Detect Malicious WordPress PHP & JavaScript Code

Use Antivirus and Security Plugins. The first line of defense against malware is a strong security plugin.

Wordfence Security: Scans all theme and plugin files for unauthorized modifications, detects anomalies in PHP and JS code, and blocks malicious IPs in real time with its Web Application Firewall.
iThemes Security Pro: Goes beyond scanning by preventing brute force logins, blocking known bad bots, enforcing strong passwords, detecting file changes, and offering Two-Factor Authentication.

Combined, these plugins dramatically reduce the attack surface of your WordPress installation.

Security Scans & Online Analysis

Alongside plugins, you can scan suspicious files or your entire website using external services:

• VirusTotal: Upload themes, plugins, or individual PHP/JS files to check them against dozens of antivirus engines.
• Sucuri SiteCheck: A free service to scan your domain for known malware signatures, redlists, and spammy redirects.
• Google Safe Browsing: Alerts you if your site is already flagged as unsafe.

These tools are free to start with, but professional paid scans provide deeper detection layers. For best results, scan every file before installation – even if it comes from a trusted source.

Manual Inspection of Suspicious Code

If you’re comfortable with development, manually check for signs of obfuscated or injected code:

• PHP functions like eval(), base64_decode(), gzinflate(), and preg_replace() with the /e modifier.
• JavaScript code snippets using document.write() with long encoded strings or suspicious atob() calls.
• Files in unusual directories (e.g., wp-includes/fonts/ containing PHP scripts).
• Recently modified files with unfamiliar code blocks.

While not every occurrence of these functions is malicious, attackers often rely on them to hide backdoors. Compare suspicious files against a clean WordPress installation to verify integrity.

Database Anomalies

Attackers frequently inject malicious JavaScript into your wp_posts table or alter wp_options to create hidden redirects. Run queries to identify unexpected <script> tags or unfamiliar admin accounts. Always back up your database before making changes. Look for spam links/injected scripts in wp_posts, options like home, siteurl, rogue active_plugins, and suspicious scheduled events:

-- obvious script tags in posts/pages
SELECT ID, post_type, post_status FROM wp_posts
 WHERE post_content REGEXP '<script|data:text|atob\\(|unescape\\(' LIMIT 50;

-- siteurl/home integrity
SELECT option_name, option_value FROM wp_options 
 WHERE option_name IN ('siteurl','home');

-- find odd admin accounts
SELECT ID, user_login, user_email, user_registered FROM wp_users
 ORDER BY user_registered DESC LIMIT 10;

Step-by-Step Cleanup Guide

If you find suspicious entries, follow this process to remove them safely:

1. Backup First: Export your full database using phpMyAdmin, Adminer, or WP-CLI (wp db export).
2. Review in Staging: Work on a cloned copy of your site so you can test cleanup before touching production.
3. Fix Core Options: Reset altered siteurl or home values to your actual domain.
4. Remove Malicious Content: Edit or delete infected posts and pages containing hidden scripts or spammy links.
5. Check wp_users: Delete unauthorized admin accounts, then reset passwords and enable Two-Factor Authentication.
6. Audit Scheduled Tasks: In WP-CLI run wp cron event list to detect unusual jobs; remove any that look suspicious.
7. Re-scan with Plugins: After manual cleanup, run a full scan using iThemes Security Pro to ensure reinfection triggers are gone.
8. Harden Database Access: Change your DB password, update wp-config.php, and ensure proper least-privilege permissions.

Recommended Tools

• Adminer: For database browsing and editing via web interface.
• WP-CLI: Fast command-line inspection and cleanup (wp db query, wp user delete).
• WP-Optimize or Advanced Database Cleaner: Plugins to purge transients, revisions, and optimize tables after cleanup.

By combining SQL checks, careful manual review, and automated scans, you reduce the risk of hidden reinfection mechanisms inside your database.

Sometimes, the first sign of trouble comes from your visitors. They may report strange popups, redirects, or browser warnings. Always take such feedback seriously, as end users often encounter malicious code that admins overlook.

Google Reconsideration

If Google or Chrome blocks your site for hosting malware, visitors will see a red warning screen. To recover:

• Clean your site thoroughly using the steps above.
• Verify ownership in Google Search Console.
• Request a Security Review under Security Issues.

Without a full cleanup, your request will be denied, so ensure your site is genuinely malware-free first.

Reporting Malicious Sites

If you discover a compromised site harming users, you can report it to Netcraft’s malware and phishing classification system. This contributes to a safer web ecosystem overall.

Best Practices to Protect Your WordPress Website

Beyond detection, prevention is critical. Apply these measures:

• Keep WordPress core, themes, and plugins updated.
• Remove abandoned or nulled plugins/themes – these are common malware carriers.
• Enforce strong passwords and enable Two-Factor Authentication.
• Run scheduled scans with Wordfence or Solid Security Pro.
• Regularly back up files and databases to secure, off-site locations.
• Use a reliable host with built-in malware monitoring and firewalls.

Finally, always download GPL-licensed plugins and themes from trusted marketplaces like DevTools Club Marketplace to avoid hidden malware.