Before you start
This explains the proposed actions you see when reviewing a cleanup.
Steps
-
Complete webshells are isolated first.
A file that is entirely a request-executing PHP shell is moved to quarantine, with a verified backup.
-
Core files are restored from verified originals.
WordPress files are replaced with the original for the exact version and locale, checked against WordPress’s published checksums. Joomla files come from the official release, checked against its published SHA-256.
-
Other files have the injected code removed.
The rest of the file is kept and PHP syntax is checked with the account’s PHP version.
-
Repairs are verified.
Each repaired file is scanned again before it counts as cleaned. If malware remains or the repair fails, the file is quarantined.
-
Unclear files are left alone.
Ambiguous code and protected configuration files stay unchanged for manual review.
What you should see
Every changed file has a recovery backup, and its outcome is recorded.
If something goes wrong
Plugins, themes and custom files have no trusted original to restore, so they can only be repaired by removing injected code. Cleanup never upgrades WordPress or Joomla. If the scanner is unavailable, repaired files wait for verification.
Related guides
Follow the steps visually
Choose a step to review its instructions and reference screen. Terminal output is an example.
Complete webshells are isolated first
A file that is entirely a request-executing PHP shell is moved to quarantine, with a verified backup.
Example only. Nothing runs on a server from this guide. Replace placeholders before using a command yourself.
Loading this step’s screenshot…
Sample-data capture of the plugin interface. Where shown, the orange outline marks the relevant control. Select the image to enlarge it.