How to fix a compromised website plugin

Summary

This guide helps you troubleshoot and resolve: How to fix a compromised website plugin. Follow the steps below to fix the issue.

Common Causes

If your website uses a Content Management System such as WordPress, Joomla, or Drupal, outdated or abandoned plugins can create security vulnerabilities that allow unauthorised access to your site and hosting account. Attackers may inject malicious code, redirect visitors to harmful pages, or use your server to send spam. This article explains how to identify signs of a compromised plugin, safely remove suspicious extensions, and restore your site from a clean backup.

Signs your site may be compromised

Before taking action, look for common indicators that a plugin has been exploited:

• Visitors being redirected to unfamiliar or harmful websites
• New, unknown administrator accounts created in your CMS
• Suspicious files appearing in your website directories
• Hosting alerts about spam being sent from your server
• Unexpected changes to website content or appearance
• Security warnings from search engines or browsers

Quick fix steps

1. Put your website into maintenance mode if possible.
2. Create a full backup of your site files and database.
3. Scan your site for malware and identify compromised files.
4. Identify and deactivate the compromised plugin.
5. Remove the plugin files from your server.
6. Restore your site from a clean, pre-compromise backup.
7. Update all remaining plugins, themes, and the CMS core.
8. Change all relevant passwords, including CMS admin, hosting, and database credentials.
9. Scan your local computer for malware that may have stolen credentials.

Detailed instructions

Step 1: Back up your website

Before making any changes, download a complete copy of your website files and export your database. This ensures you can revert if something goes wrong during the cleanup process.

1. Log in to your hosting control panel.
2. Open the File Manager or use an FTP client such as FileZilla.
3. Download all files from your website's root directory (commonly public_html or www).
4. Open phpMyAdmin and export your website database to a .sql file.

Step 2: Identify the compromised plugin

Review your CMS admin dashboard for recently installed or updated plugins. Check modification dates on plugin files via your hosting control panel to spot files changed around the time the issue began.

1. Log in to your CMS administrator dashboard.
2. Navigate to the Plugins or Extensions section.
3. Look for plugins that are outdated, no longer supported by their developer, or that you do not recognise.
4. Check your site's error logs for references to specific plugin file paths.
5. Use a security scanner or malware detection tool to identify infected files.

Step 3: Deactivate and remove the plugin

1. In your CMS dashboard, go to Plugins > Installed Plugins.
2. Select Deactivate beneath the suspicious plugin.
3. Once deactivated, select Delete to remove the plugin from your site.
4. Connect to your server via FTP or File Manager and navigate to the plugins directory (for WordPress, this is typically /wp-content/plugins/).
5. Manually delete the plugin folder if any files remain.

Step 4: Restore from a clean backup

Restore your website files and database from a backup created before the compromise occurred. Avoid restoring from a backup taken after the breach, as it may contain the same malicious code.

1. Upload your clean website files to the server, overwriting existing files.
2. Import your clean database backup via phpMyAdmin.
3. Verify that your site loads correctly and that no unfamiliar administrator accounts exist.
4. Scan the restored site for any remaining malicious files or code.

Step 5: Update everything

1. Update your CMS core to the latest version.
2. Update all installed plugins and themes.
3. Remove any plugins or themes that are no longer maintained by their developers.

Step 6: Change your passwords

Attackers may have harvested credentials during the compromise. Change the following:

• CMS administrator passwords
• Hosting control panel passwords
• Database user passwords
• FTP and SSH account passwords

Step 7: Scan your local computer

Attackers may have stolen credentials from your computer. Run a full antivirus scan on any device used to access your website or hosting account.

Troubleshooting

Site still crashes after removing the plugin

If unexpected site crashes continue, check your error logs for specific file paths and consider restoring from an earlier backup.

Cannot access the admin dashboard

Use FTP or your hosting control panel's File Manager to rename the wp-content/plugins folder (for WordPress) or the equivalent extensions directory for Joomla or Drupal. This disables all plugins and may allow you to log in.

Still Having Issues?