A Step-by-Step Guide to Deobfuscating Malware and Encrypted Backdoors in WordPress Source Code

Malware on web servers and shared hosting often disguises itself as spoofed WordPress core files like wp-vcd, encoded eval/base64 function strings in index.php, or malicious mu-plugins that automatically regenerate after deletion. This article shares a technically standardized malware extraction workflow using Integrity Hash Checks, web shell scanning, and establishing thorough security hardening mechanisms for enterprise websites.

1. Signs Your WordPress Website Is Infected with Malware

A compromised website often exhibits the following unusual symptoms:

• Suspicious URL Redirection: Visitors coming from Google or mobile devices are redirected to gambling, betting, or phishing websites.
• Red Browser Warnings: Google Chrome or Google Search Console displays a warning: ‘Deceptive site ahead’.
• Rogue Admin Accounts Automatically Created: Unfamiliar administrator accounts with random email addresses appear in the user list, which were not created by anyone in your organization.
• CPU/RAM Resource Spikes: The server is constantly overloaded at 100% capacity due to malicious scripts running in the background to send spam emails (Spam Mail) or mine cryptocurrency.

2. Step 1: Isolate the Environment and Create an As-Is Snapshot

Before proceeding with dissection, immediately sever public access and create an audit trail using these 3 technical operations:

1. Enable server maintenance mode: Configure a temporary 503 maintenance page to prevent malware from continuing to communicate with the attacker’s Command & Control (C&C) Server.
2. Export a database backup: Run the command wp db export backup_infected.sql to preserve the exact state of the data for forensic analysis.
3. Compress the wp-content directory: Archive the entire wp-content/ directory into an independent compressed file to safeguard user upload files.

3. Step 2: Integrity Hash Check with WP-CLI

The fastest and most accurate way to clean malware is to verify all source code files against the official WordPress.org repository using WP-CLI:

# 1. Verify WordPress Core source code integrity
wp core verify-checksums --allow-root

# 2. Verify integrity of all official plugins from WP.org
wp plugin verify-checksums --all --allow-root

# 3. Re-download clean Core files from the official repository
wp core download --skip-content --force --allow-root

The wp core verify-checksums command calculates the sha256 hash of each file on the server and compares it against WordPress.org servers. Any infected file, any modification by even a single character, or foreign files injected into the wp-admin or wp-includes directories will be instantly flagged.

4. Step 3: Scan and Extract Web Shells in the Uploads Directory

The wp-content/uploads/ directory should only contain media and document files (jpg, png, webp, pdf). Any file ending with .php, .phtml, or .ico that contains executable code is a Web Shell planted by hackers:

# 1. Find all stealthy PHP files hidden within the uploads directory
find wp-content/uploads/ -type f -name "*.php"

# 2. Scan for dangerous code execution functions (eval, base64_decode, assert)
grep -rnE "(eval|base64_decode|gzinflate|str_rot13|assert)s*(" wp-content/uploads/

# 3. List files created or modified in the last 7 days
find . -type f -name "*.php" -mtime -7

Once the list of malicious files has been identified, proceed to isolate and permanently remove them:

# 1. List and remove fake malware files in the mu-plugins directory
ls -la wp-content/mu-plugins/
rm -rf wp-content/mu-plugins/hidden-backdoor.php

# 2. Delete fake WordPress core files in the root directory
rm -f wp-vcd.php wp-tmp.php class.wp-cache.php .well-known/*.php

# 3. Reset standard ownership for the web server
chown -R www-data:www-data wp-content/

5. Step 4: Clean the Database and Revoke Admin Privileges

Many sophisticated malware strains do not reside in static files, but directly within the wp_options or wp_posts tables as obfuscated JavaScript scripts. You need to perform the following steps in the database:

• Check the wp_users table: Delete all unauthorized accounts with administrator privileges.
• Check autoloaded keys in wp_options: Scan the autoload = 'yes' field to find unusual values containing eval or base64 strings.
• Regenerate all Security Salts in the wp-config.php file to invalidate any remaining hacker sessions.

6. Step 5: Server Hardening and Locking Down Read-Only Mode

After completely cleaning the source code, the decisive step to prevent malware from returning is to harden the runtime environment:

// Add the following lines to wp-config.php right above the 'happy publishing' line

// 1. Disable the file editor in WP Admin
define('DISALLOW_FILE_EDIT', true);

// 2. Block direct plugin/theme installations and updates via the UI
define('DISALLOW_FILE_MODS', true);

// 3. Block execution of unauthorized PHP files by disabling script execution in uploads (Web Server configuration)

7. Comparison of WordPress Malware Scanning Methods

Comparing the effectiveness of conventional plugin scanning versus technical hash verification workflows:

8. Frequently Asked Questions & Troubleshooting (FAQ)

A compilation of hands-on experience in troubleshooting hacked and malware-infected WordPress websites:

Read More: Explore Further Technical Categories on DevPixel VN