I’ve been working on WordPress malware and compromised website cases, and one pattern keeps appearing: removing the visible infected files often doesn’t solve the actual problem.

A site can look completely clean and still contain a hidden persistence mechanism.

Some of the areas I normally investigate include modified PHP files, wp-config.php, .htaccess, functions.php, wp-content/uploads, unknown admin accounts, wp_users/wp_usermeta, database injections, wp_options, malicious cron jobs, compromised plugins/themes, and other hidden backdoors.

This becomes even more important when several WordPress installations are hosted under the same hosting account. Cleaning only one site may not be enough if another compromised installation is responsible for reinfection.

I’ve also seen cases involving spam URLs, gambling/casino injections, malicious redirects, SEO spam and unauthorized administrators.

My approach is therefore: identify the infection → investigate persistence → remove malicious code → check the database and users → close the likely entry/reinfection path → harden the site.

If anyone here is dealing with a WordPress infection that keeps returning, feel free to describe the symptoms. I’m happy to suggest what areas I would investigate first.