Not every WordPress error is malware.
A blank page can come from:
- a PHP error,
- a plugin conflict,
- a broken theme,
- a failed update,
- a memory problem,
- or a normal coding mistake.
In one real case, a WordPress site showed a white screen because of a problem in the active theme's functions.php.
In another case, an almost identical blank site had a compromised root index.php containing malicious loader behavior.
Same symptom.
Two completely different conclusions.
That is why the first chapter of the book begins with a simple principle:
Start with the symptom, not the word “malware.”
What the Book Covers
The current book includes chapters on topics such as:
- identifying whether a WordPress site is actually hacked,
- understanding how WordPress sites get compromised,
- preparing safely before malware cleanup,
- finding connected infections,
- cleaning WordPress core, plugins, and themes,
- removing malware from the WordPress database,
- cleaning users and WordPress state,
- investigating hosting, server, DNS, and CDN problems,
- finding and removing WordPress redirect malware,
- removing SEO spam and hacked URLs,
- detecting fake plugins, themes, and hidden backdoors,
- removing hidden WordPress administrators,
- investigating checkout skimmers and payment-page malware,
- and handling malware that returns after cleanup.
More chapters are still being developed.
Who This Book Is For
I am writing it primarily for:
- WordPress developers,
- freelancers,
- site owners,
- agency teams,
- hosting and technical-support staff,
- and people who want to understand WordPress malware cleanup beyond automated scanners.
It is not meant to turn every reader into a malware analyst overnight.
Instead, I want readers to understand why a cleanup step is being performed and what evidence should support it.
The Book Is Still Under Development
WordPress Malware Removal for Developers & Site Owners is currently an early-access work in progress.
The first chapter is already available as a free preview:
📘 Read Chapter 1 Free
Is the WordPress Site Actually Hacked?
👉 Read the free chapter and join the book waitlist
The first chapter looks at mobile-only redirects, blank pages, browser evidence, scanners, hidden administrators, search-engine clues, logs, DNS, and the difference between a suspicious symptom and confirmed compromise.
One Principle I Want the Book to Keep
If I had to reduce the entire project to one idea, it would probably be this:
Finding malware is not the same as understanding the compromise.
A malicious file tells you that a malicious file exists.
A database injection tells you that an unauthorized value was stored.
A hidden administrator tells you that unauthorized access exists.
None of those observations automatically proves how the attacker first entered, what else they changed, or whether they still have another way back in.
That is the investigation the rest of the book is about.
WordPress Malware Removal for Developers & Site Owners is currently under development. New chapters and case studies will be added as the manuscript progresses.
Top comments (0)