Removing malicious code.
THE SAFEST APPROACH
Replace rather than clean.
HOW TO REPLACE
Download fresh core files from the official source Reinstall plugins and themes from legitimate sources Keep only your own content
WHAT TO KEEP AND CHECK
Your uploads directory, checked for script files Your configuration file, checked for additions Any custom code, reviewed
CHECKING UPLOADS
Look for script files among images.
Those should not exist.
CHECKING THE CONFIGURATION FILE
Look for anything added at the top or bottom.
Injected code frequently hides there.
WHAT INJECTED CODE LOOKS LIKE
Long strings of encoded characters Functions decoding and executing content Code at the very start or end of a file Unusual filenames
WHAT NOT TO DO
Delete every file a scanner flags without checking Clean one file and assume you are finished
WHAT TO CHECK AFTERWARDS
That the site works That no flagged files remain
WHAT TO ASK
If you are unsure, open a ticket before deleting anything.
