WordPress is one of the most popular content management systems (CMS) globally, but its popularity also makes it a prime target for hackers. If your WordPress site is infected with malware, it’s critical to take swift action to avoid losing your data, visitors, and reputation. This guide walks you through the process of cleaning your WordPress site, including some concise remediation techniques to efficiently restore and secure your site.
Step 1: Identify the Infection
Before diving into the cleanup process, you need to verify that your site is infected. Common signs of malware infection include:
- Unexpected changes to your site’s content (e.g., links to spammy sites).
- Google flagging your site as harmful or blacklisting it.
- Visitors seeing warnings from their browsers or antivirus programs.
- A sudden drop in traffic or site performance.
- Unfamiliar users or admins appearing in your WordPress dashboard.
- Files you didn’t upload or scripts running in the background.
If you notice any of these signs, your site is likely compromised.
Step 2: Backup Your Website
Before you start cleaning up, create a backup of your entire site, including files and the database. This backup is necessary to recover important data in case anything goes wrong during the cleanup process.
You can back up your WordPress site manually using FTP (e.g., FileZilla) and phpMyAdmin to export the database, or use plugins like UpdraftPlus or BackupBuddy for automated backups.
Step 3: Take Your Site Offline (Optional but Recommended)
Taking your site offline temporarily helps prevent further damage and protects your visitors from encountering the infection. You can place a maintenance page by adding an
index.html file in your root directory while you clean the site.
Step 4: Scan Your Site for Malware
Use scanning tools to identify the locations of the infection:
- Security Plugins: Plugins like Wordfence, Sucuri, or iThemes Security can scan your site for malicious files.
- External Tools: Tools like VirusTotal or Sucuri SiteCheck can scan your URL for malware.
Step 5: Remove Malware – Concise Remediation Efforts
After identifying the infected files and malicious code, proceed with the cleanup:
- Delete wp-admin and wp-includes Folders: One of the most effective methods to clean core WordPress files is to delete the
wp-admin and wp-includes folders entirely. After that:
- Re-upload fresh copies of WordPress core files from the official WordPress repository.
- Note: Do not delete wp-includes as that contain all your plugins, themes and your website images and other files.
- Reinstall All Plugins: Instead of manually inspecting plugins for infections, it’s efficient to reinstall them.
- Use a plugin like Fresh Plugins to delete and automatically reinstall all plugins from their official sources.
- Manually Clean Your Database: Review the database (using phpMyAdmin) for malicious entries, especially in the
wp_posts, wp_options, and wp_users tables. Remove any suspicious entries.
- Delete any other folders/files that are not part of WordPress
- WordPress comes with 3 folders, wp-admin, wp-content and wp-includes. Any other folders should be deleted Similar for PHP files in the root directory.
Step 6: Change All Passwords and Secret Keys
Update all your site’s passwords to lock out potential attackers. This includes:
- WordPress admin accounts
- FTP and hosting control panel logins
- Database passwords
Also, update the security keys in the
wp-config.php file to invalidate all active sessions. You can generate new keys using the
WordPress secret key generator.
Step 7: Check User Accounts
Go through the WordPress “Users” section and check for any unauthorized users that may have been added by the hacker. Delete any suspicious accounts, especially those with administrative privileges.
Step 8: Harden Your WordPress Security
Once your site is clean, implement additional security measures to prevent future infections:
- Keep Everything Updated: Ensure that WordPress, plugins, themes, and your server software (e.g., PHP) are up to date.
- Install Security Plugins: Use security plugins like Wordfence or iThemes Security to add firewalls, real-time scanning, and brute-force protection.
- Disable File Editing: Prevent attackers from injecting malicious code by disabling the WordPress theme and plugin editor. Add this line to
wp-config.php:
- Limit Login Attempts: Install a plugin to limit failed login attempts to protect against brute-force attacks.
- Enable Two-Factor Authentication (2FA): Add an extra layer of security by enabling 2FA for all admin users.
Step 9: Request a Review from Google (If Applicable)
If Google flagged your site as harmful, you can request a review after you clean it. Do this through
Google Search Console by navigating to the “Security Issues” section and clicking “Request a Review.”
Step 10: Monitor Your Site for Future Attacks
To prevent reinfection, continuous monitoring is essential. This is where tools like
Netumo come in handy. Netumo monitors your site for changes, checks for SSL certificates, and alerts you about uptime and potential threats, helping you identify issues before they become severe.
Cleaning an infected WordPress site is not a one-time task; it requires ongoing security maintenance. Using a combination of remediation techniques like replacing core files, reinstalling plugins, and leveraging security tools like Netumo can help you efficiently restore your site and protect it in the long run.
By staying proactive with regular backups, security updates, and monitoring tools, you can safeguard your WordPress site from future threats. Stay vigilant, and ensure that your website continues to function smoothly and securely!
