WordPress Malware Scanner and Safe Database Cleanup Tool

 WordPress websites can sometimes become infected with malicious JavaScript that is injected into the database. These infections may cause unexpected redirects, security warnings, suspicious downloads, or other unwanted behavior.

In one such case, malicious JavaScript was detected inside a WordPress serialized database option named wpb_js_templates.

To make the cleanup process safer and easier to repeat across multiple WordPress websites, we created a secure WordPress Malware Scanner and Cleanup PHP tool.

What Does This Tool Do?

The tool scans the WordPress database for specific known malicious JavaScript patterns and reports exactly where they are found.

It follows a scan-first, cleanup-second approach.

The tool does not immediately modify the database.

Instead, it:

1. Connects to the WordPress database through wp-load.php
2. Detects the WordPress database tables automatically
3. Scans text-based database columns
4. Searches for known malicious JavaScript signatures
5. Displays the number of tables and rows scanned
6. Shows the affected table and row ID
7. Creates a backup before modifying anything
8. Removes only the detected malicious script blocks
9. Correctly re-serializes WordPress serialized data
10. Updates the database
11. Performs a final malware verification
12. Reports the number of removed scripts

Why Is Backup Important?

Directly modifying WordPress database content can be risky, especially when serialized data is involved.

For example, WordPress options can contain data similar to:

a:9:{s:16:"about_1717776371";a:2:{...}}

Simply deleting text from serialized data can make the serialization invalid.

The cleanup tool therefore:

• Reads the serialized value
• Unserializes it
• Removes the malicious content
• Serializes the data again
• Validates the resulting structure
• Creates a backup before updating the database

This helps prevent accidental corruption of WordPress options.

Scan-Only Mode

The first step is always a scan.

The tool provides a summary such as:

Tables scanned: 35
Rows scanned: 12,540
Infected rows: 1
Malicious scripts: 1

If nothing suspicious is found, it displays:

No Malware Found

No database changes are performed during the scan.

When Malware Is Detected

If suspicious content is found, the tool displays a warning such as:

Malware Detected

It also shows the affected database location:

Table	Row ID	Detected
wp_options	1505	1 script

This makes it easier to understand exactly what was detected before proceeding.

Two-Step Cleanup Confirmation

The cleanup process intentionally requires confirmation.

First, the administrator selects:

Review Cleanup

The tool performs another scan and shows what will happen.

Only after that does the administrator see:

Backup First & Remove Malware

A second confirmation is required before the database is changed.

This prevents accidental cleanup operations.

Backup Before Database Modification

Before modifying an infected row, the tool creates a backup.

The backup contains:

• Website
• Database name
• Table name
• Primary key
• Primary key value
• Original database row
• Backup timestamp

For example:

abacux-malware-backups/
└── 2026-07-28_07-50-06/
    └── wp_options_1505_xxxxx.json

The backup is verified before the database update is performed.

Cleaning the Malicious Script

The tool is designed to remove only the specific malicious JavaScript patterns it has been configured to detect.

For the previously identified infection, the suspicious code contained an obfuscated JavaScript function such as:

_0x3023

The cleanup process removes the matching malicious <script>...</script> block while preserving the rest of the WordPress data.

It does not simply delete the entire WordPress option.

Final Verification

After cleanup, the tool automatically runs another database scan.

A successful cleanup displays:

CLEAN

and:

Final verification found no matching malicious script blocks.

The cleanup summary also reports:

Backup rows created: 1
Database rows updated: 1
Malicious script blocks removed: 1

If malware is still detected, the tool clearly reports that the website should not be considered clean.

Security Protection

The cleanup tool is protected with a secret key.

Instead of allowing anyone to execute the script, access requires a URL similar to:

https://example.com/abacux-malware-cleanup.php?key=YOUR_SECRET_KEY

The key should be changed before deploying the tool.

A long random key should be used rather than a simple password.

Important Security Warning

This type of cleanup script should be treated as a temporary administration tool, not as a permanent WordPress plugin.

After the scan and cleanup are complete:

1. Verify the website
2. Check the WordPress admin
3. Check important pages
4. Check redirects
5. Check server security logs
6. Run your normal malware/security scanner
7. Delete the cleanup PHP file

Do not leave the cleanup script publicly accessible on the server.

Is Removing the Database Script Enough?

Not necessarily.

A malicious JavaScript injection can be a symptom of a larger WordPress compromise.

After cleaning the database, you should also check:

• wp-content/plugins/
• wp-content/themes/
• wp-content/uploads/
• wp-config.php
• .htaccess
• WordPress administrator accounts
• Unknown PHP files
• Scheduled cron jobs
• Recently modified files
• Server access logs
• Suspicious redirects
• Unknown database users
• Vulnerable or abandoned plugins

If the attacker had access to the server, the database injection may only be one part of the infection.

Conclusion

A database cleanup tool should never blindly delete suspicious content.

A safer approach is:

Scan → Review → Backup → Confirm → Clean → Verify

The WordPress malware cleanup tool described here follows that approach and is particularly useful when troubleshooting known database-based JavaScript infections across multiple WordPress installations.

However, it should be considered a targeted cleanup utility, not a replacement for a full WordPress malware/security audit.