Types of Malware and How to Prevent Them

• Exploiting unpatched vulnerabilities in popular plugins or themes.
• Credential stuffing or brute-forcing weak administrator passwords.
• Using leaked credentials harvested from infostealer logs.
• Uploading malicious files through insecure form, media, or file-manager plugins.
• Exploiting outdated WordPress core installations that have not been patched.
• Compromising a shared hosting neighbor and pivoting laterally through misconfigured file permissions.

Once inside, attackers typically plant one or more of the malware types below. Understanding what each type does makes it much easier to spot the warning signs early and respond before damage spreads.

1. Backdoors

A backdoor is malicious code that gives an attacker a persistent, hidden way back into your site, bypassing normal login authentication entirely. Backdoors are often the first thing installed after a successful breach, because they let the attacker return even after the original vulnerability is patched.

Signs of Infection

• Unfamiliar PHP files in wp-content/uploads or other directories that should not contain executable code.
• New administrator accounts you did not create.
• Unexplained outbound connections or spikes in server resource usage.

Prevention

• Disable PHP execution in the uploads directory using server rules or a security plugin.
• Run regular file-integrity scans to flag new or modified files against a known-clean baseline.
• Review the admin user list monthly and remove any account you cannot account for.
• Keep WordPress core, plugins, and themes updated, since most backdoors arrive through an unpatched vulnerability.

2. SEO Spam and Pharma Hacks

This category injects hidden content designed to manipulate search engines or redirect traffic, often without any visible change to the site for a normal visitor.

Signs of Infection

• Search results showing your site's pages with titles or descriptions you never wrote.
• A sudden drop in search rankings or a Google Search Console security warning.
• Unfamiliar pages appearing in your sitemap or admin page list.

Prevention

• Set up Google Search Console and enable security issue alerts, so you are notified the moment Google flags your site.
• Restrict file editing in wp-config.php using DISALLOW_FILE_EDIT to prevent theme/plugin editor abuse.
• Use a Web Application Firewall (WAF) to block known SEO spam injection patterns before they reach your site.
• Audit your sitemap periodically for pages you did not create.

3. Malicious Redirects and Phishing Kits

Redirect malware sends visitors, and sometimes only mobile visitors or only first-time visitors, to an external scam, ad-fraud, or phishing destination.

Signs of Infection

• Visitors reporting they are being sent to unrelated or suspicious websites.
• Browser warnings ("Deceptive site ahead") appear when loading your site.
• Unexplained new directories that mimic login pages of well-known brands.

Prevention

• Test your site from multiple devices and connections periodically since conditional redirects often hide from desktop/admin sessions.
• Monitor Google Safe Browsing status for your domain.
• Lock down file permissions (typically 644 for files, 755 for directories) to limit what a compromised plugin can modify.
• Use server-level malware scanning that checks media and asset files, not just PHP.

4. Cryptojacking Malware

Cryptojacking scripts hijack server or visitor CPU resources to mine cryptocurrency on the attacker's behalf, usually without any visible defacement.

Signs of Infection

• Unusually high CPU or resource usage reported by your hosting account, often flagged by automated resource alerts.
• Site slowdowns with no corresponding traffic increase.
• Unfamiliar cron jobs or scheduled tasks in cPanel.

Prevention

• Review scheduled cron jobs regularly and remove anything you did not create.
• Use resource usage alerts to catch abnormal spikes early.
• Apply the same patching discipline as other malware types since crypto miners always arrive via the same plugin/theme vulnerabilities.

5. Defacement and Ransomware

Less stealthy than the categories above; this malware announces itself, either by visibly altering the site or by encrypting files and demanding payment.

Signs of Infection

• The homepage or any page displaying unfamiliar content, images, or ransom messages.
• Files that will not open or display garbled/encrypted content.
• A site that is completely down with no clear server error.

Prevention

• Maintain automated, frequent backups stored off server so you can restore quickly without negotiating with an attacker.
• Test backup restoration periodically. A backup you have never restored is not a verified backup.
• Apply the principle of least privilege to database and file-system accounts, so a single compromised credential cannot wipe everything.

6. Data-Stealing Malware

This category is built to quietly harvest sensitive information, customer data, payment details, or admin credentials, rather than alter the site's appearance.

Signs of Infection

• Customers report fraudulent charges shortly after purchasing through your site.
• Unfamiliar outbound network connections in server logs, especially around checkout or login pages.
• Modified checkout, cart, or login template files.

Prevention

• Use a PCI-compliant payment processor that keeps card data off your server entirely whenever possible.
• Enable two-factor authentication for all administrator and editor accounts.
• Run file-integrity monitoring on checkout, cart, and login templates specifically since these are the highest-value targets.
• Rotate API keys and database credentials if you suspect any exposure.

General Prevention Checklist

Most malware families above share the same root causes. These foundational practices address most WordPress infections regardless of which payload an attacker installs.

• Keep everything updated. WordPress core, plugins, and themes should be updated promptly. Remove any plugin or theme you are not actively using rather than leaving it dormant and unpatched.
• Use strong, unique credentials. Enforce strong passwords and enable two-factor authentication for every account with publishing or admin access.
• Limit login attempts. Use a login-attempt limiter or Web Application Firewall to block brute-force and credential-stuffing attempts.
• Check infostealer exposure. Periodically check whether site credentials have appeared in known breach or infostealer-log databases and rotate any that have.
• Harden file permissions. Set files to 644 and directories to 755 and disable PHP execution in the upload directory.
• Maintain offsite backups. Automate daily backups stored away from the live server and periodically test restoring them.
• Scan regularly. Run automated malware scans on a schedule, not just when something looks wrong.
• Restrict file editing. Disable the built-in theme/plugin file editor in wp-config.php to reduce the impact of a compromised admin account.

If You Suspect an Infection

• Take a backup of the current (infected) state before remediating in case you need to compare files later.
• Change all passwords, including hosting, WordPress admin, and database credentials, from a clean device.
• Run a full malware scan and review recently modified files for anything unfamiliar.
• Contact Bluehost for a guided cleanup if you are on a plan that includes malware remediation.

Need Help?

If you believe your site has been compromised, Bluehost support is available to help diagnose and remediate the issue: