Has your website been hacked or caught a virus? There's no need to panic, you're in the right place. Here you'll learn how to protect against hacks and how to clean a virus from WordPress.
Whenever a technology develops, people who want to abuse it inevitably appear alongside it. Today most companies use websites to deliver their services to customers. That's exactly why people with bad intentions prefer to carry out their schemes through websites too.
Why do websites get infected?
Hacking a website (infecting it with a virus) means using some weakness in the site to add malicious code to its source code. The people doing this can do it directly or with the help of various bots. This way they can steal confidential data from your site's database, or simply make money by redirecting your site to their own ads. Others do neither and, for various reasons of principle, hack your site by changing its “index” page.
Is WordPress more dangerous than a custom script?
WordPress is a large CMS used on 40% of the whole web. Naturally, a CMS this big is more secure than a script written by 2–3 people. But very often it's we ourselves who make WordPress dangerous. Most of the themes and plugins used in this CMS are paid. Many web developers download “nulled” versions of these paid themes and plugins from the internet and use them. If you get a product for free, you're surely giving something in return without even noticing. The “nulled” websites that offer them integrate malicious viruses into the code in advance before handing it to you. The moment you install them in your WordPress, you turn a secure WordPress into a dangerous one.
In most cases such viruses don't activate at first. After the site has been running for a while, they show up on entry as various pop-ups, redirects or in other forms.
How do I clean a virus from my WordPress site? — Identify the type of virus or malware
As a first step, you need to identify what kind of virus has spread on your website. For that, I recommend the Sucuri system, which gives a broad analysis in a few seconds.
If a red screen appears in your scan results, there is malicious code on your website. But sometimes even SUCURI may fail to detect the virus. If unwanted pop-ups open on your site or your site redirects to another link, there is a virus.
In that case, if you have a backup of the last version of your site from before the virus appeared, restore it. This will give you a second chance to find the malicious code by looking at the site's code as it was before the virus spread. If there is no backup, go to your website's root folder through cPanel or FTP, paste the code below at the very top of the .htaccess file and save it.
Note: This code only works on Apache hosts with mod_headers enabled.
Header set X-XSS-Protection "1; mode=block"
Header always append X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options nosniff
By adding this to the .htaccess file, you block code that is run on your site through outside interference.
Note: Sometimes, under your hosting provider's rules, you may not have direct permission to edit the .htaccess file. In that case, contact your hosting provider.
The main known types of viruses
- Iframe viruses: The general name for viruses that affect the pages of your website. This malware works by inserting itself into the HTML code. It can install itself as a trojan on the computers of users who visit your site. On top of that, because this code is on your website, Google puts you on a blacklist and stops showing you in search.
- Phishing and spam: A type of virus that redirects users who come to your website to another address, or to a hidden section inside your site, and asks for and steals confidential data such as credit card details. In this case, a user whose card was stolen may not realise it for a long time if they trust your website.
- Database access: As we mentioned above, this most often appears when “nulled” themes or plugins are used. Malicious code added this way opens a backdoor on your site. Through this backdoor, the person who wrote the virus can easily get into your site's database and do whatever they want there.
How do I clean the virus?
After this short overview of each virus type, let's move on to the main topic. First, go to the official WordPress website and download clean WordPress files again. Also compress your website's files into a .zip and download it to your computer. Extract the .zip file of your website. Inside, delete everything except the wp-content folder and the wp-config.php file. Next, open the clean wordpress.zip archive you downloaded and copy its files (except the wp-content folder) into your site's folder. This way you get rid of viruses that spread anywhere other than the wp-content folder and the wp-config.php file right away.
Note: If your WordPress files are very large and your internet doesn't let you download the whole site, you can also do the process directly over FTP.
If you see suspicious code in your wp-config.php file, you can replace it with the clean wp-config-sample.php and configure the database details in it again. Don't forget to rename the file to wp-config.php after the change.
After that, zip the final files and move them to your hosting (if you aren't working directly over FTP). Then log in to the WordPress admin panel, add a new plugin from the plugins section and install the Wordfence plugin. Once the plugin is installed, go to the Scan section and run a scan with the High Sensitivity setting. After a short scan, this plugin will show you a list of all the infected files in the wp-content folder, which we haven't checked yet. You should go to these files over FTP and delete the malicious code.
Note: Be careful when deleting code and don't touch the system code. Otherwise your website may stop opening.
Change your passwords
As a result of the virus on your website, your passwords may have fallen into the other side's hands. So change your FTP, MySQL, cPanel and WordPress admin panel passwords, and set passwords that aren't easy to guess.
After this whole process, if your website works, take a backup right away and keep it. Ask your hosting company to scan the server so that any remaining hidden backdoors come to light.
If your website has been marked as harmful on Google, request a review. Since Google no longer sees malicious code on your site, it will keep showing it in search.
In this post I tried to help, even if only a little, with website hacking, which has happened to many website owners lately. This is the first time I've gone this deep into a technical topic on my blog. I always wrote in a way every reader could understand, but I felt this was needed.
If, despite all this, the problem on your website isn't solved, you can get in touch with me. I can help you as a professional.
