Note (September 2026): This guide has been corrected. The Emergency Recovery Script is a free download rather than a WP Reset PRO extra, and it cannot find or remove malware in plugins, themes or uploads; a full malware clean-up checklist has been added.
When malware strikes a WordPress website, stay calm and document what you see, scan the site and your own computer, contact your host, reset every password and the security keys in wp-config.php, back up the infected site, then remove the hack by replacing core, theme and plugin files with clean copies. Update everything, change passwords again, and ask Google to review the site in Search Console.
Key Takeaways
- WordPress.org’s official guidance for hacked sites is a sequence: document, scan, check with the host, reset access, back up, remove the hack, update, change passwords again, then investigate how the attacker got in.
- The free Emergency Recovery Script (ERS) from WP Reset helps regain admin access and repair WordPress core files, but WP Reset states its Core Files check does not scan plugins, themes or uploads.
- A clean backup made before the infection is the fastest reliable fix; restoring a snapshot taken after the infection brings the malware back.
- If Google flags the site, fix every issue first, then use Request Review in the Search Console Security Issues report; Google says a review can take from a few days to a few weeks.
- Prevention is mostly routine: updates, long unique passwords, two-factor authentication, 755/644 file permissions and regular off-site backups.
Just like any other software or CMS, WordPress also needs constant maintenance. By maintenance we mean updates of WordPress and plugins, as well as upgrades of PHP versions according to the requirements of our CMS system.
An outdated version of our WordPress sites can lead to a number of problems in terms of security and normal functioning. Also, a big problem is created by plugins that are not updated because WordPress sites that are not up to date are more susceptible to cyber-attacks.
What To Do After A Malware or Ransomware Attack
If we have the latest version of WordPress CMS problems can still happen. If we install an unverified plugin we can easily get into a situation where our pages become non-functional.
Problems are not always caused by the site owner’s own mistakes. If we use shared hosting that does not have adequate protection, hackers can gain access to the server and thus damage or delete our WP pages.
Our database may be corrupted, files deleted, WordPress installation may be corrupt, and we may no longer be able to gain administrator access.
There is a solution to each of these problems. Sometimes the solution is difficult, it takes a lot of time, effort and work to get everything back to normal. However, the solution does not have to be that difficult. In the following text, we will present you with a tool which will help you to return the pages to a functional state if any problem occurs.
This tool is called Emergency Recovery Script and it is something that absolutely every WordPress administrator should have.
Emergency Recovery Script is a PHP script that works separately from the WordPress installation, it does not need WordPress to work. Because it runs independently, it can still work when WordPress itself will not load, although WP Reset notes that in rare cases even ERS cannot help and restoring a backup or reinstalling the site is the only option left.
ERS is designed for situations where you can’t log in as an admin, a white screen of death has appeared, or WordPress core files have been damaged or deleted by mistake or by malware. It can often restore access quickly, but it is a recovery tool rather than a malware cleaner: malicious code hidden outside the core files needs a separate scan.
Each ERS download gets a uniquely generated filename and password, so only someone who knows that secret URL and the password can open it. From there it can restore administrator access and fix many common faults, but it cannot undo everything a malware infection changes. Because it is a single PHP file, you can delete it from the server when you are finished.
Some of the tools offered by Emergency Recovery Script are.
WordPress Information
This tool displays a lot of information detected by ERS related to the WordPress installation. These are the WordPress version, database access details, wp-config.php locations and site URLs.
Server information
This tool displays a range of data related to our hosting servers, such as the PHP and MySQL versions currently in operation.
Core files
This is a great tool that does a check of all WordPress core files and then does a comparison with the core files hosted on the WordPress.org platform. If ERS detects that some of your core files have been modified or changed you will receive a notification.
In this case, you have the option to replace the complete files with new, original files that ERS will download directly from the WordPress repository. What is important to note is that this tool does not check your themes, plugins or any other part of your site. Only core files are checked and changes are detected on them.
Reset WordPress
This is a very powerful tool whose purpose we can guess from the name. It allows us to reset our WordPress pages. By this we mean that the database will be reset to the default values. However, your files, themes, plugins and uploads will remain intact. WP Reset warns that a reset also removes all user accounts, so create a new administrator account afterwards, and remember that resetting the database does not remove malicious files.
Plugins
This is a great tool to help identify the plugin that is causing the problem on our WordPress sites. Instead of accessing the server via FTP and renaming the folder of the problematic plugin, simply select the plugin in ERS and disable it. This action is done the same as from the WordPress admin console.
Themes
Just like the previous option that solves the problem with plugins, this tool is designed to solve problems with themes. Simply click a theme to enable or disable it.
Edit WP options
This tool is meant to save the time you would spend installing an SQL client or searching through phpMyAdmin. As of September 2026, WP Reset’s ERS page lists the Options tool as “coming soon”, so it may not be available in the copy you download. This tool works with the options located inside the wp_options table in the database so you can easily add, delete or edit their values.
User Privileges & Roles
A great tool we can use to restore roles and permissions to our account to the values it previously had. If it happens that we can’t log in or we can log in but we no longer have administrator access, this tool will help us and solve the problem.
Administrator Account
This is one of the most important tools within ERS. Whatever problem we have with our administrator account, with the help of this tool we simply create a new account and assign it administrator privileges.
The only thing we have to pay attention to is that the username and email we want for the new account do not already exist in the WP database.
Delete or reset .htaccess
If the .htaccess file is damaged, the site usually shows a white screen of death (an error 500) with no useful error message. ERS offers two tools for this: one deletes the .htaccess file and the other restores it to the default WordPress rules for pretty permalinks. Once you are back in the admin, open Settings, then Permalinks, and click Save to regenerate them.
Snapshots
This is one of the most useful options in ERS. If a major problem occurs that requires a lot of time, knowledge and work to solve, with the help of this tool simply restore the previous functional image (snapshot) of your WordPress pages. Restoring a snapshot returns the site to the state it was in when the snapshot was made, so it is only a clean fix if that snapshot was taken before the infection.
ERS has the option to restore snapshots, but if you want to create snapshots then you will need to get the WP Reset PRO plugin. WP Reset PRO is a paid plugin from WebFactory Ltd for resetting WordPress and taking snapshots. ERS itself is a free download from WP Reset; the PRO plugin can also install ERS automatically so you do not need FTP.
As much as we are experienced WordPress users, sometimes mistakes can happen even if it’s not our fault. Poorly programmed plugins can give hackers a chance to create a problem. We often create a problem with our own carelessness, and we need a lot of effort and time to solve it later.
ERS and WP Reset Pro can save time on access and core-file problems, but no single plugin fixes every malware infection. The checklist below, based on WordPress.org’s own guidance for hacked sites, covers the full clean-up.
How Do You Know Your WordPress Site Has Malware?
WordPress.org calls the symptoms of a hack Indicators of Compromise. According to its official FAQ for hacked sites, the clearest signs are:
- The website is blocklisted by Google, Bing or another search engine.
- The hosting provider has disabled the website.
- The website has been flagged for distributing malware.
- Visitors report that their desktop antivirus software flags the site.
- Someone reports that the website is being used to attack other sites.
- Unauthorized changes appear, such as new user accounts you did not create.
- The hack is visible when you open the site in a browser.
Write down which of these you see and when you first noticed them. WordPress.org recommends recording the time, time zone and any recent changes, such as a new plugin or theme edit, because that record becomes the baseline of your incident report.
Step-by-Step: What To Do When Malware Strikes a WordPress Website
The following order follows the WordPress.org FAQ for hacked sites. It is not exhaustive, but it keeps you from cleaning the site while an attacker still has access.
- Document the incident. Note the symptoms, the time you noticed them and details of your hosting environment.
- Scan the website. Combine an application-level scanner plugin (WordPress.org names Wordfence, Sucuri, Quttera and GOTMLS) with a remote scanner such as VirusTotal or Sucuri SiteCheck. Each type finds different problems.
- Scan your own computer. WordPress.org notes that many infections start on the owner’s computer, where trojans capture FTP and wp-admin logins. Run a full antivirus scan, and consider a second scanner.
- Contact your hosting provider. On shared hosting the hack may affect more than your site, and the host can confirm whether it is a real hack or an outage. A rootkit scan on the server is also worth asking about.
- Reset all access. Force a password reset for every user, especially administrators, and change the FTP/SFTP, hosting control panel and MySQL passwords. Replace the secret keys in wp-config.php with a new set from the WordPress key generator; this logs out anyone still signed in.
- Back up the infected site. WordPress.org recommends taking one more snapshot before cleaning, even though it is infected, so you have a reference copy if the clean-up goes wrong.
- Find and remove the hack. Restore a clean backup if you have one. Otherwise, replace the /wp-admin and /wp-includes folders with fresh copies of the same WordPress version via SFTP rather than the dashboard reinstaller, which only overwrites existing files. Then replace theme and plugin files with clean copies and inspect .htaccess, index.php, header.php, footer.php and functions.php, which attackers often modify.
- Update everything. Once the site is clean, update WordPress core, themes and plugins to their latest versions.
- Change the passwords again. Passwords changed while the site was still infected may already be compromised. Use long, unique passwords, for example from a secure password generator, and consider changing the database user and password in wp-config.php too.
- Investigate how the attacker got in. WordPress.org calls this forensics: find the attack vector, such as an outdated plugin or a stolen password, so the same hole cannot be used again.
Which Recovery Option Fits Your Situation?
| Option | Best for | Limits |
|---|---|---|
| Clean backup restore | Any infection, if a backup from before the hack exists | Loses changes made after the backup; restores the malware if the backup is already infected |
| Emergency Recovery Script (free) | Lost admin access, white screen, bad plugin or theme, modified core files, stuck maintenance mode | Core Files check does not scan plugins, themes or uploads, according to WP Reset |
| WP-CLI wp core verify-checksums | Checking core files against WordPress.org checksums from the command line | Covers WordPress core files only; needs SSH access |
| Security scanner plugin | Finding malicious code in themes, plugins and uploads | Needs a working admin area; one scanner can miss what another finds |
| Hosting provider or professional clean-up | Server-level infections, repeat hacks, sites without backups | Cost and turnaround vary by provider |
How To Get Your Site Off Google’s Warning List
Google’s Search Console Security Issues report covers three kinds of problems: hacked content, malware and unwanted software, and social engineering such as phishing pages. Google may show warnings in search results or on a full-page interstitial while an issue is open.
After fixing every issue across the whole site, open the Security Issues report and select Request Review. Google asks you to explain the exact problem, the steps you took to fix it and the outcome. According to Google’s Search Console Help, a malware review can take from a few days to a few weeks. WordPress.org also recommends registering the site with Bing Webmaster Tools, Yandex Webmaster and Norton Safe Web, since other blocklists and antivirus products can flag a site independently.
How To Protect Your WordPress Site From Malware
WordPress.org’s hardening guide lists a small set of habits that stop most attacks:
- Keep everything updated. WordPress has offered automatic background updates since version 3.7, and WordPress.org notes that older versions are more prone to hacks.
- Use strong passwords and two-factor authentication. See these password management security tips.
- Set file permissions correctly. The guide recommends 755 for directories and 644 for files.
- Disable the built-in file editor. Adding define( ‘DISALLOW_FILE_EDIT’, true ); to wp-config.php stops administrators, and anyone who steals an admin login, from editing PHP files from the dashboard.
- Back up regularly and off-site. Keep regular backups of both the database and the files, so a clean restore point always exists.
- Enable logging and install only trusted plugins. Logs help detect brute-force and injection attempts, and every unmaintained plugin is a possible entry point.
For a broader checklist, see these key website security checks. If repeat infections come from neighbours on shared hosting, it may also be time to ask whether your WordPress site needs a dedicated server.
Frequently Asked Questions
What is the first thing to do when a WordPress site gets malware?
The first step is to document the problem: what you see, when you noticed it and what changed recently. WordPress.org then recommends scanning the site and your own computer, contacting your host and resetting all passwords before starting the clean-up.
Can the Emergency Recovery Script remove malware?
The Emergency Recovery Script can replace modified or infected WordPress core files with original copies and remove extra files from core folders. According to WP Reset, it does not check plugin, theme or upload files, so malware there must be found with a security scanner or removed by restoring clean copies.
Is the Emergency Recovery Script free?
Yes. WP Reset offers the Emergency Recovery Script as a free download with a uniquely generated filename and password. The paid WP Reset PRO plugin can install it automatically and is needed to create the snapshots that ERS can restore.
Will restoring a backup remove malware?
Restoring a backup removes malware only if the backup was made before the infection. After restoring, update WordPress, themes and plugins and change every password, or the same weakness can be exploited again.
How long does it take Google to remove a malware warning?
Google removes the warning after a successful review requested through the Security Issues report in Search Console. Google’s Search Console Help says a malware review can take from a few days to a few weeks.
Justwebworld has published guides since 2012. How we write and update articles Report an error
