Malware & your website explained

What malware is, how it gets onto websites, what it does when it's there, and how to get it removed.

Malware — short for malicious software — is code that an attacker places on your website without your permission. It can do many things: redirect your visitors, display ads, steal customer data, or turn your site into a spam sender. Most website owners have no idea it's there until something goes visibly wrong.

Quick summary

Website malware is usually installed through outdated or vulnerable plugins/themes, or through stolen admin credentials. Signs include unexpected redirects, security warnings from Google, new pages you didn't create, or a sudden slowdown. Removal requires a full scan and clean — not just deleting what you can find visually. Prevention is mostly about keeping software up to date and using strong passwords.

How malware gets onto websites

Outdated or vulnerable software

This is one of the two most common routes in — password guessing is the other. When a vulnerability is discovered in a WordPress plugin or theme, attackers write automated tools to exploit it, and sites still running the unpatched version get found by those tools. WordPress's own hardening guide puts this first of the two: attackers "sending specially-crafted HTTP requests to your server with specific exploit payloads for specific vulnerabilities. These include old/outdated plugins and software."

Keeping WordPress, themes, and plugins up to date is the most effective way to close this route.

Stolen or weak credentials

If an attacker gets your WordPress admin password (through phishing, a data breach at another site, or by guessing), they can simply log in and install malware themselves.

Strong, unique passwords and two-factor authentication prevent this.

Infected hosting environment

On shared hosting, a compromised neighboring website on the same server can sometimes lead to yours being compromised too. Managed WordPress hosting, which keeps sites more isolated from each other, reduces this risk.

Malicious plugin or theme

Installing plugins or themes from untrusted sources — unofficial websites, pirated ("nulled") versions — is a direct path to malware. Only install plugins from the official WordPress repository or from reputable commercial developers.

What malware does on your site

Type	What it does
Redirects	Sends your visitors to spam, scam, or adult websites
SEO spam	Adds hidden links to your pages to boost the attacker's rankings
Spam email sender	Uses your server to send bulk spam, harming your email reputation
Credential harvesting	Captures login information from your own visitors
Cryptomining	Uses your visitors' computers to mine cryptocurrency
Backdoor	A hidden access point that lets the attacker return even after you change passwords
Defacement	Replaces your homepage with the attacker's message
Ransomware	Encrypts your files and demands payment to unlock them

Signs your site may have malware

Visitors report being redirected to other sites
Google Search Console shows a security warning
Your browser or antivirus shows a warning when visiting your own site
You see pages, posts, or links you didn't create
Your hosting provider sent an alert or suspended your account
Sudden significant drop in search traffic
The site runs much slower than usual
You notice unfamiliar admin user accounts in WordPress

How malware is removed

Don't try to clean manually without expertise

Malware often places copies of itself in multiple locations and installs backdoors so it can return. Deleting visible files without a full scan almost never works — the site gets reinfected within days.

There are two reliable approaches:

Option 1: Restore from a clean backup If you have a backup from before the malware was installed, restoring it is the cleanest solution. You lose any content changes made since the backup, but you get a confirmed clean site. See Why backups are your safety net.

Option 2: Professional malware removal Sucuri and Wordfence both offer this. Sucuri includes malware removal in all of its platform plans and says it removes malicious code from your files and database and works on getting you off search engine blocklists. On Wordfence's side, its Care plan includes hands-on support with security incidents, and its Response plan adds 24/7 support from Wordfence's incident response team. This is what we recommend when no clean backup is available.

After cleanup, you must:

Update WordPress, all plugins, and all themes
Change all passwords (WordPress admin, hosting, FTP/SFTP, database)
Remove user accounts you didn't create
Address the vulnerability that allowed the infection

Preventing malware

The most effective prevention steps, in order of importance:

Keep everything updated — WordPress core, plugins, and themes
Use strong passwords and 2FA on all WordPress admin accounts and your hosting account
Remove plugins and themes you don't use — WordPress's hardening guide is direct about it: "if you are not using a specific plugin, delete it from the system." Deactivating leaves the files on your server
Install only from reputable sources — WordPress's guidance is to "restrict yourself to the WordPress.org repository or well known companies"
Use a security plugin — Wordfence adds a firewall plus a malware scanner that checks core files, themes, and plugins for malware, backdoors, SEO spam, and malicious redirects. Kadence Security (the plugin previously called Solid Security, and iThemes Security before that) adds login protection, firewall rules, and scanning for known vulnerabilities
Maintain backups — so recovery is fast if something does get through
Use good hosting — many managed WordPress hosts will scan your site for malware and help you clean it

Common questions

My site looked fine — how did I not notice sooner?

Much malware is specifically designed to be invisible to the site owner. It may only show redirects to visitors who came from search engines, or only on mobile, or only on first visit. Attackers want to remain hidden as long as possible.

Can visitors get malware from visiting my infected site?

Some types of malware attempt to install malicious code on visitors' devices. This is called a drive-by download. Modern browsers and antivirus software catch many of these, but not all. This is why it's important to put your site into maintenance mode if you know it's infected, and to address it urgently.

Will my SEO recover after cleaning?

Once the malware is removed and Google completes a review, rankings generally recover. When you have confirmed the problem is fixed, request a security review in the Security Issues report in Google Search Console. Google says that review "can take from a few days to a few weeks to complete", so the faster you clean the site, the sooner that clock starts.

What is a 'nulled' plugin and why is it dangerous?

A nulled plugin is a premium (paid) plugin that someone has distributed for free, often with the license check removed. These frequently contain malware planted by whoever redistributed them. Never install nulled plugins or themes.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.