WordPress mu-plugin Malware: What It Does and How to Remove It

WordPress mu-plugin malware is malicious PHP placed in the wp-content/mu-plugins folder, where WordPress loads it on every request without activation, so it never shows as an active plugin. Attackers use it to load remote payloads, hide accounts, steal logins and restore deleted files. This guide shows how it hides and survives, the indicators that give it away, how to audit the folder, and how to remove it so it stays gone.

WordPress mu-plugin Malware: Why Attackers Choose the mu-plugins Folder

Attackers choose this folder because WordPress treats every PHP file in it as trusted code. A file placed there loads on every request, runs before regular plugins, and cannot be deactivated from the dashboard, because the only way to disable a must-use plugin is to delete its file. It does not appear in the normal plugin list, only under a separate Must-Use tab that few owners open. Managed hosts use the same folder for their own code, which gives malware a place to look normal. The result is persistence: you can reinstall every plugin and still be infected. Our guide on why WordPress malware keeps coming back covers the wider picture.

What a mu-plugin Is and What a Legitimate One Looks Like

A must-use plugin is a plugin installed in a special folder that WordPress enables on every site automatically. The WordPress documentation says these plugins do not show in the default plugin list, appear in a separate Must-Use section, and cannot be disabled from the dashboard. It also notes that web hosts commonly use them for host-specific features such as caching and monitoring, and that developers use them for code that must always run. So a file in this folder is not suspicious by itself. A file that nobody installed, or that nobody can explain, is.

How WordPress mu-plugin Malware Hides From You

Researchers who analysed a 2026 sample found that being a must-use plugin was only the start of its hiding. The malware hooked WordPress filters to remove itself from the Must-Use list, the normal Plugins page, update notices and the Site Health screen, so the dashboard showed nothing wrong at any point. It posed as a health check tool with a believable author and repository link, and that metadata changed from sample to sample. Across the researchers’ detections the files appeared under more than 4,000 different names, many borrowed from legitimate-looking ones such as the advanced-cache.php and db.php drop-ins. For owners, names, plugin headers and file hashes are weak evidence, and behavior and location are better evidence.

How WordPress mu-plugin Malware Survives a Cleanup

Deleting the visible file fails because the malware plans for it. In the 2026 sample, a routine ran early on every request, checked at most once an hour, and rewrote the file from a copy stored in the database if it was missing or too small. It then backdated the modified time and made the file read-only, so the restored copy looked old. The same sample added itself to the active plugins list directly, created a hidden administrator, captured logins, and copied itself into other WordPress installs it could reach on the same server.

How WordPress mu-plugin Malware Gets Instructions and Does Damage

Most mu-plugin malware is a loader: a small file that fetches the real code from the attacker’s side. In 2025, researchers described a mu-plugin whose small loader, named wp-index.php, fetched a remote payload named cron.php, with strings hidden using str_rot13. The 2026 sample went further: it found its control server through a blockchain smart contract, so blocking one domain did not cut it off, and it exchanged encrypted instructions, sent stolen data out and could change the site remotely. The damage you see, such as SEO spam, redirects, new administrators or captured passwords, is the end of that chain, and a file scan shows only the loader.

Indicators of Compromise: Where mu-plugin Malware Leaves Traces

No single indicator proves an infection, and samples vary, so look for several together. The table lists where each trace appears and how to check it. The option names and the account pattern come from one 2026 sample, so treat them as examples, not a checklist.

SELECT option_name, LENGTH(option_value) AS size
FROM wp_options
ORDER BY size DESC LIMIT 20;

How to Audit the mu-plugins Folder Step by Step

The audit takes about ten minutes. Write down every file, date and result before you change anything.

1. List every file in the folder with its modified and change times, using the commands in the table above.
2. Compare the folder with the Must-Use tab, and treat any file the tab does not show as hidden on purpose.
3. Ask your host and developers which files they installed, and note any they cannot explain.
4. Search the folder for code that downloads and runs other code. Command: grep -rnE "file_get_contents|curl_exec|wp_remote_get|eval|base64_decode|str_rot13" wp-content/mu-plugins
5. Check custom schedules, scheduled events and the largest options for entries you do not recognize, using wp option list or the query above.
6. Query the users table for hidden administrators, because the dashboard list can be filtered.

A clean scan does not cover this folder reliably, as our guide on why a scanner says clean when the site is still hacked explains.

How to Remove mu-plugin Malware So It Stays Gone

Remove the pieces in this order, because each one restores the others. If the files are read-only, change their permissions before you delete them.

1. Copy the files, the scheduled event list, the suspicious options and the logs before you change anything.
2. Delete the suspicious scheduled events and custom schedules with wp cron event delete, so nothing restores the files.
3. Remove the options that hold a stored copy of the code, and any unknown entries in the active plugins list.
4. Delete the malicious mu-plugin files, then reload the site to confirm nothing legitimate breaks.
5. Remove hidden administrator accounts and any other footholds, using the three passes in our guide to find a backdoor in a website.
6. Clean every other WordPress site in the same hosting account in the same pass, because the malware can copy itself between them.
7. Rebuild core, plugins and themes from fresh official copies, then rotate every password, salt and application password last, from a clean computer.
8. Watch the folder, the options and the administrator list daily for two weeks.

For the full cleanup around these steps, follow our malware removal guide.

mu-plugin Malware or a Legitimate Host File? How to Tell

Deleting a legitimate host file can break caching or monitoring, so judge each file before you remove it. Use these signals together, not one at a time.

How to Lock Down wp-content/mu-plugins

A locked folder gives malware less room to hide, and a watched one tells you in minutes when something changes.

• Restrict write access to the folder where your host allows it, so the web server can read the files but not create new ones.
• Monitor the folder, the largest options and the scheduled events for changes, and alert on any.
• Review the folder and the administrator list monthly, and compare them with your last list.
• Close the entry points that let attackers write files, starting with the causes in our guide on how did my website get hacked.

When mu-plugin Malware Needs a Professional Cleanup

Get help when a file returns after you delete it, when you find a hidden administrator or credential-stealing code, when several sites share the hosting account, or when customer data may have been exposed. These cases usually involve more than one foothold, and guessing costs time while the attacker stays in. A professional cleanup finds every restorer, the entry point and any other site in the account that carries a copy, and documents what the attacker could reach. The wider list of signs of website malware shows what else to check, and ScanTitan’s website malware removal service covers the cleanup.

WordPress mu-plugin Malware FAQ