Why does malware keep coming back to my WordPress site?

Your website was hacked, someone cleaned it, and for a few days or weeks everything looked fine. Then the same redirect, spam pages or suspicious files appeared again.

This is one of the most frustrating situations for a website owner. It can feel as if the cleanup was pointless, or as if the attacker is impossible to stop.

In most cases, malware that keeps coming back means that the cleanup removed the visible symptoms but not the cause. Something is still allowing the attacker back in, or something left on the server is recreating the infection.

The good news is that a reinfection usually has an identifiable reason. Once that reason is found and closed, the cycle normally stops.

This guide explains the most common reasons malware returns, which checks you can safely make, what to avoid and when to ask for specialist help.

What does it mean when malware keeps returning?

A WordPress infection usually has three parts:

• the entry point, the weakness the attacker used to get in
• the persistence, whatever lets them return or keeps the code alive
• the payload, the visible damage, such as spam pages, redirects or injected scripts

Many cleanups focus on the payload because it is what visitors, customers and Google see. Removing it makes the website look normal again. But if the entry point or the persistence mechanism survives, the payload returns, sometimes within hours.

So the question to ask is not "how do we remove the malware again?" but "what did the last cleanup leave behind?".

Why does the malware come back?

There is often more than one reason at the same time.

The entry point was never closed

If the attacker got in through a weakness, that weakness may still be there. Common examples:

• a vulnerable plugin or theme that has not been updated, or that is no longer maintained
• a nulled or pirated plugin or theme, downloaded from an unofficial source, which may contain malicious code from the start
• stolen credentials, such as a WordPress, hosting, SFTP or database password that was not changed
• an abandoned plugin that is deactivated but still present on the server, where its files can still be reached
• an old copy of the website in a subfolder, with outdated and vulnerable software

Deactivating a plugin is not the same as removing it. In many cases its files can still be called directly.

Backdoors were left behind

Attackers rarely rely on a single way in. After the first compromise, they often install backdoors: small pieces of code that let them run commands or upload files whenever they want.

Backdoors can be:

• hidden in files with innocent-looking names
• added to legitimate plugin or theme files
• stored in the uploads folder, which should only contain media
• placed in the mu-plugins folder, which loads automatically and does not appear in the normal plugin list
• stored in the database, for example inside an option or a widget

A cleanup that removes the visible malware but misses one backdoor leaves the door open.

Other websites on the same hosting account are infected

If several websites share one hosting account, an infection in one of them can often reach the others. Cleaning only the website that shows the symptoms leaves the source untouched.

This is very common with old test sites, forgotten microsites or a previous version of the website kept "just in case".

Scheduled tasks recreate the infection

WordPress has its own scheduling system, called WP-Cron, and servers have their own scheduled tasks (cron jobs). An attacker can add a task that regularly downloads or rewrites malicious code.

If the task is not removed, the malware may reappear at regular intervals, which is often a useful clue.

A compromised account is still active

The attacker may still have:

• an administrator account in WordPress, possibly with an ordinary-looking name
• an active login session that was never ended
• access to the hosting control panel, SFTP or the database
• access to an email account used to reset passwords
• ownership of the property in Google Search Console

If one of these was missed, the attacker can simply log back in. See what to do about an unknown administrator for more detail.

An infected backup was restored

Restoring a backup is a common response to a hack. But if the backup was made after the compromise started, it contains the same malware or backdoor.

Infections can stay quiet for weeks before showing visible symptoms, so a backup made "before we noticed the problem" is not necessarily clean.

What are the safe first checks?

These checks help you collect information without changing anything.

Write down the pattern

Note:

• when the malware first appeared
• when it was cleaned, and by whom
• when it returned
• whether it returned in the same form or a different one
• whether it seems to return at regular intervals

A regular pattern suggests a scheduled task. A quick return after a cleanup suggests a backdoor or an active account. A return after a long time suggests an entry point that was used again.

Ask what the previous cleanup included

If a hosting provider, agency or security service cleaned the site, ask them:

• what they removed
• whether they found how the attacker got in
• whether they checked other websites in the same account
• whether passwords and security keys were changed
• whether they checked scheduled tasks and user accounts

Gaps in the answers often point to the problem.

Check users and plugins in the dashboard

In WordPress, look at Users → All Users and filter by Administrator. Check for accounts you do not recognize.

Then look at Plugins → Installed Plugins. Note plugins you do not recognize, plugins that have not been updated in a long time, and plugins installed from outside the official directory without a valid license.

Do not delete anything yet. Record what you see.

Ask the hosting provider

Your hosting provider may be able to tell you:

• whether malware is still being detected
• which other websites share the account
• whether there are server-level scheduled tasks
• whether there were suspicious logins to the control panel or SFTP
• whether server logs are available for the period of the attack

What can you safely do now?

Some steps reduce risk without destroying evidence:

• change the password of your own WordPress account and your hosting account, using unique passwords
• turn on two-factor authentication where available
• check that the email account used for WordPress and the hosting is secure
• stop restoring backups until it is clear which one is clean
• pause advertising that sends traffic to the website, if visitors are being redirected

Changing all passwords is most effective after the entry point has been found. Otherwise, the new passwords may be exposed the same way.

What should you avoid?

Avoid:

• repeating the same cleanup and hoping for a different result
• deleting files at random
• deactivating suspicious plugins instead of removing them
• restoring the most recent backup without checking it
• cleaning one website while others in the same account remain untouched
• installing several security plugins at once
• leaving unknown administrators in place "until later"
• using nulled or pirated plugins and themes

How do you break the cycle?

A complete response usually includes:

1. preserving a copy of the current files, database and logs
2. finding the entry point, using logs, file dates and known vulnerabilities
3. replacing WordPress core, plugins and themes with fresh copies from official sources
4. searching the remaining files, uploads and database for backdoors
5. checking every website in the hosting account
6. removing unknown accounts and malicious scheduled tasks
7. changing all passwords and the WordPress security keys
8. removing unused plugins, themes and old copies of the site
9. monitoring the website after the cleanup to confirm the infection has not returned

Step 9 matters. A cleanup is only confirmed when the website stays clean over time.

When should you ask for support?

Ask for help when:

• the malware has come back at least once
• you do not know how the attacker got in
• several websites share the same hosting account
• the website handles payments, subscriptions or personal data
• Google or your hosting provider has flagged the site
• you do not have a backup you trust

A recurring infection is a sign that something specific has been missed. Finding it often requires access to logs and experience with the patterns attackers use.

How D4Hub can help

D4Hub can:

• review what the previous cleanup did and did not cover
• identify the entry point using logs, file analysis and known vulnerabilities
• search for backdoors in files, uploads, mu-plugins and the database
• check every website in the hosting account
• review WordPress and server scheduled tasks
• remove unknown accounts and end active sessions
• replace core, plugins and themes with clean copies
• identify a clean backup or rebuild from verified sources
• set up monitoring and maintenance to reduce the risk of reinfection
• support the Google review if the site has been flagged

You can ask for support at any stage, including after a cleanup that did not hold.

wp core verify-checksums

wp plugin verify-checksums --all

find wp-content/uploads -type f -name "*.php"

ls -la wp-content/mu-plugins/

wp cron event list

crontab -l

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

find . -type f -name "*.php" -mtime -14