Treat malware as an incident, not a broken plugin
Unexpected administrator accounts, injected redirects, modified core files, spam pages, backdoors, or security-scanner findings can indicate compromise. Do not begin by deleting every suspicious file. Preserve timestamps, scanner output, access logs, changed-file lists, user records, and the current software inventory. This evidence helps determine entry point, scope, and whether the problem will return after cleanup.
Containment depends on severity. Restrict public access or place the site behind a controlled maintenance response when customers are at risk. Coordinate with the host if the account, neighboring sites, or server processes may be affected. WPFixAgent can surface a high alert and Wordfence vulnerability matches, but a match is intelligence, not proof that a site is infected.
Remove persistence and close the entry point
Compare WordPress core and extension files with trusted packages, inspect unexpected PHP in uploads, review scheduled tasks, database options, active users, must-use plugins, and web-server rules. Replace compromised components from known sources instead of editing visible payloads one by one. Patch or remove the vulnerable theme or plugin that enabled access.
Rotate WordPress salts, administrator credentials, hosting credentials, database credentials, API keys, and deployment tokens according to the confirmed scope. Perform rotations from a trusted device. If the database or customer records may have been exposed, follow applicable legal, contractual, and notification requirements.
Restore trust through verification
A clean backup from before compromise can shorten recovery, but restoring it without closing the entry point invites reinfection. After restoration or cleanup, scan again, verify file integrity, review outbound requests, test public and administrative workflows, and monitor logs for repeated indicators. Search-engine warnings and blocklists may require separate review requests after the site is demonstrably clean.
Document detection time, affected assets, containment, evidence, credentials rotated, software patched, verification, and ongoing monitoring. Complex incidents require a qualified WordPress security professional; one-click repair should not claim certainty where forensic review is needed.