Malware Suspect Checker

There is a difference between a site behaving badly and a site that has been hacked, and treating one as the other wastes time. Compromise usually shows up as redirects that only happen for visitors arriving from search results or on mobile, pages appearing in Google with content in another language or about products you do not sell, administrator accounts you did not create, scheduled posts you did not write, or a browser warning that the site is deceptive. Files with recent modification timestamps that you cannot account for are another strong signal.

Redirects that only trigger for some visitors are the classic pattern, because the injected code checks the referrer or user agent first so that the site owner, who visits directly on desktop, sees nothing wrong. If customers report a redirect you cannot reproduce, test by arriving through a search result on a phone rather than assuming they are mistaken.

Before deleting anything, take a full backup of both files and database, even though it contains the infection. You will need it if a cleanup removes something legitimate, and it is the only record of how the attacker got in. Then check Search Console for a security notice, run a reputable scanner, and compare your WordPress core files against a fresh download of the same version so that any modified core file stands out immediately.

Look in the places injections normally live. In the database, the wp_options table often carries injected script in autoloaded rows, and wp_posts can contain hidden links in older content. In the file system, check the uploads folder for PHP files, since nothing in uploads should ever be executable code, and look at wp-config.php and index.php for long encoded strings. Also list every administrator account and every application password, because attackers frequently leave a second way back in that survives a file cleanup.

The most reliable cleanup replaces rather than repairs. Reinstall WordPress core from an official copy, reinstall every plugin and theme from their official sources rather than trying to disinfect them, and delete anything you no longer use, especially nulled or abandoned plugins, which are how a large share of infections arrive in the first place. Keep only the uploads folder from the old file set, after checking it for executable files.

Recovery is not finished when the symptoms stop. Change every password, including database, FTP, hosting panel and all WordPress accounts, and regenerate the security salts in wp-config.php so any stolen session cookie stops working. Remove unknown administrator accounts and application passwords. Then update everything, and if the site was flagged, request a review in Search Console once you are confident it is clean. If the same infection returns within days, something was missed, and at that point paying a specialist is cheaper than another week of guessing.