WordPress Malware: What to Do

A containment-first response plan for suspected WordPress malware, including backups, credential resets, cleanup and recovery.

Updated August 30, 2026 · Research-based editorial guide

Editorial note: We do not claim firsthand use unless explicitly stated. Provider details can change; verify live terms before purchasing.

Key takeaways

If you suspect malware, preserve evidence and backups before making destructive changes.
Contain access, reset credentials from a clean device, identify the intrusion path, clean or restore, then patch the root cause.
A clean-looking homepage does not prove a site is safe.

Considering WPX?

See WPX's current plans, resources and checkout terms directly before making a hosting decision.

See Current WPX Plans Read Our WPX Review

Affiliate link: we may earn a commission if you purchase through this link.

Containment

Containment matters because it changes either the amount of work your hosting environment must do or the amount of work you must do yourself. Evaluate it in the context of your actual site rather than treating it as a checkbox.

A good hosting decision is usually the result of several moderate advantages working together: suitable resources, reliable recovery, clear support, manageable workflows and a cost structure that still makes sense when the introductory term ends.

Preserve backups

Security should be evaluated as prevention, detection and recovery. No single firewall, plugin or host feature can remove every risk, so layered controls and recoverable backups matter.

WPX currently advertises malware scanning and removal, brute-force protection, a web application firewall, hybrid DDoS protection, SSL certificates and daily backups. Those are useful hosting-layer controls, but site owners still remain responsible for credentials, plugins, themes and application-level decisions.

Credentials

Credentials matters because it changes either the amount of work your hosting environment must do or the amount of work you must do yourself. Evaluate it in the context of your actual site rather than treating it as a checkbox.

Identify compromise

Identify compromise matters because it changes either the amount of work your hosting environment must do or the amount of work you must do yourself. Evaluate it in the context of your actual site rather than treating it as a checkbox.

Clean or restore

Clean or restore matters because it changes either the amount of work your hosting environment must do or the amount of work you must do yourself. Evaluate it in the context of your actual site rather than treating it as a checkbox.

Patch root cause

Patch root cause matters because it changes either the amount of work your hosting environment must do or the amount of work you must do yourself. Evaluate it in the context of your actual site rather than treating it as a checkbox.

Monitor

Monitor matters because it changes either the amount of work your hosting environment must do or the amount of work you must do yourself. Evaluate it in the context of your actual site rather than treating it as a checkbox.

Hosting support

Managed hosting earns its premium when it removes recurring operational work. Look beyond the existence of support and ask what the team will actually help with, how issues are escalated, and what remains your responsibility.

For agencies and site portfolios, workflow matters almost as much as raw infrastructure. Staging, access control, migration help, backups and a clear upgrade path can save more time than a small difference in headline price.