How to Clean a Hacked Drupal Website and Remove Malware

Drupal is a robust CMS, but like any platform it can be compromised through an unpatched flaw or weak credentials. Cleaning it comes down to a clear sequence: lock things down, locate the malicious code, remove it, and patch whatever let the attacker in. Follow the order and you avoid the frustrating cycle of reinfection.

Step 1: Lock it down

Change your Drupal admin password, and your cPanel, database and FTP passwords. Take a full backup of the current state before you change files.

Step 2: Find the malicious files

Scan the account to locate infected files — see scanning with Imunify360. Look especially for recently modified files, unexpected PHP in the files or sites/default/files directories, and unfamiliar scripts.

Step 3: Restore or clean the core

• Best option: restore a clean pre-infection backup.
• Manual clean: remove flagged files, then replace Drupal's core and contributed modules with fresh official copies of the same versions, keeping your settings.php and database.

Step 4: Audit modules, users and the database

Update or remove outdated contributed modules — a classic entry point. Check for admin accounts you did not create, and look for injected content or malicious code hidden in the database.

Step 5: Patch and harden

Apply all available Drupal security updates immediately. Drupal security advisories are taken seriously for good reason — unpatched sites are targeted quickly. Finish with our hardening checklist.

Frequently asked questions

Why is keeping Drupal updated so important?

Drupal vulnerabilities, once disclosed, are exploited rapidly by automated bots. Applying security updates promptly is the single most effective way to avoid a compromise.

The malware keeps returning after cleanup.

A hidden backdoor is likely still present, or the original flaw is unpatched. Replace core files fresh, remove backdoors, patch everything, and reset all credentials.

Can I restore from backup instead of cleaning?

Yes, if the backup predates the infection. It is usually faster and cleaner. Update and harden immediately afterwards so the same vulnerability is not re-exploited.