How to Scan and Remove Malware from WordPress with Wordfence

If your WordPress site has been acting strangely — unexpected redirects, spam pages, browser warnings — it may be infected. Wordfence is a well-established free security plugin that scans WordPress for malware, backdoors and altered files, and helps you clean them up. It is a solid first responder for a compromised site.

First, act quickly

Before scanning, change your key passwords — WordPress admin, cPanel, and database. A live attacker with valid credentials will just re-infect a site you clean. For a full recovery walkthrough, see recovering a hacked WordPress site.

Step 1: Install Wordfence

1. In your WordPress dashboard, go to Plugins → Add New.
2. Search for Wordfence Security, install and activate it.

Step 2: Run a scan

1. Open Wordfence → Scan.
2. Click Start New Scan and let it run — it compares your core files against known-good versions and looks for malicious code.
3. Review the results, which flag infected files, suspicious code and outdated plugins.

Step 3: Clean up

• Core files flagged as changed can usually be repaired by reinstalling WordPress core.
• Unknown malicious files can be deleted from the scan results.
• Infected plugins/themes — remove and reinstall clean copies; delete any you do not use.

Work carefully, and lean on a recent clean backup if one exists.

Step 4: Harden against the next attack

Once clean, close the door: keep everything updated, use strong passwords and two-factor authentication, and run a server-side scan with Imunify360 for a second opinion.

Frequently asked questions

Wordfence found nothing but my site still misbehaves.

Some infections hide in the database or in files outside WordPress's reach. Run a server-side scan with Imunify360 as well, and check for unexpected admin users and scheduled tasks.

How did my site get infected in the first place?

Usually an outdated plugin or theme with a known vulnerability, or a weak password. Keeping everything current and using strong, unique passwords prevents the large majority of infections.

Should I just start over?

If the infection is deep and you have a clean pre-infection backup, restoring it can be faster and safer than hunting every trace. Then harden immediately so it does not recur.