WordPress Malware File Scan Checklist
When a WordPress site is suspected of being hacked, file scanning helps identify suspicious PHP files, modified plugins, unknown uploads and injected code. This checklist focuses on practical checks before cleanup.
Suspicious signs
- Unknown PHP files in uploads.
- Plugin folders you did not install.
- Recently modified core files.
- Encoded or obfuscated code.
- Unexpected redirects.
- New admin users.
Checklist
- Backup the current infected state for evidence.
- Record the website root path.
- Check wp-content/uploads for PHP files.
- Check plugin and theme folders for unknown files.
- Compare WordPress core files with clean versions.
- Search for suspicious functions carefully.
- Check recently modified files.
- Review admin users.
- Remove malware only after identifying entry points.
- Restore from a clean backup if available.
Final check
Malware cleanup is not complete until suspicious files are removed, vulnerable access is closed, passwords are changed and the site is monitored after recovery.
When to Use This Checklist
Use this checklist when a WordPress site shows signs of malware, redirect injection, unknown files or suspicious admin activity.
Required Tools
SSH access or file manager, WordPress admin, backup, malware scanner, clean WordPress core package, Nginx logs
Before You Start
Do not delete suspicious files before creating a backup of the current state and recording what you found.
Structured Checklist Steps
- Backup current state.
- Check uploads for PHP files.
- Check plugins for unknown folders.
- Check themes for unknown files.
- Find recently modified files.
- Search for suspicious code patterns.
- Check admin users.
- Change passwords.
- Restore clean files.
- Monitor after cleanup.
Verification Steps
- No unknown admin remains.
- No PHP files remain in uploads unless intentionally required.
- Suspicious files are documented.
- Passwords are changed.
- Site no longer redirects unexpectedly.
Rollback Plan
If cleanup breaks the site, restore the latest backup and repeat the cleanup in a staging copy or restore from a known clean backup.
Common Mistakes
- Deleting files without backup.
- Cleaning malware but keeping the same passwords.
- Ignoring plugin vulnerabilities.
- Not checking uploads folder.
- Assuming one scan means the site is clean.
Related Commands
find wp-content/uploads -name "*.php"
find . -type f -mtime -7
grep -R "base64_decode" wp-content/
grep -R "eval(" wp-content/
ls -la wp-content/plugins