How to Scan WordPress for Hidden Malware, Backdoors & Malicious Code (2026)

Common Signs of a Compromised WordPress Site

Malware rarely announces itself with obvious visual defacements anymore. Modern malicious payloads operate stealthily: redirecting mobile visitors to phishing domains, sending spam emails via server cron, or injecting hidden SEO doorway pages that only Googlebot can see.

1. Scanning with WP-CLI File Verification

If you have SSH access, use official WP-CLI commands to verify core file integrity against the WordPress.org checksum database:

wp core verify-checksums
wp plugin verify-checksums --all

If any core or plugin file has been tampered with or modified by malware, WP-CLI will highlight the exact filename instantly.

2. Searching for Base64 and Eval Injections

Malware authors frequently obfuscate backdoors using PHP functions like eval(base64_decode(...)) or gzinflate(). Run this grep command inside wp-content to hunt for suspicious payloads:

grep -rn "eval(" wp-content/
grep -rn "base64_decode(" wp-content/

3. Auditing Rogue Admin Accounts in MySQL

Check your wp_users table to verify that no unknown administrator accounts have been registered without your authorization:

SELECT ID, user_login, user_email, user_registered FROM wp_users;

Automated Core Checksum Verification via WP-CLI

Malware authors frequently tamper with standard WordPress core files like wp-settings.php, index.php, or wp-includes/formatting.php to evade simple plugin-level file scans. The fastest and most authoritative method to uncover core tampering is through official MD5 checksum verification.

Connect to your server via SSH and execute the following WP-CLI diagnostic commands:

# Verify core integrity against WordPress.org repository hashes
wp core verify-checksums

# Verify all installed repository plugins
wp plugin verify-checksums --all

# Search for suspicious obfuscated eval payloads across themes and uploads
find wp-content/ -type f -name "*.php" -exec grep -Hn "eval(base64_decode" {} ;

If any file fails the checksum test, WP-CLI immediately highlights the exact file path and line number, allowing you to replace the compromised file with a pristine original copy in seconds.

Frequently Asked Questions

Where do attackers hide backdoors in WordPress most frequently?
The most common hiding spots are fake plugin directories, the wp-content/uploads/ folder (often disguised as .png.php or thumb_xyz.php), and scheduled WordPress database cron jobs.

Can a nulled theme or plugin reinfect my cleaned WordPress website?
Yes. Nulled items almost universally contain hidden base64-encoded web shells and cron backdoors that automatically download fresh malicious payloads within 24 to 48 hours of cleaning.

What is the first step I should take if my site is infected?
Immediately switch the site to maintenance mode, perform an emergency database and file backup, reset all WordPress admin passwords, database credentials, and SSH keys, and run core checksum verification.