Eliminating Malware out of a hacked WordPress website is not a simple work. And today, we know that Google is Implementing a 30-day ban onsite reviews to limit offenders from distributing malware. So cleaning a hacked website thoroughly is more significant than ever.
WordPress malware removal expertise
If you can not go to your WordPress admin on your account of this hack, we highly suggest contacting an expert to clean out the website.
If You’re going to try to wash out the website yourself, below are some steps we recommend:
What to do to remove malware out of your WordPress
Backup the website files
Backup the entire website if you are using the web host that uses this feature. This is going to be the most complete backup of your whole server. But it may be quite big, so be ready for the download to take some time.
Use a WordPress backup plugin if you’re able to log in fine. If you can not log in the website, the hackers might have jeopardized the database in which case, you might choose to contact an expert professional as we mentioned previously.
If you’re able to login, additionally use Tools > Export to export an XML file of your own content.
Some websites are very big. The uploads file itself may be over 1GB and sometimes much more. The wp-content folder has become easily the most crucial folder on your server since it includes all of your uploads. If you can not conduct a backup plugin along with your web host and do not have a “snapshots” functionality, then it is sometimes possible to use the webhost File Manager to make a zip archive file of your wp-content folder then download that zip file.
If you have a number of installs of WordPress on the machine, you will want to back up everyone.
.htaccess document notice: create a backup copy of your .htaccess document and upload it. Analyze this copy to see if your file has been corrupted with false informations. For example, some people place SEO 301 redirects in the .htaccess file.
Download and analyze the backup Files
After the Website is backed up, download the backup to your pc, double-click on the zip file to open it/extract its content. You need to check it.
You can download a clean WordPress installation from WordPress.org and take a look at the files in the download, then match them to your files. This can give you clues as to how your site was hacked and the impact.
Check the wp-config.php file. It is important since it includes all database information for your WordPress database that we’ll use in the restore procedure.
From the wp-content folder, you need to see three or more folders: themes, uploads, and plugins. Look in such folders. Can you see that your themes, plugins, and uploaded pictures? In that case, then that is a indication you’ve got a good copy of your website. This is ordinarily the mission-critical folder you want to restore for your website (along with this database).
You will have also an SQL file that’s an export of your database. We’re not going to delete the database in this procedure, but it is very important to have a backup.
Replace the WordPress core files
Employing the One-click installer from your hosting control panel, reinstall WordPress into the public_html directory when this was the place of the WordPress setup or at the subdirectory when WordPress was set up within an add-on domain.
Referencing the copy of your website, edit the wp-config.php document on the brand new install of WordPress to utilize the database credentials in your former website. This will link the new WordPress installation to the old database. We really don’t advise re-uploading your previous wp-config.php file.
Reset your passwords and permalinks
Login to your website and change all user names and passwords. If you find any users you do not know, your database was compromised, and you want to get in touch with an expert to be certain no unwanted code was left on your database.
Go to Settings > Permalinks and click on Save Changes. This will resave your .htaccess file. Make sure you don’t leave the old .htaccess or a “hacked” copy among the files on your site. The .htaccess file can sometimes be hidden, so you should also display hidden items if necessary. This .htaccess file controls many elements on the host and can be hacked to maliciously divert users from the site to other sites.
Be sure to reset all FTP and hosting accounts passwords too.
Reinstall plugins
Reinstall all your plugins from the WordPress repository or upload them with “Add New” plugin in your dashboard. Do not install untrusted, unknown or hacked plugins. Do not install plugins that are no longer updated.
Reinstall themes
Reinstall your theme from a new clean download. If you have customized your theme, replicate the changes on the new theme. Do not download your old theme, as you may reinject wrong files.
Upload Your Pictures from the Backup
Now’s the tricky part. You want to get your old image files copied up to the brand new wp-content > uploads folder onto the server. But you do not wish to replicate any hacked files from the process.You will have to thoroughly examine each year/month folder on your backup and appear inside every folder and be certain that there are ONLY picture files without any PHP documents or JavaScript files or whatever you didn’t upload into your old Media Library. It can be long and tedious. As soon as you’ve blessed each year/month folder, then you can upload these to the host using FTP.
Install and Run Security Plugins
Install a free or paid security plugin like iThemes Security for example. Check through all of its settings.
Run anti-malware scans and check your server’s security settings (firewall…), regularly scan your website thoroughly. Scan the website with Sitecheck (Sucuri) to make sure you haven’t missed anything.
Still stuck ? You can contact an expert.
