You cleaned the site, checked it, and moved on, and a few weeks later the same warning is back. This is one of the most demoralising patterns in WordPress security, and it is also one of the most predictable. Malware that returns is almost never bad luck. It is a sign that the cleanup dealt with the symptoms and left the cause in place. This post explains why WordPress malware comes back, and what actually stops the cycle: not a better scanner, but closing the surface that let it in and keeping it closed.
Cleanup removes the payload, not the entry point
A cleanup, done on its own, finds the malicious files and removes them. That is real and useful work, but it addresses what the attacker left behind, not how they got in. If a vulnerable plugin, a weak password, or a backdoor script was the way in, deleting the visible infection changes nothing about that route. The attacker, or more often an automated bot working through a list of known-vulnerable sites, comes back through the same door and drops the same payload again. From the outside it looks like the malware returned. What actually happened is that it never lost its way in.
The usual reasons it comes back
Recurrence tends to come from a short list of causes, and naming yours is the first step to ending it:
- The vulnerable component was cleaned but never updated, so the same hole is still open the next day.
- A backdoor was missed. Attackers routinely leave a second, hidden way back in, so removing the obvious infection is not the same as removing their access.
- Credentials were never rotated, so the password or key that let them in still works.
- A neighbour on shared hosting is compromised, and the infection crosses over from another site on the same server.
- The backup you restored from already contained the infection, so you reinstalled the problem along with the site.
Notice that only one of these is about the malware itself. The rest are about the environment the site lives in and the habits around it. That is why a scanner alone rarely ends the cycle. It keeps finding the same thing because the same thing keeps being true.
Why shared, unmanaged hosting makes it worse
Where your site lives has a lot to do with whether an infection sticks. On crowded shared hosting, a single compromised account can expose its neighbours, and you have no visibility into how well the sites around you are maintained. Updates are your responsibility and easy to postpone. Backups may exist but rarely get tested, so the one time you need to restore, you find the backup is old, broken, or already infected. None of this is exotic. It is the ordinary condition of a site that nobody is actively looking after, and it is exactly the condition in which malware recurs.
If a site keeps getting reinfected, the malware is not the problem to solve. The open surface is. Cleanup buys you a clean moment; closing the surface is what makes the clean moment last.
Signs a cleanup did not hold
It helps to know what an incomplete cleanup looks like before it becomes a full reinfection, because the early signs are usually quiet. Watch for a few things in the days after a site is cleaned:
- New files or modified core files appearing again shortly after the cleanup, which suggests a backdoor was left in place.
- Admin users or scheduled tasks that reappear after you remove them, a common sign the attacker still has access.
- Search results still showing spam pages, or the host still flagging the site, days after you believe it is clean.
- Outbound email or unusual traffic that never quite returns to normal.
Any of these means the cleanup treated the visible infection but missed the access behind it. That is not a reason to start deleting at random. It is the point to have someone go through the logs properly and confirm the entry point is closed, rather than cleaning the same symptoms a third time.
The durable fix is clean plus kept clean
Breaking the cycle takes two things, and both have to happen. The first is a proper cleanup: restore from a backup taken before the compromise, rotate every credential, and remove or replace the exploited component rather than just deleting its symptoms. You can read how that engineer-assisted process works on our malware cleanup page. The second is keeping the surface closed after the site is clean, which is where most recurring cases fall down. A clean site with unpatched plugins on unmanaged hosting is simply a site that has not been reinfected yet.
Keeping it closed is ongoing work, not a one-time task. Having a WordPress support partner who owns it is what keeps it happening once the crisis has passed. It means updates applied promptly and tested rather than deferred, backups taken on a schedule and actually verified so you can trust the restore point, and monitoring that notices unusual changes before they become the next incident. Done consistently, this is unremarkable. Skipped for a few months, it is how the next compromise begins.
Where managed hosting fits
This is the honest case for managed hosting, and it is a narrow, checkable one rather than a slogan. On our managed platform, the work that keeps a site clean is the platform’s job, not a monthly chore you have to remember. Updates are handled and checked, backups are taken and tested, and the environment is not a crowded shared box where a neighbour’s problem becomes yours. Recovery and prevention stop being two separate scrambles and become one continuous process. The point is not that managed hosting is magic. It is that the specific things which cause recurrence, deferred updates, untested backups, and shared exposure, are the things a managed platform is built to remove.
If you have cleaned the same site more than once, that is the signal to change the environment rather than repeat the cleanup. Clean it properly one more time, then put it somewhere the surface stays closed, and the pattern breaks. Talk to an engineer about a cleanup, or look at how the managed platform is set up, and choose the path that ends the cycle rather than resetting it.