Why does website malware keep coming back after I delete it?
Deleting infected files isn't enough because persistent malware hides its source in the database or configuration scripts, automatically recreating the threat on the next request. This leaves site owners stuck in an endless loop of manual cleanups where infections reappear within hours.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
- 1Replacing core files and plugins with clean ones
- 2Changing user passwords, application passwords, app keys, and auth tokens
- 3Scanning via SSH from outside the site rather than using an in-plugin scanner
- 4Checking source code using curl as Googlebot
- 5Manually scanning files and databases for hidden backdoors and rogue administrator accounts
- 6Relying on host malware scanners
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“A manual file cleanup was not enough: it came back within 24 hours because the malware’s source of truth was in the database and in wp-config.php.”source ↗
“i had the same fight on a client box, deleted the mu-plugin and it was back on the next request because object-cache.php was dropping it back from the db.”source ↗
“Thanks for the heads up. I noticed UK Casinos linked on a client’s Shopify site but it was through a link to an old domain they no longer used. I’ll need to check if that old domain was a Wordpress site. I guess I’ll be working this weekend to make sure their Shopify site is not compromised.”source ↗
“Me ha ocurrido en una web, pero solo se activaba desde mac. Muchas gracias por compartirlo en cuanto tenga un rato sigo estas instrucciones.”source ↗
“What a cluster fuck.”source ↗