How to Swiftly Detect and Eliminate Suspicious Code with Defender Post-Hack

If you’re not vigilant, dubious code lurking on your websites can easily remain undetected and cause serious issues. Whether your site has been compromised and requires immediate remediation, or you simply wish to examine your sites for any unusual behaviors, Defender offers a solution to swiftly identify and eradicate malware permanently. Discover how it works in this tutorial.

Are you in search of an easy and straightforward method to find and remove suspicious code from your websites?

This tutorial provides a step-by-step guide on how Defender‘s extensive array of security tools can assist in eliminating and preventing suspicious code from resurfacing.

You will also learn effective strategies to ensure your sites remain safeguarded against such problems in the future.

Let’s get started, as the well-being of your sites is on the line!

How To Identify and Fix Suspicious Code and Files Using Defender

To begin… Identifying and deleting suspicious files and code requires the Pro version of Defender.

You can acquire Defender Pro, along with our collection of Pro WordPress plugins and site management tools for a mere $3/month. This is exceptional value, particularly if you own or oversee critical sites that are highly vulnerable to malware or attacks.

The first step is to activate the Suspicious Code feature through Malware Scanning > Settings.

Ensure that File Change Detection is enabled for both ‘Scan Core Files’ and ‘Scan Plugin Files.’ This will help lower the chances of false positives during your scans.

A screen showing Defender's various security settings
Activate these essential security settings before proceeding any further.

After enabling these settings, you are set to scan your site for malware.

To initiate this, head to Malware Scanning from the WordPress admin sidebar or the main Defender dashboard.

A screen showing where you can start a new malware scan
Start a new malware scan with a single click and identify threats in seconds.

Once here, you can kick off a new scan with just one click.

Then, relax and allow Defender to perform its functions. The scan should only take a few moments, dependent on your site’s size.

A screen showing a Defender malware scan in progress.

Once the scan is finished, you will be notified of any issues found related to file change detection, known vulnerabilities, and suspicious code.

A screen showing that vulnerabilities have been detected.
The Issues tab provides details on all identified vulnerabilities or suspicious activities.

Next, simply click on the Issues tab. You will find a compilation of all potentially harmful files that have been altered or compromised in some manner.

A screen showing the issues the Defender scan has detected.
Defender promptly spots issues for you to address.

Click on any detected files for more detailed information about the issue and its exact location.

In the example provided, the suspicious code has been found within a WordPress plugin. Defender clearly indicates the error and the file where it was detected.

A screen showing details of an issue that was detected during the malware scan.
Quickly identify where the detected issue was located.

Alongside crucial details such as the plugin URL, location of the issue, date added, and developer, you have three options for addressing suspicious files or code.

You can choose to ignore, delete, or Safe Repair the file.

Note: It’s highly advisable to verify that something is truly benign before deciding to delete and/or ignore it. If you’re uncertain or need guidance, feel free to consult with our 24/7 WordPress experts.

Keep in mind that there is a possibility that reported concerns or vulnerabilities could be false positives, meaning genuine code being misidentified as suspicious due to its similarity to malicious code.

This can occur due to various factors, like a function modified by a plugin or theme, or alterations made directly in the file or theme editor.

Fortunately, Defender is built to minimize the chances of false positives. Yet, malicious code frequently mimics legitimate code, making complete avoidance nearly impossible.

To help validate suspicious code, you can undertake a couple of actions:

  • Verify custom edits: Consult with the plugin developer to verify the questionable code.
  • Contact our support: If you did not add the code, and you’re confident that no one you know did, don’t hesitate to reach out to WPMU DEV support for feedback and to report what you consider to be malicious code.

It is strongly advised to consult either the plugin developer or our support team for guidance before deleting any files. You’ll need to disable the plugin beforehand to delete the corresponding file.

Another excellent and risk-free option is to utilize Defender’s Safe Repair feature.

A screen showing where the user can enable the Safe Repair feature
Employing Defender’s Safe Repair feature is a fantastic way to fix your site without the concern of causing further damage by deleting a file.

Click Safe Repair to automatically quarantine the file for a specified duration that you set (30 days – one year).

This allows for a swift site repair and fixes the issue immediately if it is responsible. The quarantine timeframe also provides sufficient time for thorough investigation.

Moreover, if it turns out to be a false positive, you can effortlessly restore the file. This prevents you from accidentally deleting a vital file and averting further issues with your site.

A screen showing a potentially malicious file in quarantine, and the options you have to deal with it
Restore or permanently delete files with a single click.

Once you are confident that deleting the file is both safe and necessary, you can securely do so from the Quarantined tab.

And that’s a wrap!

You’ve witnessed how straightforward and quick it is to pinpoint and address suspicious files or code following a hacking incident or malware attack.

However, promptly addressing critical issues as they arise is one thing….

Preparing and safeguarding your sites against future threats is quite another!

With that in mind, here are some ‘bonus tips’ to make sure your sites are well-equipped to handle potential hacks or other issues should they arise again.

BONUS TIPS: How To Set Up Your Sites For Ongoing Protection

Schedule Automated Site Scans

Another beneficial feature of Defender Pro is the capability to schedule automated site scans.

This not only frees you from the need to conduct manual scans but also ensures that your sites are checked regularly for security issues effortlessly.

Scheduled scans can be configured via Malware Scanning > Settings. From there, all you need to do is activate scheduled scanning and specify the frequency, day of the week, and time of day for the scans to commence.

A screen showing where you can schedule and automate your malware scans.
Effortlessly establish automated scans according to your desired frequency.

Activate Notifications for Suspicious Activities

After setting up automated scans, it’s advisable to establish notifications so you can be alerted of scan results regardless of your location, saving you from needing to check in manually.

Simply navigate to the Notifications section using the sidebar or from the main Defender dashboard.

Here, you’ll discover various notification options available for selection.

For instance, in the event of detecting suspicious code, you should enable the Malware Scanning “Notification” and “Reporting” options.

A screen showing where you can enable Defender notifications.
Defender provides multiple notification options for you to customize.

After making your selections, you can configure additional settings and preferences for each notification.

You also have the option to add users directly or invite them via email.

A screen showing where Defender users can adjust the recipients of their notifications

Next, you can further fine-tune the notification settings to ensure you only get alerts at appropriate times.

Additionally, you can set up bespoke email message templates for your clients to ensure the notifications they receive align with your preferences and are clear to the end-user.

A screen showing where you can confirm notification settings and set up email message templates
Enable notifications when necessary and provide customized message templates for your users.

Identifying and Erasing Suspicious Code Has Become Simpler With Defender

As illustrated, suspicious code is no challenge for Defender and it truly only requires a few clicks to eliminate.

In addition to locating malicious code and the capacity to remove it, Defender can also stop SQL injections, prevent unauthorized access to WordPress vulnerabilities, halt PHP execution, and much more.

For further insights into WordPress security, be sure to check out our Ultimate Guide to WordPress Security. And for more details on how Defender operates, don’t forget to review the plugin’s documentation.

Don’t have the time or resources to tackle malware or hacks on your own? Explore our Expert Services!

We recognize that when a malware incident occurs on a client site you manage, you may lack the time or resources to rectify it yourself.

In such cases, our Expert ‘done-for-you’ Services present another excellent alternative.

Instead of stressing over security concerns or malware attacks by yourself, you can enlist our experts at an affordable cost to manage it for you. You can also readily resell these services to your clients without incurring any additional fees from us.

Furthermore, we offer a full 7-day money-back guarantee. If we assist in resolving a hacked site and a problem reappears within seven days, we will return to fix it at no additional charge!

Discover more about our Expert Services here.

[Editor’s note: This article was initially published in July 2020 and revised in May 2024 for accuracy.]