Why removing malware isn't the same as fixing a hack

There's a pattern we see over and over. A site owner finds malware — their host emails them, or Google flags the site, or customers mention a strange redirect. They install a security plugin, run a scan, delete the infected files, and breathe out. Three weeks later it's back.

Nothing about that surprises us, because deleting malware and fixing a hack are two different jobs. The malware is the consequence. The way it got in is the cause — and the cause is still there, waiting for the next automated visit.

Nobody typed your address

Most WordPress compromises aren't personal. Bots scan the entire internet for sites running a specific plugin version with a known vulnerability. Your site wasn't chosen; it was reachable. That matters for the fix, because it means the attacker's script knows exactly one way in — and if that door is still open after your clean-up, the same script simply walks back through it.

What a real clean-up looks like

When we take on a compromised site, the payload removal is actually the middle of the job, not the end:

• Full backup first. Even an infected site gets backed up before anything changes — you can't un-delete a mistake made during a rushed clean-up.
• Core file comparison. Every WordPress core file is checksummed against the official release. Modified files are restored from source, not "cleaned".
• Timeline reconstruction. File modification dates and access logs usually point at the first infected file — and the request that created it. That request names the entry point.
• Backdoor hunt. Attackers almost always leave a second way in: an extra admin user, a rogue file in uploads/, a scheduled task. Removing the visible malware while leaving the backdoor is the classic reinfection setup.
• Close the door. Update or remove the vulnerable component, rotate every credential, and only then call it fixed.

How to tell if your last clean-up was real

Three questions. If any answer is no, the door may still be open:

• Did anyone identify which component let the attacker in?
• Were all admin accounts audited and all passwords and keys rotated?
• Is something now watching for file changes, so a re-entry gets caught in hours instead of weeks?

Removing malware without finding the way in isn't a fix. It's a delay.

Prevention, as always, is cheaper: the overwhelming majority of these entry points are just outdated plugins, which is precisely what routine maintenance exists to remove.