Every day, hundreds of WordPress websites get infected with viruses. These viruses can include files or pieces of code that send SPAM or display unwanted ads to your visitors.

For a business website, I recommend having your WordPress restored and secured so that you can be sure your WordPress is virus-free and have the assurance of a guarantee to fall back on if the infection turns out to be more complicated and persistent than expected (which is often the case!).

However, for a hacked WordPress blog or hobby website, you may not want to spend too much money, and you can attempt to remove the virus yourself and revisit it later if you’ve missed anything.

We will guide you through the process of making your WordPress virus-free as effectively as possible!

There will be many links behind terms you might not be familiar with; visit those pages and educate yourself to ensure you remove the virus correctly.

First, make a backup of all files and the database!!

Step 1 – Removing the WordPress Virus

The virus may consist of just a few files or as many as 100 to 5000 files! For example, a virus may create pages on your server. To avoid having to check each WordPress file one by one, you can start by removing the standard WordPress files in the “root” of your website.

Keep the wp-content folder, the htaccess, and the wp-config. These contain unique files you don’t want to overwrite with a new WordPress installation.

Download the latest version of WordPress.

Step 2 – Checking Files for Backdoors

A WordPress virus doesn’t just consist of files; there are often pieces of code (syntax) added to your theme or plugins, known as backdoors.

To find them, check the file modification dates. If all the files in your theme or plugin were placed on 3-05-2015, but one file has been edited or added on a different date, there’s a good chance it contains code that shouldn’t be there.
Inspect this file; you’ll likely find Base64 or eval code that is unreadable and differs from regular PHP formatting. Carefully remove these lines of code.

Some tricks to watch out for:

1. Virus code is often written in Base64, but it can also be a single line of PHP that passes data or gives a write command.
2. Virus code is often placed at the beginning or end of a file; automation takes care of this logic.
3. Sometimes they leave a lot of white space at first, making the file appear empty, but the code is located to the right, requiring you to scroll to see it.

Step 3 – Adjust File Permissions

You don’t want files to be modified again within a day if a virus file is still present. You can set many directories so that they cannot be edited by WordPress or a virus that doesn’t have Username and Password access via FTP software. (The downside is that updates will need to be done manually.)

For example, you can set theme files to 644 and directories to 555 (the crucial thing is to avoid setting them to 777!).

Step 4 – Install a Security Plugin

Preventing a WordPress virus depends on many factors, but one important aspect is preventive security.

Install and configure a security plugin to prevent a virus file from easily returning through a vulnerability and to immediately detect file changes.

For choosing a security plugin, you can read this article.

Step 5 – Create a Backup

Make another backup? But I’m done now, right? I’ve removed the virus from the website.

Well, if you’ve overlooked a file, the virus may reinstall itself on the server and in the files. This could happen through an automated file that writes files to your server daily or weekly.

In case this happens, you can restore the backup from the time when your website was seemingly 97% clean, and you can fix the last percentages.

It happens a lot: you’ve just checked WordPress and removed the hacked files, yet after a few days, the website is back to sending spam.

As a WordPress website security expert, I know all the tricks that hackers use to deceive you.

When you hire me, I take the website cleanup and security to a higher level by addressing both the backdoors and the exploits.

You can’t expect this level of expertise from your current WordPress developer who designed or programmed your website.

Securing a website is a specialty that requires attention 7 days a week to stay updated with the latest tricks hackers use.

That being said, it’s interesting to look at the tricks hackers apply to hack your WordPress site repeatedly.

First basic fact: A hacker writes a script once and spends weeks coding it. A script that exploits a new vulnerability or a known WordPress function.

The script will copy itself to multiple files and leave the website open for reinfection after you’ve removed it.

Furthermore, the script will use the server it’s on to find other websites to repeat the same trick.

Ways a hack can keep coming back

1. The file that sends spam is relatively easy to find, so the hacker writes a function to recreate the spam file periodically. For example, once every 7 days or sometimes every 24 hours. When you think you’ve solved this issue, you’ve only addressed the symptom but not the cause.
2. The hacker has written a function that creates a new user with administrator rights. When you think you’ve solved the problem but have no idea that this user has been created in the database, an automated script from your server or another server uses the user’s login to place information on the server again.
3. Every post and page is injected with a piece of code (inn-content) that you only see when you switch from the WYSIWYG editor to the text version. In other words, if you have 100-200 news articles and each contains a piece of code… even if you clean the file on the server, it’s still present on every page.
4. The hack only appears once per browser session. Peekaboo! When you think you’ve solved the problem, it’s just that the effects of the hack file are no longer visible in your browser. But every new visitor will see it. This can be in the form of a link, a frame overlaying your current page, or an attempt to place a virus file on the visitor’s computer.

These are some reasons why your hack keeps coming back even after you (thought you) removed it.

These are just 4 ways, but hackers know many more tricks that I won’t explain here. However, now you understand why it’s best to have a specialist work on your website if you REALLY want a fully functional and clean website.