How to Find and Remove Malware Hidden in Your Website's Database

Cleaning your files but leaving your database infected is a common reason a site stays hacked. Malware can live in the database too — injected scripts in posts, spam links in options, or malicious admin users. This guide shows how to find and safely remove it using phpMyAdmin.

Always back up first

Database edits are powerful and permanent, so export the database before you touch anything. If a change goes wrong, you can restore.

Step 1: Open phpMyAdmin and search

In cPanel, open phpMyAdmin, select your database, and use the Search tab to look across tables for tell-tale signs of injection, such as <script, <iframe, or obfuscated code markers. On WordPress, pay attention to the posts, options and users tables.

Step 2: Identify what's malicious

• Injected scripts inside post or page content.
• Spam links or redirects hidden in content or settings.
• Suspicious entries in the options table, such as unfamiliar autoloaded values.
• Unexpected admin users in the users table.

Step 3: Remove it carefully

Edit the affected rows to strip the malicious code, or delete clearly malicious entries (like a rogue admin user). Work precisely — change only what is malicious, and re-check your backup is safe before large edits. For WordPress, some security plugins can clean database injections for you, which is lower-risk than manual edits.

Step 4: Coordinate with a full cleanup

Database cleaning is one half; the files are the other. Combine this with removing malicious files and backdoors, and for WordPress follow recovering a hacked WordPress site. Change all passwords afterwards.

Frequently asked questions

How do I know malware is in the database, not just files?

If spam or scripts reappear on pages after you have cleaned the files, or you find injected content when searching the database, it is in the database. Cleaning both is essential.

Is editing the database risky?

It can be — a wrong deletion can break the site. Always export a backup first, change only what is clearly malicious, and consider a reputable plugin for WordPress to reduce the risk.

I found an admin user I didn't create.

Remove it — attackers add admin accounts to keep access. After deleting it, change all passwords and hunt for the backdoor that allowed the account to be created.