Saturday, January 3, 2015

Remove Malware From Your WordPress Site

This step-by-step guide can be used by practically anyone to remove malware from WordPress. However, you must be willing to get your hands a little dirty, and be comfortable with FTP and File Manager.

Step 1: Scan Your Computer

When malware infects your WordPress site it is actually quite common if you don't stay on top the game and update regularly as well monitor your logs. So first things first is to make sure your computer is virus-free. We recommend scanning at least with Malware Bytes, and to be doubly safe, another anti-virus such as NOD32 or Kaspersky.

Step 2: Change Your Password

Now that your computer is virus free, you should change your cPanel and FTP password. Make sure it is something random, with at least 1 special character like ! # & %, a mix of lower and uppercase letters plus numbers. We recommend using a password manager tool such as LastPass to not only generate secure passwords but store and manage them for you too.

Step 3: Download WordPress

Download the latest fresh WordPress package from the official site.

Step 4: Extract Files

Extract the files from the zip or tar.gz that you have just downloaded onto your computer. Leave those files there for now. We will come back to them later.

Step 5: Removing The Malware Infection

Login to your FTP or cPanel > File Manager.
Your WordPress installation files on your web host should look like this:
wp-admin
wp-content
wp-includes
index.php
license.txt
readme.html
wp-activate.php
wp-blog-header.php
wp-comments-post.php
wp-config.php
wp-config-sample.php
wp-cron.php
wp-links-opml.php
wp-load.php
wp-login.php
wp-mail.php
wp-settings.php
wp-signup.php
wp-trackback.php
xmlrpc.php
Delete everything you see there except for the wp-content folder, and the wp-config.php file.
Now your installation should look like:
wp-content
wp-config.php
In your cPanel > File Manager, click on and edit the wp-config.php file. Make sure there are no strange codes or anything unusual. If there is malware in this file, it will generally look like a long string of random text. You can compare it to the wp-config-sample.php file to be sure.
Now go into the wp-content folder. It should look like:
plugins
themes
uploads
index.php
Make a list of the plugins you are currently using, then remove the plugins folder and index.php file. You will need to re-install your plugins after the cleaning process.
Go into the themes folder, and remove any theme which you are not using. You will then need to individually check each file in your current theme to make sure there is no malware or strange codes in them. If you have a clean backup of your theme somewhere (like on your computer), then to be safe you should just delete the entire themes folder.
Check every directory inside your uploads folder to make sure there are no php files or anything that you may not have uploaded.

Step 6: Re-upload WordPress

The fresh WordPress files that you extracted earlier in Step 4 can now be uploaded via FTP.
If you removed your theme you should also re-upload your clean backup theme files.

Step 7: Change WordPress Admin Password and Re-install Plugins

You should now be able to access your dashboard, and change your admin password. Always use a random hard to guess password. Don’t be tempted to use something basic like welcome or ilovekittens(actual passwords used by some of our clients). You will get hacked this way.
If you don’t want to use a random password like xSpM82!#3&W, then pick an uncommon phrase with 3 or more words like MyKitten<3sMe. A strong password is one with uncommon words, at least 1 number, 1 special character and a mix of upper and lower case characters.

Step 8: Remove Google Warning

Now that your site is free of malware, you can submit your site to Google to get the warning “This site may harm your computer” removed. Login or create an account at Google Webmaster Tools, add your site, click Health, and then click Malware. and finally Request A Review.
Disclaimer: While these steps may help remove malware from your site it is not a complete guide and therefore we are not responsible for any damage or data loss that could happen from attempting to remove malware. We always encourage you to consult a professional who can ensure the correct measures are taken to negate any further damage already caused from a malware infected website.

For professional malware removal services visit http://www.thinkmonkey.ca


ThinkMonkey - Web Design Company | Software Company