Work through these steps in order. Do not skip step 1 — cleaning a site while it is still serving malware to visitors and re-infecting itself wastes the effort.
1. Contain
- Open a support ticket immediately so we can check the account server-side and confirm whether other sites on the account are affected.
- Change your cPanel password, all WordPress administrator passwords, your database password, and any FTP accounts.
- Delete FTP or WordPress users you do not recognise.
2. Identify
- Run ImunifyAV from cPanel and review the detected files.
- Install Wordfence and run a full scan comparing core files against the official repository.
- Check File Manager for recently modified files — sort by Last Modified. Injected code is usually in
index.php,wp-config.php, themefunctions.php, or new random-named PHP files inwp-content/uploads.
3. Clean
The most reliable route is to restore from a backup taken before the infection, then immediately apply all updates. If you have no clean backup: delete wp-admin and wp-includes entirely and replace them with fresh copies from a matching WordPress download, replace all plugins and themes with fresh downloads, and manually inspect wp-content/uploads for PHP files — there should be none.
4. Close the hole
Update everything, remove nulled software, enable 2FA, and work through the hardening checklist. A site that is cleaned but not hardened is usually reinfected within days.
5. Recover your reputation
If Google has flagged the site, request a review in Google Search Console under Security Issues once it is clean.
