How to clean a hacked WordPress site using Wordfence Security

Wordfence-Security

If your site has been hacked, Don’t Panic.

You can use Wordfence to clean much of the malicious code from your site. Wordfence lets you compare your hacked files against the original WordPress core files, and the original copies of WordPress themes and plugins in the repository. Wordfence lets you see what has changed (do a diff) and gives you the option to repair files with one click and take other actions.

How to clean your hacked WordPress site using Wordfence:

1. Upgrade your site to the newest version of WordPress.


2. Upgrade all your themes and plugins to their newest versions.


3. Change all passwords on the site.


4. Backup all your files and the database.


5. Go to the Wordfence options page and make sure the options to scan core, theme and plugin files are selected. Then run a Wordfence scan. This compares your core, theme and plugin files against the original versions in the WordPress repository and lets you know how a hacker has changed them.


6. When the results come up you may see a very long list of infected files. Take your time and slowly work through the list.


7. Examine any suspicious files and delete them if they are dangerous. Remember that you can’t undo deletions.


8. Look at any changed core, theme and plugin files. Use the option Wordfence provides to see what has changed between the original file and your file. If the changes look malicious, use the Wordfence option to repair the file.


9. Look at any unknown files that are in core directories and delete them if necessary.


10. Slowly work your way through the list until it is empty.


11. Run another scan and confirm your site is clean.


12. If you are still getting an alert from another product or from Google that says your site has a problem, please contact us via our support forum and we’ll take a look.

I have a file that looks suspicious, but I am not sure if it is. How can I tell?

Email it to us at samples@wordfence.com and we’ll let you know. If you don’t receive a reply, either your mail system or ours may have discarded the message thinking it was malicious because of your attachment. So please email us a message without the attachment letting us now that you’re trying to send us something and we’ll try to help get it through.

I have cleaned my hacked Wordpress site but Google Chrome is still giving me the malware warning. What should I do?

You need to get your site removed from the Google Safe Browsing list. Read this Google document on how to clean your site. Here are the steps:

1. First sign-in to Google Webmaster Tools.


2. Add your site if you haven’t already.


3. Verify your site. Installing the Google Site Verification Plugin may help with this.


4. On the Webmaster Tools home page, select your site.


5. Click Site status, and then click Malware.


6. Click Request a review.

My site visitors are getting warnings from other security products and anti-virus system. What should I do?

Getting off the Google Safe Browsing list is a big step, but you may have some work ahead of you. You need to keep a list of every anti-virus product that is saying your site is infected. This may include products like ESET anti-virus, McAfee’s Site Advisor and others. Visit each anti-virus maker’s website and find their instructions for removing your site from their list of dangerous sites. This is often called “whitelisting” by anti-virus makers, so Googling for terms like ‘whitelisting’, ‘site removal’, ‘false positive’ and the product name will usually lead you to the place where you can get your site removed.

Wordfence Plugin Download.

How can I manually check if my site is listed on Google’s Safe Browsing List?

Visit the following URL and replace example.com with your own site address.

http://www.google.com/safebrowsing/diagnostic?site=http://example.com/

You can include a sub-directory if your site has one. The page that appears is very plain, but contains detailed information about the current status of your site, why it is listed on Google’s malware or phishing list (The google safe browsing list is actually two lists) and what to do next.