When Backvera confirms a threat in the backups of a site, the site gets a red badge such as 2 threats, and its Security tab lists what was found. This article covers what to do next.
Read the Security tab
Open the site and go to Security. The header reads, for example, 2 threats confirmed by Backvera, and shows which backup was checked. Each threat below it shows:
- What it is, for example Malicious file, Administrator account, or Compromised plugin release.
- Where it is: the file path, the database entry, or the release.
- The plugin or theme a file belongs to, when it belongs to one.
- When it first appeared: First found in the backup of a date, with a Browse that backup link.
Find the last clean backup
The date after First found in the backup of tells you when the threat arrived. In the History tab, a backup with a red badge contains a threat, and a backup with a grey shield was checked and had no confirmed threats. Restore from a backup with a grey shield taken before that date.
Remove the threat
Pick the option that loses the least work:
- Restore only the affected files from a backup taken before the threat appeared. Everything else on the site, such as new posts or orders, stays as it is. See Restore specific files or database tables.
- Remove it yourself. Delete the file, delete an administrator account you do not recognise under Users in WordPress, or update or remove a compromised plugin or theme.
- Restore the whole site from a backup taken before the threat appeared, when many files are affected. Anything that changed on the site since that backup is rolled back too. See Restore your site to an earlier point in time.
Close the way in
Malware often gets in through an outdated plugin or theme, or a stolen password. After removing it:
- Update WordPress, every plugin, and every theme. A restored backup brings back the versions it held, so update again right after a restore.
- Remove plugins and themes you do not use.
- Change the passwords of every administrator, and of your hosting, FTP, and database accounts.
- Check Users in WordPress for administrator accounts you do not recognise.
Take a new backup
Run Backup now once the site is clean. When Backvera has checked the new backup, the Security tab reports on it, and a threat that is gone no longer appears. Until then, the tab says how many newer backups have not been checked yet.
If you think a finding is wrong
Email [email protected] with the site and the item, and we will review it.
Still need help? Email our team at [email protected].