Treat a malware alert or unexpected website behaviour as a reason to investigate promptly. Our NabWP workspace can provide malware status, scanning and cleanup tools where those services and permissions are enabled. The WordPress AI Engineer can also help inspect relevant files, errors and settings, while our support team can assist with problems that need wider investigation.
IN THIS ARTICLE
01 Record the problem and investigate the alert
- Capture the relevant observations. Start by recording the affected domain, the warning and the behaviour you observed. Examples include an unfamiliar redirect, altered content or a new administrator account you did not create. Note when the issue began and whether a plugin, theme or account change happened shortly beforehand. This information helps focus the investigation.
- Check scan results and available cleanup actions. Review the latest scan result and use the available scan or cleanup action as appropriate. A scan still running is not a clean result. If a control is unavailable, or a cleanup operation does not complete, contact us rather than repeatedly applying unrelated changes. Keep an appropriate copy of the current state for investigation, and clearly distinguish it from a known-good recovery backup.
02 Address the cause and verify recovery
Cleaning detected files may be only one part of recovery. Investigate how the unwanted change occurred, update or replace the affected component and review compromised access. Change relevant credentials through their proper account controls when needed, and do not paste passwords, private keys or other secrets into public reports.
After remediation, test the site and repeat the relevant checks. Restoring an old backup without addressing the cause can allow the problem to return, while restoring an infected backup can reintroduce it immediately. We do not promise that every infection can be removed automatically. Share persistent findings with our team so the remaining cause and suitable recovery steps can be identified.
Does removing malware stop the site from being compromised again?
- Record the alert and affected behaviour before deleting evidence.
- Investigate the entry point, affected components and any exposed credentials along with available scan or cleanup tools.
- After remediation, update or replace the cause, rotate relevant credentials and verify both security checks and the customer journey.
Restore a known-good backup only after checking its date and scope. Restoring an infected copy or leaving the original vulnerability uncorrected can bring the problem back. A current incident copy may be useful for investigation, but it must not be confused with a clean recovery point.