WordPress websites can sometimes become infected with malicious JavaScript that is injected into the database. These infections may cause unexpected redirects, security warnings, suspicious downloads, or other unwanted behavior.
In one such case, malicious JavaScript was detected inside a WordPress serialized database option named wpb_js_templates.
To make the cleanup process safer and easier to repeat across multiple WordPress websites, we created a secure WordPress Malware Scanner and Cleanup PHP tool.
What Does This Tool Do?
The tool scans the WordPress database for specific known malicious JavaScript patterns and reports exactly where they are found.
It follows a scan-first, cleanup-second approach.
The tool does not immediately modify the database.
Instead, it:
-
Connects to the WordPress database through
wp-load.php - Detects the WordPress database tables automatically
- Scans text-based database columns
- Searches for known malicious JavaScript signatures
- Displays the number of tables and rows scanned
- Shows the affected table and row ID
- Creates a backup before modifying anything
- Removes only the detected malicious script blocks
- Correctly re-serializes WordPress serialized data
- Updates the database
- Performs a final malware verification
- Reports the number of removed scripts
Why Is Backup Important?
Directly modifying WordPress database content can be risky, especially when serialized data is involved.
For example, WordPress options can contain data similar to:
a:9:{s:16:"about_1717776371";a:2:{...}}
Simply deleting text from serialized data can make the serialization invalid.
The cleanup tool therefore:
- Reads the serialized value
- Unserializes it
- Removes the malicious content
- Serializes the data again
- Validates the resulting structure
- Creates a backup before updating the database
This helps prevent accidental corruption of WordPress options.
Scan-Only Mode
The first step is always a scan.
The tool provides a summary such as:
Tables scanned: 35 Rows scanned: 12,540 Infected rows: 1 Malicious scripts: 1
If nothing suspicious is found, it displays:
No Malware Found
No database changes are performed during the scan.
When Malware Is Detected
If suspicious content is found, the tool displays a warning such as:
Malware Detected
It also shows the affected database location:
| Table | Row ID | Detected |
|---|---|---|
| wp_options | 1505 | 1 script |
This makes it easier to understand exactly what was detected before proceeding.
Two-Step Cleanup Confirmation
The cleanup process intentionally requires confirmation.
First, the administrator selects:
Review Cleanup
The tool performs another scan and shows what will happen.
Only after that does the administrator see:
Backup First & Remove Malware
A second confirmation is required before the database is changed.
This prevents accidental cleanup operations.
Backup Before Database Modification
Before modifying an infected row, the tool creates a backup.
The backup contains:
- Website
- Database name
- Table name
- Primary key
- Primary key value
- Original database row
- Backup timestamp
For example:
abacux-malware-backups/ └── 2026-07-28_07-50-06/ └── wp_options_1505_xxxxx.json
The backup is verified before the database update is performed.
Cleaning the Malicious Script
The tool is designed to remove only the specific malicious JavaScript patterns it has been configured to detect.
For the previously identified infection, the suspicious code contained an obfuscated JavaScript function such as:
_0x3023
The cleanup process removes the matching malicious <script>...</script> block while preserving the rest of the WordPress data.
It does not simply delete the entire WordPress option.
Final Verification
After cleanup, the tool automatically runs another database scan.
A successful cleanup displays:
CLEAN
and:
Final verification found no matching malicious script blocks.
The cleanup summary also reports:
Backup rows created: 1 Database rows updated: 1 Malicious script blocks removed: 1
If malware is still detected, the tool clearly reports that the website should not be considered clean.
Security Protection
The cleanup tool is protected with a secret key.
Instead of allowing anyone to execute the script, access requires a URL similar to:
https://example.com/abacux-malware-cleanup.php?key=YOUR_SECRET_KEY
The key should be changed before deploying the tool.
A long random key should be used rather than a simple password.
Important Security Warning
This type of cleanup script should be treated as a temporary administration tool, not as a permanent WordPress plugin.
After the scan and cleanup are complete:
- Verify the website
- Check the WordPress admin
- Check important pages
- Check redirects
- Check server security logs
- Run your normal malware/security scanner
- Delete the cleanup PHP file
Do not leave the cleanup script publicly accessible on the server.
Is Removing the Database Script Enough?
Not necessarily.
A malicious JavaScript injection can be a symptom of a larger WordPress compromise.
After cleaning the database, you should also check:
-
wp-content/plugins/ -
wp-content/themes/ -
wp-content/uploads/ -
wp-config.php -
.htaccess - WordPress administrator accounts
- Unknown PHP files
- Scheduled cron jobs
- Recently modified files
- Server access logs
- Suspicious redirects
- Unknown database users
- Vulnerable or abandoned plugins
If the attacker had access to the server, the database injection may only be one part of the infection.
Conclusion
A database cleanup tool should never blindly delete suspicious content.
A safer approach is:
Scan → Review → Backup → Confirm → Clean → Verify
The WordPress malware cleanup tool described here follows that approach and is particularly useful when troubleshooting known database-based JavaScript infections across multiple WordPress installations.
However, it should be considered a targeted cleanup utility, not a replacement for a full WordPress malware/security audit.
