How to use AI when cleaning an infected WordPress site

Start with backup and risk control

I would not start by pasting random code into AI and hoping for a miracle. First, create a backup of files and database, check hosting access, rotate passwords and stop anything that can keep spreading the damage.

If the site sends spam, redirects visitors or creates new admin users, the priority is control. AI can help with analysis, but it does not replace basic security work.

What I would not send to AI

AI can help, but I would not paste a whole site with sensitive data into it. For a security issue, I would first remove passwords, API keys, database credentials, customer data and anything that should not be public.

A suspicious code snippet, file name, context and a clear question are usually enough. Not a full database export or config file without checking it first.

Where AI actually helps

• Explaining suspicious PHP or JavaScript in plain language.
• Spotting obfuscation such as `base64_decode`, `eval`, long strings or hidden redirects.
• Comparing a suspicious file with a clean plugin or theme file.
• Building a checklist: files, database, admin users, cron, `.htaccess`, `wp-config.php`, plugins and theme.
• Turning a technical finding into a client-friendly explanation.

Where infections often hide

On an infected WordPress site, checking one weird-looking file is not enough. The same problem can be spread across several places.

• wp-content/uploads, where PHP files usually should not be,
• mu-plugins and small custom plugins people often miss,
• functions.php in the theme or child theme,
• wp-config.php, .htaccess and suspicious redirects,
• unknown admin users, cron tasks and strange database records,
• nulled plugins or themes that should never have been installed.

Where I would not trust AI blindly

I would not let AI decide that a specific file is safe to delete without the full site context. I also would not paste a generated “fix” back into the site without understanding it.

Security is unforgiving. One small mistake can break the site or leave a backdoor open. AI is useful for explanation and orientation, but final decisions need manual verification.

Practical workflow

1. Back up the current state, even if the site is infected.
2. Change WordPress, hosting, FTP/SFTP, database and email passwords.
3. Check admin users, suspicious plugins and recently changed files.
4. Use AI to explain suspicious code, not to blindly fix it.
5. Compare plugins and theme files with clean official versions.
6. Update WordPress, plugins and theme, and remove unused items.
7. Check `.htaccess`, `wp-config.php`, cron jobs and database links.
8. After cleanup, test the site, forms, redirects and Search Console.

After cleanup, it is not finished yet

When the site stops behaving strangely, that still does not mean the job is done. Passwords need to be changed, WordPress, plugins and theme updated, unused items removed, file permissions checked, and the site watched for a while.

If the site was flagged by a browser or Google, I would also check Search Console and request a review after cleanup. Otherwise the site can be technically clean but still look unsafe to visitors.

Short takeaway

AI is a useful second pair of eyes for an infected WordPress site. It helps you understand suspicious code faster and avoid missing checks. But the order still matters: backup first, verify manually, then change things.