Check for malicious code?

If you want to be certain your site is clean, you can either start with a fresh install of WordPress, all of your plugins and the theme.
An alternative would be to use the WP CLI verify-checksums to check your core and plugins for any modifications.

Perhaps the hardest one to clean is your database as malicious code could be hiding in any number of tables. Take a backup first before you do any sort of cleanup, and then you can start to look for common malicious code markers such as PHP eval, base64_decode, gzinflate, shell_exec etc. Take a look at this article for some further explanation on these.

The How to Clean a WordPress Hack article on the Securi.net website is also worth a read.

Related Posts:

  1. What’s the effect if this malware if infected your WP?
  2. Malware on site [closed]
  3. How to find the backdoor of the hack
  4. My wordpress site was hacked – is my htaccess file compromised?
  5. My WordPress Blog sends malicious traffic to other sites [closed]
  6. Hacked WordPress website, as notified by Google Search Console, what to do? [closed]
  7. How was my WP site hacked [closed]
  8. If a WP install is hacked, can it spread to other domains on a server?
  9. Find and Replace text in the entire table using a MySQL query
  10. Is it a good idea to rename the “index.php” in “wp-admin” folder to avoid being hacked?
  11. How to fight this wp-info.php exploit? [closed]
  12. Prevent Hacking of WordPress Site [closed]
  13. Suspicious URLs being loaded after hack and restore
  14. Server hacked: correct contents of wp-uploads directory? [closed]
  15. Site hacked with malware [closed]
  16. Copy wordpress website pages and content
  17. How do I know if my WP Theme is using infamous TimThumb?
  18. Spam pages hack? [closed]
  19. Why would a hacker add this code to each post, and how to do mass cleanup?
  20. Is the current spate of hacks related to the recent security fix?
  21. I have removed the malware from our website however, when I tried again to search the word from Google it is still there [closed]
  22. Have I been hacked? Mysterious code at the top of theme files [closed]
  23. Strange codes in my wordpress site and my website is running too slow [closed]
  24. Spam Content Serving from old cached version of site?
  25. How to solve wordpress redirection (no malware was found)?
  26. Help determining if the following are legitimate files
  27. My blog was hacked? WP posting random posts
  28. Have I been hacked – getting new site setup email for 8 localhost wordpress sites
  29. Site Hacked – WordPress Divi Site – Cannot find where to fix the issue? [closed]
  30. malware in wordpress installer on dreamhost. [closed]
  31. Where I can find a list of WordPress security risks?
  32. looking for indoxploit hack solution [closed]
  33. Why functions.php file automatically empty?
  34. Bruteforce attack from 127.0.0.1?
  35. WordPress installer attack
  36. Why wordpress is hitting another url
  37. Where do hackers usually run their hacking script? [closed]
  38. Malicious Code in Index.php WordPress [closed]
  39. WP Site Hacked, Serp Google Spam [closed]
  40. My site appears to be hacked [closed]
  41. WordPress Redirect Hack
  42. Strings of malicious code to look for after a hack
  43. Hacked/cloaked sitemap [closed]
  44. Not able to change WordPress admin email. Someone added another admin credentials
  45. My WordPress Website Redirect to bigbricks.org and other site
  46. If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
  47. WordPress site hacked. Has .htaccess been hacked?
  48. Scanning Database for malicious Data
  49. How Attackers write script into my php files?
  50. Websites defaced by uploading script using theme editor
  51. How can I find security hole in my wordpress site?
  52. Has anyone experience w/ WordPress (MultiSite) hidden users (possibly hacked)?
  53. Restrict access to xmlrpc.php
  54. How to prevent bot or someone to modify any file automatically?
  55. How do i disable/disallow and tags in TinyMCE?
  56. hSite has no css on mobile [closed]
  57. Unfamiliar query string in Google Search Console URL not found
  58. Strange gibberish JavaScript in Editor – site hacked?
  59. wp-config.php modified?
  60. Suspicious Files
  61. Invisible spam post in backend
  62. How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
  63. Files automatically added
  64. How To Clean The Malware Infected & Hacked WordPress Websites? [duplicate]
  65. You appear to have already installed WordPress. To reinstall please clear your old database tables first
  66. getting casino links on my woocommerce site [closed]
  67. sitemap contains weird links and does not contain my pages [closed]
  68. Malware script in database post table only? [closed]
  69. New user is assigned 2 roles: customer and superadmin
  70. Hacked WordPress website /Homepage redirect [closed]
  71. wp-admin folder removed by hacker [closed]
  72. How to find exploited wordpress plugin [closed]
  73. What can I do when an outside party hacks into my weblog and changes my display name?
  74. Troll the hackers by redirecting them
  75. Website show Google Ads when we have no Google Ads linked to our website
  76. malware undetectable by multiple scans
  77. WordPress Hacked 5.5 admin-ajax.php [closed]
  78. Is there a simple way to set wordpress site files back to out of the box?
  79. Can’t access htaccess [closed]
  80. Replace domain in database
  81. Admin user lacks admin permissions after hack and can’t reinstate
  82. Website Got Hacked – Fixed – Now Cannot Activate Theme
  83. WordPress disable direct access of files in WordPress installation path
  84. Is this a hack? WordPress Usernames of every website we have changed into one single name automatically?
  85. Should I prevent access to .htaccess and wp-config.php files?
  86. Verifying that I have fully removed a WordPress hack?
  87. Javascript Injection on my WordPress Site
  88. Replacing nav-menus.php file with standard clean one?
  89. Some code is added automatically to my site’s header – what is it?
  90. How can hackers access WP usernames? [duplicate]
  91. suspicious boolean.php file in wp web root [closed]
  92. How to remove content from hacked pages? [closed]
  93. My WP site and password was hacked, what to do? [closed]
  94. Is my WP site being hacked?
  95. My WordPress site hacked with unwanted popups [closed]
  96. Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
  97. WordPress Hacks/Defacing [closed]
  98. WordPress broken dashboard with ninja-shell text
  99. wp-salt.php and wp-cli.yml File present in public_html folder
  100. Are there any legitimate reasons for a web browser to directly access wp-includes/*.php?