Dealing with malware found on your site

Every website on the server, subdomains included, is scanned for malware each night. The scan only reads files: nothing changes until you act. When it finds something, you'll see it in a few places:

• an email to the domain's owner, titled "Malware found" or "Suspicious files found" with the domain's name;
• a malware badge next to the domain on Hosting → Domains, and next to the site on Hosting → WordPress;
• the domain's Malware tab, which lists every flagged file and is where you deal with them.

Press Scan now on the Malware tab to check again at any time, for example after cleaning up. If the tab says malware scanning isn't installed, ask your host to turn it on.

MALWARE or SUSPICIOUS

Each flagged file has a label:

• MALWARE: the file matches a known piece of malware. Treat it as real.
• SUSPICIOUS: the file looks like a typical backdoor, such as PHP code inside an image or a PHP file in an uploads folder, but it may be harmless. Look at it before you decide.

The line under the file's path says what was found, its size, when it last changed and when it was first found. A file that changed on a day you didn't change anything is a strong sign of a break-in.

Replacing WordPress files with clean copies

If the file belongs to WordPress itself or to an installed plugin, the finding offers a better fix than quarantine:

• Reinstall WordPress core replaces WordPress's own files with clean copies of the same version.
• Reinstall followed by the plugin's name replaces that plugin's folder with a clean copy from WordPress.org.

Both save a restore point first and roll back if the site breaks. A clean copy also replaces any other altered file in the same place, not just the one the scan caught. When the job is done, press Scan now to confirm.

Quarantining a file

Quarantine moves the file out of the website to a place nothing on the site can reach. When a website has two or more MALWARE files, Quarantine all moves them in one go.

The site is checked before and after the move. If it stops working without the file (a server error, a PHP fatal error, WordPress's "critical error", or no answer at all), the file goes straight back, and Activity shows "Put back: the site broke". That means your site loads the file: clean it by hand, or replace it with a clean copy from a backup.

A file whose name has unusual characters can't be quarantined from the panel. The finding says so: delete it over FTP instead.

When it's a false alarm

Press Not malware to stop the file being flagged. If the file changes later, it's flagged again, so a real infection of the same file still shows up. Files you've cleared are listed under Marked as not malware, where Flag again undoes it.

Putting a quarantined file back

Quarantined files are kept for 30 days, then deleted. Until then they're listed under In quarantine with the date they'll be deleted. Press Restore to put one back where it was. It's then treated as not malware until it changes.

Cleaning up after a hack

Malware usually means someone got in. Removing the files isn't enough: close the way in too.

1. Deal with every finding, then press Scan now until the tab says Nothing flagged in the last scan.
2. Look for WordPress administrators you don't recognise (in wp-admin, under Users) and delete them.
3. Change passwords:
   • each WordPress administrator's: on the domain's WordPress tab, Reset password sets a new one and signs that user out everywhere;
   • the database's: on the WordPress tab, open Database connection and press Repair, which sets a new password and puts it in the site's settings for you;
   • your FTP accounts' and mailboxes', on Hosting → FTP accounts and Hosting → Email accounts;
   • your own panel password, under Settings.
4. Give WordPress new security keys ("salts"), which signs everyone out, including anyone who stole a session. Open wp-config.php with the domain's Files, and replace the eight lines that start with define( 'AUTH_KEY' through define( 'NONCE_SALT' with a fresh set from https://api.wordpress.org/secret-key/1.1/salt/.
5. Update WordPress, every plugin and every theme. Delete plugins and themes you don't use: an old, inactive plugin can still be attacked. See Installing and updating WordPress.
6. Work through the site's security checklist in Keeping WordPress secure, especially PHP can't run from uploads.

If the same files keep coming back after you've cleaned up, something you haven't found is still letting the attacker in. Ask your host for help, or restore the whole site from a backup taken before the break-in.