After malware removal, it is natural to wonder whether your website is actually clean. Knowing how to tell if a hacked WordPress site is clean takes more than running one scan: you need to check the site from different angles and look for signs that access or malicious code remains.
Use the checks below to gather evidence, not to guarantee that every threat has been removed. Some checks can be done in WordPress and a browser. Others, such as reviewing server files and logs, may require help from your hosting provider or a developer.
Start with a careful account review
Sign in to WordPress and review all users with administrator access. Confirm that each account belongs to someone who should have that level of access. Look for unfamiliar names, unexpected email addresses, accounts you do not recognize, and legitimate accounts whose roles or details have changed without explanation.
Do not remove an account solely because it looks unfamiliar. Check with your team first, and preserve relevant details if you suspect it was created during the compromise. Remove unauthorized accounts once you have confirmed they are not legitimate, and review other user roles for unexpected changes.
Also check for access outside WordPress. Ask your host or developer to review hosting control-panel users, file-transfer or shell access, database accounts, and any connected services that could change the site. A WordPress password change alone may not close every route used to reach the website.
Test for redirects and other visitor-facing symptoms
Visit important pages while logged out, using more than one browser and device. Test both the homepage and pages visitors commonly reach, such as contact forms or product pages. Look for unexpected redirects, pop-ups, unfamiliar content, or pages that behave differently from what you expect.
Test more than a direct address typed into the browser. Try reaching the site from a search result as well. Some unwanted behavior may appear only for particular visitors or entry paths. If you find a redirect, note the page, browser, device, and steps that triggered it before asking for help. The guide to investigating WordPress redirects can help you understand what to check next.
Review Google Search Console for security notices or reported issues. Google’s malware and unwanted software guidance explains how such issues can affect a site in Search. The absence of a notice is useful information, but it does not independently prove that your website is clean.
Look for suspicious or changed files
A dashboard scan may not inspect every location where unwanted code could remain. Ask a qualified developer or your hosting provider to review WordPress core files, themes, plugins, uploads, configuration files, and server-level areas. Pay attention to unfamiliar files, unexpected changes, and files that do not belong in their apparent location.
Do not delete files just because you do not recognize them. Some may be required by your site or host. Have someone compare them with trusted, clean versions and investigate unexpected changes before removing them. Also review scheduled tasks and other mechanisms that could run code again after a cleanup.
For WordPress core files, a developer can use WP-CLI’s core verify-checksums command to compare files with WordPress.org checksums. This check is useful for the files it covers, but it does not establish that themes, plugins, uploads, database content, or server configuration are clean.
Look beyond files, too. Unwanted code or settings may be stored in the database, including content, options, or scheduled actions. If the site was redirecting visitors or showing injected content, ask whoever handled the cleanup to explain which locations they checked and how they confirmed the changes were removed.
Run follow-up scans and observe the site
Run another malware scan after cleanup, then repeat checks after updates or other significant changes. If possible, use a scanner that can examine the website’s files and identify changes, rather than relying only on a check of publicly visible pages. Different tools detect different things, so a clean result from one scanner is not proof that every persistence method has been found.
Continue watching for new administrator accounts, unexpected file changes, unusual redirects, and security alerts. If a threat returns, record what you observed and contact your host or cleanup provider promptly. Avoid repeatedly deleting unfamiliar files without understanding how they got there; finding the route back in is part of a lasting recovery.
For a broader look at recovery planning, see this guide to WordPress disaster recovery. Ongoing malware monitoring for WordPress can also help surface changes that appear after cleanup.
Reduce the chance of reinfection
- Remove software you do not use. Unneeded plugins and themes add complexity. Keep only what the site needs, and obtain retained software from trusted sources.
- Update retained software. Bring WordPress, themes, and plugins up to date after confirming that the versions are compatible with your site.
- Rotate relevant credentials. Change WordPress, hosting, database, file-transfer, and related service passwords from a device you trust. Revoke sessions or access tokens where available, and enable multifactor authentication when supported.
- Review access and permissions. Give each person only the access needed for their work. Remove former or unauthorized access, and check for accounts you no longer need.
- Keep clean backups. Retain backups from before the incident and confirm that you know how recovery works. Do not assume a backup is safe simply because it exists; it may contain the same compromised files.
- Monitor after recovery. Watch for file changes, unfamiliar accounts, scan alerts, and visitor-facing symptoms. Arrange for a host or developer to review server-level activity when the situation calls for it.
A thorough WordPress malware cleanup checklist combines account, browser, file, database, and follow-up checks. Each check provides a different piece of evidence, and no single clean scan can establish that the site is completely clear.
Frequently asked questions
How do I know if my WordPress site is completely clean?
You cannot confirm that from one scanner result alone. Combine repeat scans with account and redirect checks, file and database review, and monitoring after cleanup. Ask your host or developer to investigate server-level areas when needed.
Which passwords should I change after a WordPress site is hacked?
Change credentials that could provide access to the site or its connected services, including WordPress, hosting, database, and file-transfer accounts. Review other connected services as well, and revoke sessions or tokens where available.
What should I do if malware returns after cleanup?
Save details about what happened, such as affected pages, alerts, and unfamiliar changes, then contact your host or cleanup provider. Ask them to investigate how the malware returned, including access paths and scheduled tasks, rather than only removing the visible symptoms again.
How do I check whether Google still considers my site hacked?
Review Google Search Console for security notices and check relevant Search results. A lack of warnings does not replace technical checks of the website and its server.
Take the next step
If you are unsure whether the cleanup covered accounts, files, and server-level access, ask a qualified WordPress professional or your host to review the evidence with you. Zevonix Cloud provides managed WordPress website services, including security, backups, and maintenance. You can get in touch to discuss what your site needs after an incident.