Malware is malicious code that has been injected into your WordPress site, usually through a security vulnerability in core, a plugin, or a theme. Once installed, it runs quietly alongside your legitimate site content — often for weeks or months — carrying out whatever the attacker designed it to do.
Unlike a broken plugin or a failed update, malware doesn't announce itself. Your site can look and function completely normally to you while it is actively harming your visitors, your search rankings, or your server's reputation in the background.
How Malware Gets Onto a WordPress Site
Malware doesn't appear out of nowhere — it is planted through a specific entry point. The most common ones are outdated plugins and themes with known, unpatched vulnerabilities, weak or reused admin passwords, insecure file upload forms, and outdated WordPress core files. Automated bots scan millions of WordPress sites continuously, looking for exactly these weaknesses. Once found, infection can happen within hours, with no human attacker ever directly targeting your site.
What Malware Actually Does
Once installed, malware typically falls into one or more of these categories:
- Redirect malware — sends your visitors to spam, phishing, or scam websites, sometimes only when they arrive from Google search results.
- SEO spam injection — hides spam links and pages on your site to manipulate search rankings for pharmaceutical, gambling, or counterfeit goods sites.
- Backdoors — hidden scripts that give the attacker permanent, silent access back into your site, regardless of password changes.
- Cryptominers — use your server's processing power to mine cryptocurrency, slowing your site and inflating hosting costs.
- Data-stealing scripts — capture form submissions, login credentials, or payment details entered on your site.
- Spam mailers — use your server to send bulk spam email, which can get your domain blacklisted.
Signs You Might Be Infected
Because malware is designed to stay hidden, the signs are often indirect: a sudden drop in search rankings, a Google Search Console or browser malware warning, unfamiliar admin users appearing in your WordPress dashboard, unusually high server resource usage, or your hosting provider suspending your account without warning. Many site owners only discover an infection when a customer reports being redirected somewhere strange.
Why Removal Isn't Just Deleting a File
A common mistake is finding one suspicious file, deleting it, and considering the problem solved. Malware infections frequently include multiple backdoors placed in different locations — plugin folders, theme files, the uploads directory, sometimes even the database itself. Missing even one means the attacker can simply re-infect the site. Proper cleanup requires knowing what a clean WordPress installation looks like and checking every location malicious code can hide.