How to Check WordPress for Malware and Recover

On Blue Arctic Shared Web Hosting, every file written to your account is scanned for malware. Infected files are quarantined (moved out of the way) automatically. Our engineers review what the scanner flags, clean up what is confirmed and look for how it got in. Don’t wait for a message from us: if you see any sign below, start with Step 1.

Signs your site may be hacked

• Visitors are sent to another website, sometimes only from search results or on phones.
• Admin users, pages or plugins you don’t recognize.
• A browser or Google warning that the site is dangerous.
• Spam links or text in your pages or search results.
• A notice from us about malware or spam from your account.

Step 1: Open a support ticket

1. Write down what looks wrong, when you noticed it, and any recent changes.
2. Open a support ticket from the Client Portal at my.bluearctic.com with your site address and notes.

Start Step 2 while you wait for our reply.

Step 2: Keep a copy, then lock down access

1. Keep a copy of the site as it is now (see how to download a backup). Never upload it back.
2. Run a full antivirus scan on your own computer. Stolen logins often come from an infected computer.
3. In WordPress, go to Users → Profile, click Set New Password, then click Update Profile. Ask every other administrator to do the same.
4. Change the passwords for your Client Portal, cPanel and every email account at your domain, using long, unique passwords. If you can’t find where to change one, ask in your ticket.
5. On your profile, click Log Out Everywhere Else. For each other administrator, open Users → All Users, click Edit under their name, then Log Out Everywhere.

1. Go to Users → All Users and click Delete under the unknown account.
2. Choose Attribute all content to another user, then pick your own account.
3. Click Confirm Deletion.

Step 3: Choose how to recover

Option A: restore a clean backup. We keep daily backups for 30 days on Shared Web Hosting. In your ticket, ask for a restore from a few days before you first noticed anything, because attackers often get in earlier (see how to restore a backup).

Option B: clean the site yourself (advanced). Not comfortable with these steps? Use Option A.

1. Install a well-reviewed security scanner plugin and run a full scan.
2. Before deleting anything it reports, ask in your ticket whether it’s safe to remove.
3. Delete plugins and themes you don’t use, and reinstall the rest from their official source.

Then replace WordPress’s own files. Don’t use the Re-install version button: it leaves extra files an attacker added.

1. In WordPress, go to Dashboard → Updates and note your version number.
2. Download that exact version from WordPress releases.
3. In cPanel, click Files and open the File Manager tab (older layout: the File Manager icon; or search with Ctrl+K or Cmd+K). Open the folder that holds wp-config.php and delete wp-admin and wp-includes.
4. Upload the zip there and extract it. This makes a wordpress folder.
5. In the wordpress folder, select wp-admin and wp-includes, click Move, and move them to the folder that holds wp-config.php.
6. Delete the zip and the wordpress folder.

Step 4: Close the way in

1. Update WordPress, every plugin and every theme (see how to update WordPress safely).
2. Change all the Step 2 passwords again, now the site is clean.
3. Turn on two-factor sign-in for every administrator with a two-factor plugin, and reduce login attacks (see how to reduce login and comment spam).
4. If Google warned that your site is dangerous, open the Security issues report in Google Search Console (Google’s free tool for site owners) and click Request Review. Google’s review can take weeks.

How to tell it worked

A new scan finds nothing, no unknown users or files come back over the next few days, and browser or search warnings are gone.

Troubleshooting

• The infection comes back: something was missed, often a backdoor (a hidden file that lets the attacker back in) or a stolen password. Reply to your support ticket.
• A file is missing or part of your site stopped working: the malware scanner may have quarantined an infected file. Open a support ticket and tell us which page or file.
• You’re locked out of WordPress: see how to reset your WordPress password.
• Your account has been suspended for malware: we tell you why and what to fix. Reply to that message, or open a support ticket, once it’s cleaned up.

Still need help?

Reply to your ticket, or open one from the Client Portal at my.bluearctic.com. Include your site address, what you noticed and when, what your scan reported, and what you already tried. Never include a password.