Steps to cleaning malware
Unfortunately fixing a malware infection can be a complicated issue, in some cases it might be best to seek advice from a developer so they can resolve the issue and stop it from happening again.
This guide covers the clean-up itself. If you have just discovered the problem and want the wider picture - locking the site down, reviewing logs, hardening afterwards - start with My website has been hacked!
Work through these in order. The order matters more than any individual step - cleaning a site while the attacker still holds a working password just means they put everything back.
- Take the site offline first. Put it into maintenance mode so visitors are not being served malware and the attacker cannot use the site while you work.
- Change every password, before you clean anything. That means your cPanel login, all FTP accounts, database users, any SSH keys, and your website admin logins - not just the ones you use day to day. Check for FTP accounts or cPanel users you do not recognise and remove them.
- Take a copy of the site as it is now, before deleting anything. You will need it to find how they got in, and to recover anything you remove by mistake.
- Work out when it happened. Check Imunify360 in the Security section of cPanel - it records what was detected and when. Your cPanel Raw Access logs help too: look for
POSTrequests to PHP files that would not normally be posted to, or far more of them than you would expect. You need this before the next step. - Clean or restore, using a backup from before that date. Remove the infected files, or replace them with clean copies from a JetBackup taken before the compromise. Restoring a more recent backup usually restores the infection with it.
Note that picking individual files out of a backup only works on Incremental backups - archived or compressed Home Directory backups can only be restored whole. - Update everything. Make sure your CMS and all plug-ins are current - it is often better to remove them and replace them with freshly downloaded copies rather than update in place.
- Check what else they left behind. Attackers commonly add things that survive a full clean of your web files: cron jobs, email forwarders and filters, redirect rules in
.htaccess, extra FTP accounts, and unexpected subdomains. Look through each of these in cPanel. - Make sure you are on a supported PHP version. You can change your PHP version yourself in cPanel. Do this after the site is clean, not during - changing major versions can break a site, and you do not want to be debugging two problems at once.
These basic steps are the same whether you have a static site, or are using a CMS like WordPress, Drupal, Joomla or Magento.
More sophisticated attacks can also cause damage to your site's database. In these cases your options, depending on your site type, are to either have the database cleaned or restore it from a backup taken before the compromise.
Whichever route you take, the steps above still matter: a cleaned site will be reinfected if the way in is still open. Finding and closing that is the part that actually ends the problem.
You may also need to notify the Information Commissioner's Office - details of what constitutes a notifiable breach are on the ICO website.
WordPress specific malware cleaning
- Re-install the WordPress core files rather than just updating - if the site is already on the latest version, an update changes nothing and any modified core files stay exactly where they are. Our WP-CLI guide covers how.
- Change all passwords, including cPanel and database.
- Check WordPress for any additional users that might have been created.
- Change all WordPress user passwords.
- Replace the security keys and salts in
wp-config.php- this logs out every session on the site, including the attacker's. You can generate new ones from wordpress.org. - Update all plug-ins (remove and replace with fresh copies from the source or WordPress repository)
- Update all themes (and remove any unused ones).
Review the site for evidence of any malicious files (with the assistance of your developer who should be able to identify malicious or unrecognised files).
You may be able to see the attack vector via your cPanel Raw Access logs and looking for 'POST' requests to PHP files that would ordinarily not be posted to or more POSTs than you would expect.
External assistance / cleaning services for WordPress
If you are not confident cleaning your site yourself there are a number of services available, that will not only clean your site, but also then offer continued protection via a WordPress Application Firewall (WAF).
Whilst we have firewalls and security scanning in place, no single solution will ever be 100% effective - so it is important that you take steps to secure and protect your site.
Wordfence offers a plugin with a firewall in both its free and paid versions. Sucuri's firewall is a paid, cloud-based service rather than a plugin - its free plugin is a scanner and hardening tool. Both companies also offer site cleaning services.
