How to Detect Malware and Malicious Code on a WordPress Site

WordPress runs more than 40% of all websites, and attackers go where the targets are. Most compromises are not sophisticated, targeted hacks — they are automated bots exploiting an outdated plugin, a weak password, or a vulnerability patched months ago. The uncomfortable part: a well-written infection is designed to be invisible to you while staying fully visible to search engines, spam networks, and the attacker. Knowing how to detect malware and malicious code is a core maintenance skill for anyone running a WordPress site.

Warning signs your site may be compromised

• Google Search Console flags "This site may be hacked" or security issues, or rankings suddenly collapse.
• Visitors report redirects to spam or scam pages that you can't reproduce while logged in — many infections deliberately hide from administrators.
• Unknown admin users, or plugins and scheduled tasks you never created.
• The site slows down or the server sends spam email, burning your domain reputation.
• Strange files in your uploads folder, or core files with recent modification dates you can't explain.

Absence of symptoms proves nothing, though. The nastiest backdoors do nothing visible at all — they simply wait, keeping the attacker's access alive through password changes and plugin updates.

Where malicious code actually hides

After years of cleaning infected client sites, I see the same hiding spots again and again:

1. Tampered core files. A few injected lines inside legitimate WordPress files like wp-settings.php, where nobody looks.
2. Backdoors and web shells dropped as standalone PHP files with innocent names (wp-cache.php, class-wp-widget.php) in places such files don't belong.
3. Obfuscated payloads — long base64 strings fed to eval(), assert(), or create_function(), unreadable by design.
4. PHP hidden inside images. A file that opens fine as a JPEG can still carry an embedded PHP payload that executes when requested the right way — the classic "polyglot" trick, planted in the uploads folder that every theme trusts.
5. Injected code in themes and plugins, especially abandoned ones that no longer receive updates.

Manual detection: the honest version

You can do real detective work by hand: compare your core files against the official checksums WordPress publishes, list recently modified PHP files, and grep the codebase for eval(, base64_decode(, and friends. The problem is scale and skill — a WordPress install contains tens of thousands of files, obfuscation defeats naive searches, and legitimate plugins use some of the same functions, burying real findings in false positives. Manual checks are a useful spot-check, not a security posture.

Automated scanning with Site Sentinel — free

This problem is exactly why I built Site Sentinel, a free WordPress security plugin that detects malware and malicious code. It automates every technique above, properly:

• Core integrity verification — every WordPress core file is compared against the official WordPress.org checksums, so a single tampered line stands out immediately.
• Signature detection for known backdoors, web shells, and injection patterns across plugins, themes, and uploads.
• Heuristic analysis that flags obfuscation and suspicious constructs (eval, encoded payloads) even when the exact malware is brand new.
• Upload sanity checks, including detection of PHP code hiding inside image files.
• Low false positives by design: files that are byte-identical to official WordPress.org releases are trusted and skipped, so the report shows you real leads instead of noise.
• Scheduled scans that keep watching after you close the dashboard.

Findings are ranked by severity — critical, high, medium, low — with exact file paths, so you know what to look at first. And a deliberate design decision: Site Sentinel detects and reports, it never auto-deletes. Automatic "cleanup" tools that guess wrong can take a working site down; you stay in control of every change. For the full feature tour, see my deep dive into Site Sentinel.

How infections get in — and why that matters for detection

Finding malware without finding the entry point guarantees a rerun. Across the infected sites I've cleaned, the way in is depressingly consistent:

• Outdated plugins and themes with publicly documented vulnerabilities — the single biggest cause. Bots scan for known-vulnerable versions within days of disclosure.
• Nulled premium plugins and themes. "Free" copies of paid products are the most reliable malware delivery mechanism in the WordPress ecosystem; many ship pre-backdoored.
• Weak or reused admin passwords without two-factor authentication, harvested by credential-stuffing bots working from breach dumps.
• Cross-contamination on shared hosting — one forgotten staging install or abandoned site in the same account infects its neighbors through the shared filesystem.
• Stolen FTP/SFTP and hosting-panel credentials, often lifted by malware on a developer's own computer.

Each entry point leaves a different trail — a vulnerable plugin means the payload appears in that plugin's directory first; stolen FTP credentials show up as file changes with no matching web-server log entry. Reading the infection's geography tells you which door to lock.

A detection routine that actually gets followed

Security routines fail when they demand discipline. This one survives contact with a busy schedule:

1. Scheduled scans, weekly at minimum. Set the scanner's schedule once and let it run — detection you have to remember is detection that stops happening by March.
2. A scan after every update batch. Core, plugin, and theme updates change files legitimately; scanning right after gives you a clean baseline, so the next unexpected change stands out.
3. A monthly five-minute review: admin user list, scheduled tasks (cron entries), and the "recently modified files" view. Three lists, one coffee.
4. Google Search Console's security tab — Google often notices SEO-spam injections aimed at its own index before anything else does. It's free monitoring; claim the property and read the emails.

If you find something

Take a full backup first (evidence matters), change all passwords and security keys, restore or replace tampered files from official sources, remove the backdoors the scan located, then update everything and find the entry point — otherwise the infection returns in a week. If that sounds like more than you want to handle alone, my website maintenance and support service covers exactly this: cleanup, hardening, and ongoing monitoring so it doesn't happen twice.