The online world is not safe enough to place our things on the internet and keep calm that no one can harm us. If you are on the internet, you are at risk every time. The same implies to our websites; the moment our website goes live, it is at stake.
The database of a WordPress website is the backbone of it, and if any malware attack happens to the database, it could destroy our website thoroughly. We will discuss some critical topics about malware attacks. And how to remove malware from wordpress database if it attacks your website.
How To Find Out Database Attacked or Not?
WordPress stores all its information in the database. If an attack happens to your WordPress website and you see unusual tables in your database and unidentified table numbers, it means your database got compromised. It is a clear sign of database hacking.
What to do if Malware is found in my WordPress Database?
It would be a common issue now if your website’s database got hacked first thing you need to do is don’t panic. There are different ways to recover from the attack.
First, you need to scan your website manually or with a plugin and clean the database.
It is evident that scanning and cleaning databases manually will be time-consuming and technical. If a person has zero knowledge about database management’s technical aspects, he should not handle it manually. Because manually handling the database and malware removal could lead to breaking the database.
So a non-technical person always tends to use a security plugin for performing security tasks.
We will discuss both methods to scan and clean WordPress databases from malware with manual steps and plugins for your convenience.
What is WordPress Database?
WordPress website stores all its information into the database. It is like a warehouse that keeps every piece of information regarding the website. Like login details, account details, plugins information, and many more. When you set up a WordPress website, WordPress itself creates a database of the website via MySQL. All your website’s posts and data stores in that database, and when anyone tries to access that post or other data, SQL will retrieve data from the database.
Although the database is not visible and accessible to anyone, only the website owner who has hosting credentials can access the database and manipulate it. But hackers got access to the database by identifying the website’s flaws and do security breaches by different methods.
We will explain how the WordPress website’s database could be hacked.
How hackers do Malware Attacks on WordPress databases?
Other types of attacks are used to get access the database of the website. The first one is SQL Injection Attacks, and the second is Brute Force Attacks. These are majorly famous attacks hackers do to hack the database of a website.
An example of the SQL Injection Attack is when a hacker attack or manipulate your database by injecting the malicious code to the comments section of the website’s post. Injecting code via the comment section is the most common way to do this.
Input fields are a vulnerable place because anyone can type there whatever they want, so hackers oblige that point. To enter his a malicious piece of SQL code, and when that code went into the database to store as a comment or form information, it does its work, and the hacker got a chance to harm the database. If you ever heard about online security, you must have
heard about Brute Force Attack. Brute Force Attack is another type of attack a hacker used to manipulate and damage a website’s database. In this attack, hackers guess your username and password or at least try to guess. If you have an easy to imagine password, it will be a
game of seconds to hack your hosting account and exploit your website’s database.
What Can a Malware Do to Your Website?
WordPress is famous CMS; it manages your websites and content without letting you into the technicalities. However, it is necessary to maintain your website and do security checks by yourself. Because every platform every site has some vulnerabilities, which a hacker can get the benefit. And he can access your website and visitors’ information and harm you in many ways.
Malware can harm you in the following ways: Users’ private information can be a leak. Malware can be the reason for the heavy resource consumption of the server. Subscribers of your website could receive spam emails from your website. “Website is not secure error” could be shown by Google your website’s visitors.
Search engine optimization of the website could be affected. Content could be manipulated and change or remove without your knowledge. URL redirection can happen, which leads your website’s visitors to the malicious website.
Things To Do Before Scan WordPress Database
Before performing any task on your website, there is a preventive measure that every website owner should take. While working on the website’s database and internal files, the owner should always maintain a backup of the website and its database, so if anything goes wrong, at least he can get back to where he started.
Backup With WP Staging
We can make a backup of our website manually, but the reason is that it requires technical knowledge, and you have to work with the main files of the website, so you don’t need to get into technical stuff; you can copy your entire site with few click. WP Staging plugin provides you the cloning and backup feature; to completely copy your website. So if your website ever got into any problem and wants to restore the old version of the website, you can easily do it with one click. We will explain each step how to backup and restore the WordPress site with WP Staging.
- First, you need to install the WP Staging plugin’s pro version.
- (If you have not purchased it, the version you will install will be a free version. You have to buy paid version of the WP Staging plugin. For that
- Go to Plugins> Add new
- Search for WP Staging, and Install it.
- After installing it, Activate it; you will see the new WP Staging section in the left menu panel.
- Click on Get WP Staging Pro,
- On the right, you will see a new window, and you will see an option of Buy WP Staging Pro, Click on it.
- It will redirect you to the official site of the WP Staging.
- Please choose a plan which suits you and purchase it by entering your credit card information.)
- Go plugins, Click on Add plugin.
- Here you will see the Upload Plugin option on the upper left corner. Click on it and upload Purchased WP Staging (We assume you have purchased WP Staging).
- Now Activate the Plugin.
- Note: Only the pro version of WP Staging supports backup and restoration.
- After installation, Go to WP Staging Pro in the left pane.
- Click on Site/Start, Now the new window will appear, and you see two options of Staging Sites and Backups.
- Click on Backups; an option of Backup and Export Database will appear; click on this option to start making a backup of your website.
- Name the backup file; click on Take New Database Backup.
- Wait until the clone of your website database is ready to download.
- After finishing, you can download a backup of your website locally.
- Now in WP Staging Pro, In the Backup option, you can see your website’s backup in the Available Backups option.
Whenever you want to restore your website’s backup, you need to click on Actions and then click the Restore option. With few clicks, you can easily make a backup of your website and restore it from the backup whenever you want.
Where Could Be The Malware?
When a hacker attacks your website, he can sometimes have different intentions; the purpose does not reside in manipulating the database; he could want to exploit your themes’ necessary files or WordPress main files like wp-config.
Website Core Files:
Hackers can attack the website’s core files and create a backdoor in the WordPress website’s core files. They leave the infection in the core files like wp-config.php and other main directories like theme or content folder. Often they create similar files like core files and place them in different folders so that owner cannot detect the infected file.
Attackers sometimes even use similar functions in the core files to manipulate the website. The function attacker use could be used by the plugin as well for legitimate reasons. So it is easy to ditch the owner with attacking the main files of the website.
Website’s Database:
Malware could be residing in the database. The hacker injects the malware via the comment section or other input fields, directly stored into the database. Then with the help of that infected code, he tries to enter and manipulate the website.
How to Find if Website Got Hacked or Not?
Even if your WordPress website got hacked and any malware enters your website’s database, how you will know your website got hacked, and security has been compromised. What are the ways to determine if your WordPress website is infected or not and, if it is infected, how to remove malware from the WordPress database?
Google search console
Google search console also helps to find out if your website is infected or not. Google itself scans your website, and if it finds malware, it will notify via email the website owner at the email address connected to the Google search console account. They will inform you that Google has blacklisted your website, or they can show a warning message in the search result.
The security and manual actions section in the Google search console also shows an error report on whether your website has errors or not.
The unusual traffic is also a sign that anything happens to your site. You can monitor the traffic with Google Analytics’ help, and if you see unusual upward traffic or low traffic, you should inspect what the reason is.
Google search results
There is another way with which you can check if your website is hacked or not. You need to Google search for your web address. Google will scan your website and whether it is infected or not.
Website Block from Hosting Company
Choosing your hosting plan is one of the important decisions you made for your website. Because an excellent hosting company will automatically block your website when they find out your website has a malicious code.
When someone visits your website, they will show a message “This website is not available” it means they have blocked your website due to security reasons.
They will notify you via email that your website got blocked, and they are suspending your account. You have to reach support to resolve this issue.
Different hosting companies provide other solutions regarding any security issue. Some hosting providers will notify you and ask you to fix it; some companies ask you to buy their security package not to worry; they will take care of it themself.
Some hosting providers do it for free, but only if you find any problem by yourself and notify them.
Notification from Visitor
Visitors are asserted of your website. If you have permanent visitors to your website, they will notify you via email if they have noticed something unusual on your website. Any irrelevant content and irrelevant redirect that doesn’t seem to be your website’s and shows warning notify you to take action.
Scan Via Plugin
Different plugins will help you to scan your website and detect any malware. The security plugin will do everything for you if you are not familiar with the above techniques. No technical knowledge need to do this; a good plugin will do it for you.
Inspect Website Core Files
Inspecting the file is another way to detect if there is a nasty thing is in your website or not. You need to review all the website’s core files and notice any other extra files in the website’s core folder and check the main files if there is any additional code added into them. For this method, you need to have technical knowledge and code understanding.
You have to look for malicious payload in the core files and look for backdoors; hackers always spot a place where they can enter again into your website called backdoors. And if you don’t clean your website thoroughly, they can again enter into your website.
If you are new but have technical knowledge about WordPress, you can do it by yourself.
Just download the copy of WordPress from its official website and extract the folder, open the core files of the WordPress from the folder you have just downloaded.
Now compare these files with your website’s core files on the server and in the website’s leading directory.
Recent Modified Files
If you notice something has changed on your website recently and you have not made any this kind of change, you should check for the file modification date. If someone got into your system and made changes to your website, you will be able to notice the files have been modified recently. Any recent change should alarm you that someone has worked and changed the core files of your website.
You can check recently modified files by FTP or SSH terminal.
You can type this command “$ find./ -type f –time -15” this command will show you the list of files modified in the last 15 days.
Webmaster Tool
You can check your WordPress website’s security status by using the diagnostic tools provided by Google and other authorities.
You can also use any free webmaster tool and can have security reports and your website’s ratings with these webmaster tools. You can use Google Webmasters central, Yandex, Webmaster, and Norton SafeWeb.
How to Remove Malware From WordPress Database
After analyzing the website and finding out that our website has been infected, it’s time to clean the malware; we need to follow some steps.
Look The Website
Before cleaning up the website, you need to lock your website so that while you clean your website from malware, the attacker doesn’t know that files are being deleted or changed. And he doesn’t prepare for another attack.
You have to access the .htaccess file and block all IP addresses except yours.
Login to CPanel to access the .htaccess file in the root folder of WordPress, now go to CPanel’s file manager and access the main folder of WordPress.
Locate the .htaccess file, Right-click on it, and edit the file.
Now add the following code into it.
“order deny, allow.”
deny from all.”
allow from 192.164.1.11.”
You need to change the 192.164.1.11 to your IP address.
NOTE: You can find your IP address by simply typing on Google “What’s my IP.” You can find your IP address using the command prompt using this command “ipconfig/all.”
Now you have to check if all other IPs have been blocked or not after the changes you have made. Try to visit your website using a VPN because you will have different IP when you access your website via VPN.
Change Old Passwords to Strong
The next step you have to do is change all the old passwords you have set for your website. Whenever hackers attack your website’s database, the first thing that compromises is the login credentials. Which helps the hacker whenever again he wants to access the website.
Make sure that you change all passwords and, this time, choose more strong passwords than the previous one.
- Change password of WordPress account login of all users.
- Change FTP account password.
- Change CPanel account password.
- Admin should change the database’s password.
- Also, change the usernames of the users; this will make the process safer.
Scan the Website
Now it’s time to scan your website to detect the malware in your website. You can use different plugins to do that.
You can use one of the famous Wordfense Scan plugins.
Go to plugins, Add plugin.
Search for it and Install Wordfence.
Go to Wordfence, and Click on Start Scan.
After scanning, it will show you all the findings and website reports.
It will show every issue of the website; it could be about plugins or core files. You have to prioritize which point you want to address first; obviously, it will be about the website files, whether they are injected with malicious code.
Now when you get the list of the files you have to clean, you better start it right now.
Look for the Malware
It is not easy to remove any malware because every malware requires a different kind of treatment, you can fix some malware by changing coding, and you can patch some malware with additional files. So we will discuss some of the ways here.
The first thing is you should have known what the virus or malware is. If you don’t see the disease, you can’t treat it. Look for the symptoms; what is your website indicating differently? Is it redirecting to other malicious or adult websites? Or is it showing just a warning message to the visitors?
Please search for the problem and then try to discover why this problem is happening and possible manual solutions.
Try to look out for the files which Wordfence has warned you. Get information about those files; maybe these files have infected many websites before. People already got a better solution to it and told you where it resides in the directory.
It will help you understand the malware and enhance your knowledge to prevent these attacks next time.
You will also get to know a couple of things:
- If a plugin is spreading the virus or not.
- Where do backdoors or vulnerabilities reside?
- Is malware acts as a worm and makes a clone of it in different folders.
- Is malware attacked on your database or not.
Remove the Files
After discovering the malware now, you have to go to the next step and remove the infected files.
If the malware resides in the WordPress install’s core files or folders like the wp-admin folder or wp-includes folder or any of the root folder, it is better to delete its files completely.
Don’t do this for the wp-contents folder and wp-config.php file because this folder and file contains your website content data and connect to the database.
Replace the Files
If you have deleted the WordPress install’s infected core files, you need new and clean duplicate files to replace those files that have been deleted.
Download a copy of WordPress from wordpress.org. Remember, the version should be the same as your current installed WordPress version.
- Extract the downloaded WordPress folder and copy the files.
- Login to CPanel, Go to file manager
- Go into the root folder of the website.
- Paste the files within the folders which you have deleted.
- Now you have replaced the infected files with a fresh copy of the original files of WordPress.
Clean WP-Content
This part is essential as well as critical. Because the WP-Content folder is the main folder containing your website’s almost every data regarding content, it has themes and plugins.
You will have to check each file in this folder to ensure you have deleted malware from your website. If you doubt that infected files are in the theme folder or the plugin, you have to compare each file of the theme and plugin with its original files.
Suppose you doubt that an infected file or malicious code is in the plugin. Then you have to download the plugin from the WordPress plugin repository and extract its folder on PC.
You have to compare the plugin’s new downloaded files with the duplicate plugin files on the server.
Look that are the files same or files on the server look like they injected; if yes, then the best option is to delete the plugin folder from the server and upload the fresh copy of the plugin.
Repeat the same process for all plugins.
If you doubt any theme, you have to perform the same steps as we did for the plugin, download the original theme, and compare the files with the theme folder which resides on the server.
After checking the themes and plugin folders on the hosting server, you have to move on to the following folder that usually stores the media files. It’s a hectic thing to do because there could be lots of media files, but to be sure that the virus has not crawled into the media files folder, you have to filter out this folder.
You have to scan the complete folder of WP-Content.
Clean Database
Cleaning the database is also a crucial part of removing the malware from your website. Most attacks happen to attack the website’s database and penetrate the website by injecting the tables with malicious code.
To evaluate your database first, you should know what the name of your database is. You can check it by finding the database name in the wp-config.php file if you don’t know.
After finding the name of the database, please make a backup of it.
- Click on your database.
- In the navigation bar, look for the Export tab, and click on it.
- Leave default setting as it is, click on Go.
- It will download a copy of the database to your local computer.
- Now you have to scan and evaluate your database. Look for the spammy quires that you think are not belong to the database.
- You can even search for the irrelevant tables, which you thought have no concern with your database.
- We recommend looking for the tables manually. Please do not use any plugin for this because your website is already got slow by the malicious attack, and adding more plugins to it only makes it quieter and heavy.
- If you find any table odd, delete its data and revisit your website to see if it affected your website or not.
Eliminate the Backdoors
It is evident that if your website got attacked by hackers, they would not leave you soon, and even hackers know that you will take action and try to remove malware from the site.
So hackers create a backdoor into the websites to enter your website with a backdoor whenever they want. A backdoor is a loophole they make in your website so that they will be difficult to find, and hackers will always have a chance to get into your website again whenever they want.
A backdoor is primarily created in the website’s core files or made as core files of the website but placed in different directories.
There is some common example of the backdoors Php functions that attacker uses these function could be used by plugins as well for legit reasons:
- Base64
- Str_rot13
- gzuncompress
- Eval
- exec
- system
- assert
- stripslashes
- preg_replace (with /e/)
It is essential to close all the backdoors in WordPress because they can be harmful to your site in the future, and attackers can quickly enter your website again.
Make Website Global Again
Before beginning the scanning and cleaning process, we have blocked our website to access from all over the world to ensure that hackers don’t know that we are working on the website and removing the malware.
You have to remember that we edited the .htaccess file and added code to that file. To make your website again accessible and global, you have to remove that extra added code.
For some days, you have to keep on a check and continue scanning your website because an attacker could again try to penetrate your system.
Removing Warning From Google Search Console
After cleaning your website, it will never automatically ask google to remove the website warning label.
You have to request Google to remove the warning label from your site because your site is now clean and malware-free.
- Go to Google Search Console,
- Verify your website by using your domain.
- Find the Security and Manual Actions tab, and click on Security issues.
- Now Google will show your website’s security report, and then you choose the request a review option.
- Now you have to wait until Google responds to your request and unblock your website.
Prevention From Future Attacks
Once you have cleaned up your website from malware, it is crucial to take total precautionary measures to prevent the next attack.
To be defensive this time, you should install security plugins like Wordfence and activate the essential firewall setting so you can prevent your website from any attack.
To beware of the brute force attack, use a strong password. A long password with special characters is the most secure one, although WordPress suggests a strong enough password when you set any password to the user.
While you are purchasing the hosting, most of the hosting companies provide their security package with additional charges to make your website more secure and handle any attack by themselves. We recommend you always buy that security package while buying a hosting plan.
Wordfence Security Plugin
Wordfence is the most trusted security plugin people, website owners use. If your website got attacked and infected with malware and you don’t know how to tackle it. You can use Wordfence; it is a very easy-to-use and user-friendly plugin. Using it doesn’t require any technical knowledge.
It has a complete feature package that helps you maintain your website’s security and prevent attacks. It has one of the best scanners, and it scans themes, plugins, and even the content folder of your website.
With a sound updating system, it always keeps itself up-to-date with updated and new malware security definitions.
Anti-Malware Security and Brute Force Firewall
Most of the security plugins scan your system, and if found anything that is malicious, they ask your permission to delete it even if it is hurting the website. On the other hand, with Anti Malware Security and Brute Force Firewall, if it found any unusual file or confirmed malware, it will not be going to ask for your permission and directly delete the infected file.
It helps to maintain the health of the website by scanning and deleting the malicious files and codes.
MalCare Security Plugin
MalCare is one of the best and most widely used security plugins used by website developers. It has rich malware cleaning features. It helps to clean infected websites and prevent the website from future security breaches. It also enables firewall protection and blocks the lousy IP address and unwanted login attempts.
FAQs about Malware
Is it possible that malware got into my website and I don’t let me know about the unusual activity?
Yes, malware may get into your website without even making you notice. Some malware does not change your website, so it’s hard to suspect and clean that kind of malware. This malware gets into the website to steal information and data, and the website owner if it doesn’t do regular security checkups, will never notice it.
How did my website get hacked?
There is different kind of attacks with which your website can be hacked. Every website has some vulnerability or theme or plugins that are not entirely safe. So hackers fined the doors to enter into the website and manipulate your website.
Which method is better to detect and remove malware from a website manual or using a plugin?
It is clear to you which method you want to use; we always recommend a manual process only when you are knowledgeable enough to work on core files and understand the structure’s structure. Otherwise, it is best practice to hire a developer to remove malware from your site.
If you don’t want to hire a developer, and it’s out of your budget. Or you don’t have enough knowledge to work manually on your website; it is better to have used a plugin to do this task for you.
How can I be so sure that a hacker attacked my website?
If you found any unusual change in your website you have not made, like redirects, language change, unethical ads, and content you have not added. It’s a clear sign of malware. We have discussed other different ways above to find out that any malware attacked your website or not.
Final Words
Suppose you have developed a website with years of effort and gather your potential users and subscribers. One attack can harm the credibility of your whole website and years of action and compromise your user’s information.
You can do security checks manually and with the help of a plugin.
We have shown you if your website got attacked by any malware, how you can remove it. We also have discussed what security measures you should take next time to prevent your website from any potential attack in the future.
