Instructions to reinstall WordPress when infected with malicious code

Will update video later.

It is quite normal for a WordPress website to be infected with malicious code by using an unknown theme/plugin (if not pirated) or setting a simple password that is easy to guess.

Currently, when a website is infected with malicious code, there are usually 3 common scenarios as follows:

1. The homepage was changed to a hacked warning page with epic music.
2. Website silently sends phishing emails, spam continuously on the host without the owner’s knowledge.
3. The website contains hidden links advertising aphrodisiac services, gambling, phishing scams.

And when your website falls into these cases, the Hosting providers will lock it up. If you use VPS then it will be warned or locked if it falls into scenario #1 and the domain name is blacklisted sooner or later, at this time the website will drop in search engine rankings, when accessing with Google Chrome, there will be a warning. in red that this website is very dangerous.

But to keep the website from being hacked is not difficult, as long as you use a fully licensed product, set a complex password (save it to Lastpass, for example) and set up iThemes Security. If you use Hosting, you should choose hosting providers that use CloudLinux such as AZDIGI, StableHost, A2Hosting, Hawkhost, etc., which are used to avoid being infected with malicious code from your neighbor.

What do we do when the website is hacked?

We often go to websites to ask for malware scanning tools when we fall into these cases, but the sad news for you is that there is no tool to help you remove malware for free, I swear. There is only 1 malware removal service that I know and use and that is Sucuri Antivirus with a very expensive price and you have to accept if you need to completely remove malicious code. However, after removing it, it is not certain that the website is really clean, but there is only one way: Reinstall from the beginning.

Reinstalling your website from scratch is the only and best way to keep your website clean. Reinstalling your website doesn’t mean you’ll rewrite your content or products because this data will be saved to the database, but the good news is that no malicious code is attached to your database at all. Reinstalling the website means that we will take the soft data stored in the database on the old website, then install the new website and import this data, and then reinstall the plugin and theme from scratch with a clearer origin.

In this article, I will guide you in detail how to do this.

Steps to reset the website from scratch

Step 1. Install a new website

Now proceed to install a new WordPress website on your host or localhost and use a different domain name to run this website to make sure you have just accessed the new website and the old website for easy checking and comparison.

Then open the wp-config.php file of the new website and insert the following below

define(‘WP_HOME’,’http://example.com’);
define(‘WP_SITEURL’,’http://example.com’);

Replace example.com with the address of the new website.

Step 2. Backup the data on the old website

First, go to phpMyAdmin to export the data of the database the website is using and download it to your computer. If your host does not have phpMyAdmin, you can use the BackWPUp plugin to backup the database and download it, just the database.

Refer: Export database data in phpMyAdmin

Next, bring the folders containing the uploaded images in /wp-content/uploads/ like 2017, 2016, 2015, 2014,… to your computer. Note that only folders containing uploaded images, other folders do not need to be downloaded to ensure safety. If you use Hosting, you can go to File Manager and use the Compress feature to compress these folders and download them. Or if you install a new website on the same host, you don’t need to download it, just copy the data of these directories to /wp-content/uploads/ in the new website directory.

Step 3. Import old data into new website

Now go to phpMyAdmin at the host (or localhost) running the new website and find the database name of that website, then press Import and upload the .sql file you got in step 1.

[alert color=”orange” type=”alert-message-background” title=”Lỗi khi import database” size=”small”]If you get an error while importing the database, create a completely new database and import it into the new database. Then set up the website to use the new database.[/alert]

After importing, see the data table name prefixed with wp_ or another prefix. If you use a prefix name other than wp_ then open the file wp-config.php at the new website, find $table_prefix and instead wp_ prefix of the database table. For example, I have a name tag 38dug_options in the database will change to:

$table_prefix = ’38dug_’;

Then download the image folders in the old website running on the host (wp-content/uploads) into the wp-content/uploads folder on the new website to make sure the images are not lost.

To check, you can visit the Media Library section on the new website to see if the full image is already displayed. If the image displays normally, it’s done.

Step 4. Reinstall the safer theme

Now your remaining step is to reinstall the theme on your website. If you use a paid theme, it is best to buy a license for that theme to be more secure, to be updated with a new version regularly if there is a security hole.

About this step, I don’t need to talk about it, when installing a theme, if the theme requires you to install any additional plugins, you can install it because the plugins that follow the theme are also very secure, so you can be completely assured.

Step 5. Upload the source code to the main website

Once you have your website setup complete and ready to go. Please proceed to access the old website and delete all data on the host, then transfer the source code of the website you just made to the host into the directory of the main website. About this step, you do the same as changing the host of a normal website, including 2 steps:

1. Backup and restore the new website source code to the host.
2. Backup database and restore database on host.

Refer:

Once the migration is complete, open the wp-config.php file of the new website on the host and change the WP_HOME, WP_SITEURL to the main website address. For example:

define(‘WP_HOME’,’http://example.com’);
define(‘WP_SITEURL’,’http://example.com’);

This will ensure that you can access the new website under its main domain name.

Step 6. Change the website address in the database

Now log in to the new website on the host and install the Better Search Replace plugin, then go to Tools -> Better Search Replace and find the old domain name in all database tables and change to the new domain, uncheck Run as dry run as shown below.

So all the links in the website that are using the old domain name will be changed to the new domain name without having to do it manually.

Last step. Set up security for your WordPress website

As soon as the website is up and running, proceed to set up the security of the website. Take a look at the Complete WordPress Security series and follow the steps to increase the security of your website.

And most importantly, do not use shared plugins/themes of unknown origin because this is the cause of 90% of cases of malicious code that I have ever known. If you don’t install anything strange on your website, have a complicated admin password, and set up a good security plugin, you won’t need to worry about security solutions anymore.

Hope your website will be restored soon and stable operation.