WordPress Theme Malware: How to Clean Infected Theme Files Without Losing Customizations

WordPress theme malware is especially risky because an infected theme can run code on every front-end request. A few injected lines in functions.php, header.php, or an included file may redirect visitors, recreate spam, add hidden administrators, or load a remote payload.

Replacing the whole theme may remove malware but also erase a child theme, custom templates, styling, or business logic. Preserve evidence and intentional work before replacing untrusted code.

RyoheiYokoyama

I’m Ryohei Yokoyama, founder of SiteFixNow. I’ve worked as an IT engineer for over 20 years and have handled many WordPress recovery, malware removal, hacked site repair, and security cleanup cases. In this article, I’ll explain how to clean infected theme files without sacrificing legitimate customizations or overlooking the wider compromise.

WordPress theme malware: identify infection without guessing

Start by proving what changed instead of deleting every unfamiliar file. Themes legitimately contain PHP, JavaScript, templates, generated assets, and vendor libraries, so a strange name or long code block is not enough to declare malware.

Useful evidence combines timestamps, differences from the official package, unexplained remote requests, obfuscation, and behavior that stops when the theme is disabled. Record symptoms and recent updates first.

Inventory installed themes and confirm the active parent and child. If the site has redirects or unknown scripts, review WordPress file infection cleanup across wp-content and wp-config.php, because the theme may be only one affected area.

wp theme list
find wp-content/themes -type f -mtime -14 -print
find wp-content/themes -type f \( -name "*.php" -o -name "*.js" \) -print

WordPress theme malware evidence: preserve files and customizations

Before cleanup, save an evidence copy and a separate working copy. This protects custom code and timestamps if replacement causes an error.

Preserve site files, database, logs, and both active theme folders. Treat the child theme’s overrides separately from parent-theme vendor code.

The newest backup may already contain malware. The guide to restore WordPress from a backup after a hack explains how to choose a restore point and verify it.

WordPress theme malware comparison: separate vendor code from custom work

Compare against a clean package from the original source and use the same theme version. Different versions create legitimate noise that can hide malware.

Replace a commercial parent theme instead of repairing vendor files by hand. For a custom or child theme, keep documented overrides, hooks, CSS, and approved snippets; quarantine unexplained code.

diff -ru clean-theme/ suspected-theme/ > theme-differences.txt
find suspected-theme -type f -exec shasum -a 256 {} \; > theme-hashes.txt

# Review differences; do not delete automatically.

Review unexpected decoding, remote includes, file-writing code, logged-out-only behavior, and PHP inside asset folders. These are warning patterns, not automatic proof.

Preserve unexplained differences outside the live web root before restoring anything.

WordPress theme malware cleanup: replace infected files in a controlled order

Remove the attacker’s write path first. Stolen credentials, a vulnerable plugin, or a backdoor can reinfect a clean theme.

Use maintenance mode, rotate access, and disable confirmed entry points. Replace the parent theme, restore only reviewed custom changes, clear caches, and test before reopening traffic.

If replacement causes a fatal error, do not restore the infected folder wholesale. Check logs, PHP, and dependencies, then use the guide to recover a WordPress site after a plugin or theme crash.

WordPress theme malware scope: check beyond the theme folder

A clean theme does not prove a clean site. Investigate other files, accounts, database values, scheduled tasks, and server access.

Check wp-config.php, .htaccess, plugins, uploads, administrators, database options, and WP-Cron. Review server logs around the theme’s change time.

wp-config.php
.htaccess
wp-content/plugins/
wp-content/mu-plugins/
wp-content/uploads/
WordPress Users and application passwords
Database options and scheduled events
Hosting, SFTP, access, and error logs

Scanners may miss custom loaders, while file comparison may miss stolen access. Follow the wider process to scan WordPress for malware and hidden backdoors before declaring recovery complete.

WordPress theme malware verification: test behavior and watch for return

Prove both function and security. Test public pages, wp-admin, forms, checkout, mobile, logged-out visits, and search-result traffic.

Recheck hashes and timestamps after page loads and scheduled tasks. If code returns, stop deleting symptoms and find the process or account writing it.

Then secure WordPress after malware removal: update trusted components, remove abandoned themes, keep off-site backups, and monitor changes.

WordPress theme malware FAQ

Can I delete an infected WordPress theme and reinstall it?

Yes for a replaceable parent theme, but save evidence first. Review child-theme changes separately and check the wider site so a backdoor cannot infect the replacement.

How do I know whether code in functions.php is malware?

Compare the correct clean version with documented custom code. Remote calls, obfuscation, file-writing behavior, redirects, and unexplained changes require review.

Will switching themes remove the malware?

It may stop theme-only code, but it does not remove stolen accounts, database injections, cron persistence, or the original vulnerability. Switching is an isolation test, not proof of cleanup.

WordPress theme malware cleanup summary

Clean WordPress theme malware by preserving evidence, separating parent and child themes, comparing the correct clean version, replacing vendor code, and restoring only reviewed customizations.

Most importantly, verify the whole site. Rotate access, inspect other persistence locations, test from several visitor contexts, and monitor for the malicious file’s return. A theme replacement is complete only when the writer is gone and the site remains clean.

If You Can’t Secure or Recover Your WordPress Site Yourself

If your website shows malware warnings, redirects to strange pages, or you are not sure whether it is secure,
SiteFixNow can help clean, repair, and recover your WordPress site.

We help with WordPress malware removal, hacked site repair, security cleanup, and recovery support.