In March 2026 we cleaned up a backdoor campaign that hit several WordPress sites in the same week. Each one showed the same pattern: visitors were being sent to fake browser update pages, the Plugins screen looked normal, and the malicious code sat in a folder most site owners have never opened.
That folder is wp-content/mu-plugins, and security researchers have documented a steady rise in infections there since early 2025. This guide covers how the infection works, how to find it, and the cleanup step almost everyone skips.
Quick answer: Redirect malware often hides in wp-content/mu-plugins, where WordPress runs every PHP file automatically and nothing can be deactivated from the dashboard. Connect over SFTP, review each file in that folder, remove anything you cannot account for, then rotate every credential. Treat it as a stolen password problem as much as a file problem.
What are mu-plugins and why does malware hide there?
Mu stands for must use. WordPress runs every PHP file placed directly in wp-content/mu-plugins on every request, before regular plugins load. There is no activation step and no deactivate button. The Plugins screen only shows these files under a small Must-Use filter that appears when the folder has contents, and code tucked into a subdirectory does not show up there at all. A common pattern is a short, harmless looking loader file that includes the real payload from a subfolder or from the uploads directory.
The folder has legitimate uses. Managed hosts drop platform code there, some caching and security tools install helper files, and developers use it for functions that should never be switched off by someone clicking around the dashboard. Files being present is not proof of a hack. What makes the location attractive to attackers is the combination of automatic execution on every page load, persistence through plugin deactivation and theme changes, and the fact that almost nobody looks in it.
How do I know if my site has this infection?
The campaign we handled produced the symptoms below, and they match what security researchers keep reporting from mu-plugins infections:
- Visitors land on a fake Chrome or Edge update page, or a fake CAPTCHA that tells them to paste a command into a Run box. Meanwhile you see nothing, because the script checks for logged-in admins and search engine bots and leaves both alone.
- An administrator account you never created shows up in Users, sometimes reappearing after you delete it.
- Google Search Console reports a security issue, or searches for your brand start returning spam pages.
- Some visitors get a red Safe Browsing warning before your site loads.
- Organic traffic drops with no other explanation.
Because the malware cloaks itself, test like a stranger. Open the site in a private browser window on your phone with wifi off, and click through from a Google search result instead of typing the URL. If you are comfortable in a terminal, request a page the way a crawler does and look for script tags loading from domains you do not recognize:
curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "https://yoursite.com/" | grep -io "<script[^>]*src=[^>]*>"How do I find the malicious files?
- Connect over SFTP or your host’s file manager and open wp-content/mu-plugins. If the folder does not exist, skip to the other locations in step 4. If it exists, you should be able to explain every file in it. Search any unfamiliar filename together with your host’s name before deciding it is safe or malicious, because hosts do place legitimate files here.
- Open each PHP file and look for obfuscation: base64_decode, eval, gzinflate, str_rot13, long encoded strings, or an include that points at a subdirectory or the uploads folder. Recent campaigns have used bland names like redirect.php, index.php, and custom-js-loader.php.
- Sort by modified date, but treat it as a hint rather than proof. Attackers backdate timestamps to blend in.
- Check the other common persistence spots while you are connected: extra lines at the bottom of wp-config.php, the active theme’s functions.php, PHP files inside wp-content/uploads, leftover files in wp-content/upgrade, and scheduled tasks (a plugin like WP Crontrol makes those visible).
- Compare the user list in the dashboard against the wp_users table in the database. Some backdoors filter their account out of the dashboard list.
- Run a server-side scanner as a second opinion. Treat a clean result as one data point, since obfuscated loaders slip past signatures.
How do I remove it without breaking the site?
- Take a full backup of files and database first, infected or not. If the cleanup breaks something, you want a snapshot to compare against.
- Delete the malicious mu-plugins files along with any payload files they were including.
- Reinstall WordPress core. Dashboard, then Updates, then Re-install, or replace the wp-admin and wp-includes folders over SFTP. Leave wp-content alone during this step.
- Replace plugins and the theme with fresh copies from the official source instead of trusting what is on the server.
- Delete administrator accounts you did not create, and check widgets, the theme customizer, and the wp_options table for injected script tags.
- Clear every cache layer: page cache, object cache, CDN. Cached copies of infected pages will keep serving the redirect after the files are gone.
- Re-test as a logged-out visitor and with the curl check above. If Google flagged the site, request a review in Search Console once it comes back clean.
Why does the malware come back after cleanup?
This is where our March incident got interesting, and it is the part most removal guides skip. Cleaning the files answers what the malware did. It does not answer how it got there. Code in mu-plugins means someone had write access to your server, which usually means a stolen credential or an exploited plugin.
In our case the trail led back to infostealer malware on a computer that had been used to manage the sites. Passwords saved in the browser were harvested months before any site showed symptoms. The websites were the visible damage. The original breach happened on a laptop.
So after the files are gone:
- Change every password with access to the site: WordPress admins, the hosting control panel, SFTP and FTP accounts, and the database password in wp-config.php.
- Replace the salts in wp-config.php so every session, including the attacker’s, gets logged out.
- Run a malware scan on each computer used to administer the site. If one of them had a stealer, assume every password saved in that browser is compromised, here and everywhere else.
- Look through the hosting account for FTP users, SSH keys, or collaborators you do not recognize.
- Rotate API keys stored in plugins, including payment gateways.
Skip this and the odds are good the attacker walks back in through the same door within weeks.
What if I need help with this right now?
Malware cleanup is one of the services we handle for businesses that do not keep a developer on staff. We investigated this exact campaign across multiple sites, traced the entry point, rotated credentials, and set up monitoring to catch reinfection early. If your site is redirecting visitors or Google has flagged it, contact us with your domain and a description of what visitors are seeing, and we will get back to you with what it will take to fix it.
Frequently asked questions
What is the mu-plugins folder in WordPress?
It is a directory at wp-content/mu-plugins for must use plugins, which WordPress loads automatically on every request. They cannot be deactivated from the dashboard, and many sites do not have the folder at all until a host or a developer creates it.
Are all files in mu-plugins malware?
No. Managed hosts and some plugins place legitimate helper files there. Before deleting anything, search the filename along with your host’s name. A file you cannot explain, especially one with obfuscated code, is the red flag.
Why does my security plugin say the site is clean?
A scanner that runs inside WordPress loads after code in mu-plugins, and some malware disables or blinds security plugins outright. Heavily obfuscated loaders also slip past signature checks. Pair plugin scans with a manual look at the folder and a server-level or remote scan.
Why do visitors see the redirect when I do not?
The malware checks for logged-in administrator cookies, known bot user agents, and sometimes IP addresses or referrers, then skips those visitors. That cloaking keeps site owners and search crawlers unaware. Test in a private window, on a different network, arriving from a search result.
Do I have to change my passwords after removing the files?
Yes, all of them: WordPress admins, hosting, SFTP, the database password, and API keys, plus new salts in wp-config.php to end active sessions. If a computer used to manage the site had malware, treat every password saved in its browser as burned.
What is a fake browser update or fake CAPTCHA page?
It is a social engineering overlay served through hacked sites. Visitors are told their browser is out of date, or a CAPTCHA instructs them to paste a command, and the download is usually password-stealing malware. Your site becomes a distribution point, which is why Google flags it quickly.
How long does a cleanup take?
A single site with good backups is often same-day work. When several sites share credentials, or when the entry point traces to a compromised computer, it becomes a multi-day job of cleaning, credential rotation, and monitoring across everything that machine touched.