Why does website malware keep coming back after I delete it?
Deleting infected files isn't enough because persistent malware hides its source in the database or configuration scripts, automatically recreating the threat on the next request. This leaves site owners stuck in an endless loop of manual cleanups where infections reappear within hours.
Core Friction Pattern
Analysis of 10 peer accounts across online developer and community forums reveals that “Why does website malware keep coming back after I delete it?” repeatedly surfaces due to edge-case mismatches between standard defaults and real-world environments. Standard troubleshooting frequently falls short, compelling practitioners to develop custom workarounds.
+13 alternative community-tested workarounds cataloged below.
What the numbers show
Counted from the threads quoted below. How we count
- People have been saying this in most months since September 2026.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
Why does website malware keep coming back after I delete it?
- 1Replacing core files and plugins with clean onesDid this help you?
- 2Changing user passwords, application passwords, app keys, and auth tokensDid this help you?
- 3Scanning via SSH from outside the site rather than using an in-plugin scannerDid this help you?
- 4Checking source code using curl as GooglebotDid this help you?
- 5Manually scanning files and databases for hidden backdoors and rogue administrator accountsDid this help you?
- 6Relying on host malware scannersDid this help you?
- 7Check the wp-content folder for recently modified PHP filesDid this help you?
- 8Run a scan with the web host or a security pluginDid this help you?
- 9manually searching through and clearing out malicious code filesDid this help you?
- 10Replacing core files with a fresh copyDid this help you?
- 11Going through plugins and themes to update or remove unused itemsDid this help you?
- 12Resetting admin passwords and security keysDid this help you?
- 13Checking uploads folders for stray script filesDid this help you?
- 14Installing web application firewalls and security tools like Wordfence or CloudflareDid this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“we ran into a weird issue, where multiple links (buttons) on our site would lead to a gambling site (while masking themselves as our website. The URL was correct).”source ↗
“After a couple of hours I managed to clear out all malicious code and found a VERY interesting file.”source ↗
“A manual file cleanup was not enough: it came back within 24 hours because the malware’s source of truth was in the database and in wp-config.php.”source ↗
“i had the same fight on a client box, deleted the mu-plugin and it was back on the next request because object-cache.php was dropping it back from the db.”source ↗
“I've had this happen before and the entry point was almost never the core files themselves — it was usually an outdated plugin or theme letting something in, then rewriting the core files.”source ↗
“My Wordpress core files keep getting hacked with malware. I’m unsure of how they are getting in with all security protections enabled.”source ↗
“Thanks for the heads up. I noticed UK Casinos linked on a client’s Shopify site but it was through a link to an old domain they no longer used. I’ll need to check if that old domain was a Wordpress site. I guess I’ll be working this weekend to make sure their Shopify site is not compromised.”source ↗
“Me ha ocurrido en una web, pero solo se activaba desde mac. Muchas gracias por compartirlo en cuanto tenga un rato sigo estas instrucciones.”source ↗
“What a cluster fuck.”source ↗
“That looks like a credit card skimming script, likely injected through a compromised plugin or theme file.”source ↗
“I remember reading about a specific malware that embedded itself in the database and once the site was cleaned it would somehow reinstall itself.”source ↗
“facing this thing/malware on several wordpress sites?”source ↗
“I have an antivirus on the server”source ↗