How to Detect Malware and Malicious Code on a WordPress Site

WordPress runs more than 40% of all websites, and attackers go where the targets are. Most compromises are not sophisticated, targeted hacks — they are automated bots exploiting an outdated plugin, a weak password, or a vulnerability patched months ago. The uncomfortable part: a well-written infection is designed to be invisible to you while staying fully visible to search engines, spam networks, and the attacker. Knowing how to detect malware and malicious code is a core maintenance skill for anyone running a WordPress site.

Warning signs your site may be compromised

• Google Search Console flags "This site may be hacked" or security issues, or rankings suddenly collapse.
• Visitors report redirects to spam or scam pages that you can't reproduce while logged in — many infections deliberately hide from administrators.
• Unknown admin users, or plugins and scheduled tasks you never created.
• The site slows down or the server sends spam email, burning your domain reputation.
• Strange files in your uploads folder, or core files with recent modification dates you can't explain.

Absence of symptoms proves nothing, though. The nastiest backdoors do nothing visible at all — they simply wait, keeping the attacker's access alive through password changes and plugin updates.

Where malicious code actually hides

After years of cleaning infected client sites, I see the same hiding spots again and again:

1. Tampered core files. A few injected lines inside legitimate WordPress files like wp-settings.php, where nobody looks.
2. Backdoors and web shells dropped as standalone PHP files with innocent names (wp-cache.php, class-wp-widget.php) in places such files don't belong.
3. Obfuscated payloads — long base64 strings fed to eval(), assert(), or create_function(), unreadable by design.
4. PHP hidden inside images. A file that opens fine as a JPEG can still carry an embedded PHP payload that executes when requested the right way — the classic "polyglot" trick, planted in the uploads folder that every theme trusts.
5. Injected code in themes and plugins, especially abandoned ones that no longer receive updates.

Manual detection: the honest version

You can do real detective work by hand: compare your core files against the official checksums WordPress publishes, list recently modified PHP files, and grep the codebase for eval(, base64_decode(, and friends. The problem is scale and skill — a WordPress install contains tens of thousands of files, obfuscation defeats naive searches, and legitimate plugins use some of the same functions, burying real findings in false positives. Manual checks are a useful spot-check, not a security posture.

Automated scanning with Site Sentinel — free

This problem is exactly why I built Site Sentinel, a free WordPress security plugin that detects malware and malicious code. It automates every technique above, properly:

• Core integrity verification — every WordPress core file is compared against the official WordPress.org checksums, so a single tampered line stands out immediately.
• Signature detection for known backdoors, web shells, and injection patterns across plugins, themes, and uploads.
• Heuristic analysis that flags obfuscation and suspicious constructs (eval, encoded payloads) even when the exact malware is brand new.
• Upload sanity checks, including detection of PHP code hiding inside image files.
• Low false positives by design: files that are byte-identical to official WordPress.org releases are trusted and skipped, so the report shows you real leads instead of noise.
• Scheduled scans that keep watching after you close the dashboard.

Findings are ranked by severity — critical, high, medium, low — with exact file paths, so you know what to look at first. And a deliberate design decision: Site Sentinel detects and reports, it never auto-deletes. Automatic "cleanup" tools that guess wrong can take a working site down; you stay in control of every change. For the full feature tour, see my deep dive into Site Sentinel.

If you find something

Take a full backup first (evidence matters), change all passwords and security keys, restore or replace tampered files from official sources, remove the backdoors the scan located, then update everything and find the entry point — otherwise the infection returns in a week. If that sounds like more than you want to handle alone, my website maintenance and support service covers exactly this: cleanup, hardening, and ongoing monitoring so it doesn't happen twice.