You ran a security plugin, deleted the malicious files and even reinstalled WordPress. For a few days everything looked clean. Then the warnings came back, customers complained again and your VirusTotal score turned red.
This is one of the most common situations we see. The malware is a symptom; the real problem is an entry point that was never closed.
Key takeaways
- A clean scan does not mean a secure site. Backdoors survive most automated cleanups.
- Outdated plugins and themes are the number one reinfection vector.
- Shared hosting means a neighbour's compromise can reach your files.
- Blacklist warnings remain after cleanup and must be removed separately.
Why cleaning is not enough
Automated cleanup tools remove known malicious files, but attackers rarely use just one. A typical WordPress compromise includes the visible payload, such as a phishing page or redirect script, plus one or more backdoors: small PHP files hidden in upload directories, inside theme files or encoded in the database.
If even one backdoor survives the cleanup, the attacker can regenerate everything within hours.
The 7 most common reinfection causes
We see the same patterns across hundreds of WordPress sites:
- Outdated plugins or themes with known vulnerabilities that the attacker used to get in the first time.
- Backdoor files in wp-content/uploads, mu-plugins or inactive themes that scanners missed.
- Compromised admin accounts with weak or reused passwords.
- Malicious database entries such as injected JavaScript in post content, widget settings or option rows.
- Shared hosting where another site on the same server was compromised and the attacker moved laterally.
- Nulled or pirated plugins that ship with built-in backdoors.
- File permission issues that let the web server write to directories it should not.
Check your wp-content/uploads directory for PHP files. Legitimate uploads are images and documents, never executable code.
A thorough cleanup checklist
Go beyond what a plugin does automatically:
- Replace WordPress core files with a fresh download, do not just verify checksums.
- Delete every plugin and theme you do not actively use, then reinstall the ones you keep from the official repository.
- Search the database for base64_decode, eval and script tags in unexpected places.
- Change every password: WordPress admins, database, FTP, hosting panel and email.
- Remove unknown admin users and check for users with elevated roles.
- Set file permissions to 644 for files and 755 for directories, and make wp-config.php read-only.
- Add a Web Application Firewall to block exploit attempts before they reach PHP.
Dealing with the blacklist warnings
Cleaning the malware does not remove the warnings. Google Safe Browsing, VirusTotal vendors, antivirus products and web filters each keep their own listing until you explicitly request a review.
Wait until the site is fully clean, then follow the removal steps in our blacklist removal checklist. Requesting a review while traces of malware remain leads to rejection and makes the next review harder to get approved.
Preventing the next round
Prevention is cheaper than another cleanup. Keep WordPress, plugins and themes updated, use strong unique passwords with two-factor authentication, choose a host that isolates accounts and run regular scans. Monitoring your domain on services like VirusTotal alerts you to a new listing before your customers notice it.
Frequently asked questions
Can a security plugin prevent reinfection?
It helps, but no plugin is a complete solution. Keeping software updated, removing unused code and using strong passwords are equally important.
Should I move to a new domain?
Almost never. A new domain has no reputation and may get flagged faster. Fix the current site and request blacklist removal.
How do I know if my host is the problem?
If reinfection happens immediately after a clean reinstall and password change, ask your host whether other accounts on the same server are compromised or consider moving to isolated hosting.
Will the malware affect my email?
If the malware causes a domain blacklisting, yes. Email servers that check URL reputation will start rejecting or filtering your messages.