The latest Safe Repair feature enhances the process of fixing and isolating harmful files with Defender Pro, making it more efficient and secure for WordPress users than ever before!

The Hub: Defender - Quarantine Widget
Access and examine files that have been placed in quarantine by utilizing the Safe Repair function within Defender, accessible through The Hub.

WPMU DEV’s robust security plugin for WordPress, Defender, has released its latest version 4.1. This update guarantees full compatibility with the newest version of WordPress and, crucially for Pro users, simplifies the procedure of fixing and isolating altered or questionable files, while also providing a more secure option for file removal.

In this article, we will concentrate on this new addition and discuss the following topics:

  • What is Defender’s “Safe Repair” Feature?
  • How Does “Safe Repair” Work?
    • Suspicious Files
    • Modified Files
    • Repairing Files
    • Quarantined Files
  • Instructions for Utilizing Defender’s “Safe Repair” Function
  • Restoring Quarantined Files
    • Restoring Files Via The WordPress Admin
    • Restoring Files Via The Hub

Let’s jump right in…

Can you explain what the Safe Repair Feature in Defender is?

As a user-driven company, we listen to what our members and users want. Especially when it comes to addressing issues, as outlined in the comments below from our Defender plugin users:

  • “I was running a malware scan with Defender Pro, and I think I accidentally deleted a file which I shouldn’t have. Now the website is down with a critical error.”
  • “Our website is currently unavailable after deleting two files that Defender Pro advised us to remove.”
  • “It would be wonderful if Defender Pro allowed us to quarantine a file in addition to the options of deleting a file or ignoring it.
    That way if the suspicious file breaks the site, it can be restored easily instead of having to restore the entire site from a backup.”

Based on the feedback received, our development team has chosen to enhance our security plugin by incorporating additional features to prevent significant problems and errors on users’ WordPress websites.

  1. Repair and Quarantine/backup suspicious files so these can be restored if necessary.
  2. Repair and Quarantine/backup modified files so these can be restored if necessary.

Defender Malware Scanning scans your entire site for suspicious code or modified files and published vulnerabilities in plugins, themes, and WordPress core.

The Safe Repair function targets files that have been flagged as suspicious or altered, giving users the option to isolate, remove, or update them with the most recent versions from the official plugin source.

Defender Pro - Plugin vulnerability message
Defender detects and warns users of plugin, theme, and core vulnerabilities. Note: the plugin shown in the above screenshot was modified for illustrative purposes.

How Does Safe Repair Work?

As previously mentioned, the Safe Repair function in Defender Pro’s Malware scanning section aims to simplify the process of isolating files before they are repaired or removed, providing a more secure option compared to immediately deleting files that are suspicious or have been altered.

Here’s how Defender Pro handles these requests from version 4.1 onward:

Suspicious Files

Defender flags PHP functions, code, and files when they vary from what is expected or when they match known issues.

Defender- Suspicious file
Defender identifies and marks files containing potentially harmful code.

Once a flagged function or suspicious code has been verified as suspicious, Defender presents you with three actions: Ignore, Delete, or Safe Repair (note: you may need to deactivate the plugin for the ‘Delete’ option to become active).

Prior to v4.0, deleting suspicious files would occasionally cause a plugin, theme, or even the entire website to break. Often, this is caused by code from the plugin or theme itself being flagged by Defender as being suspicious.

The problem, however, appears when it’s a false positive, meaning that the flagged file isn’t malicious per se, but part of the plugin’s (or theme’s) core files and contains risky code added by the theme or plugin developer. Hence, deleting this file could cause errors on the site, break functionality, or even break the entire site.

Starting with version 4.1 of Defender Pro, users have the option to fix and isolate or create backups of questionable files for a period of 30 days or longer, rather than immediately removing the file. The files are kept under the newly added quarantine section, giving you the ability to retrieve them if necessary, including manual restoration. This offers a secure approach to managing suspicious files and gives you the ability to recover them if errors or incorrect detections occur.

Note: The Safe Repair option becomes available only if the suspicious code found differs from the plugin’s original code. Also, Safe Repair only works with WordPress.org plugins currently.

Modified Files

If code in a plugin, theme, or WordPress core file doesn’t match what is found in the official WordPress repository. Defender will flag the file as a Modified file. Restoring the original file fixes this issue.

Previous editions of Defender (including the Defender Free plugin) included a “Restore” option in the Malware Scanning area of the plugin. This option retrieves a new file from the WordPress repository and substitutes it for the current file in the server directory.

Defender Pre v4 - Restore files
Earlier versions of Defender offer only the option to restore modified files with a fresh version of the file.

However, when a file has been modified by an admin or site developer (e.g. by adding a custom code for a certain functionality), deleting or replacing the file with its original can result in the loss of custom code or functionality, and in some cases, lead to sites breaking.

In Defender Pro, the Restore function has been updated to Safe Repair. This enhanced feature not only substitutes the altered file with the original version from the WordPress repository, but also provides an option to isolate the altered file before substituting it. This allows users to recover the file if necessary.

Defender v4.0 - Safe Repair button
The new Safe Repair feature of Defender Pro allows users to restore replaced files.

Repairing Files

Repair is a handy feature to have when a file in the server directory gets modified for any reason. It smartly fetches a fresh file from the WordPress repository and swaps it with the current file in the server directory. (See below for more details on how to use this feature.)

Quarantined Files

Files that have been altered or appear to be suspicious on your server will be isolated and transferred to a separate directory./wp-content/.defender-security-quarantine), allowing you to restore the files if needed (explained in more detail further below).

How to Use Defender’s Safe Repair Feature

To access the Safe Repair function, ensure that Defender Pro is installed and updated to the latest version. If you are using the free version of Defender WordPress Security plugin, consider upgrading to the Pro version by joining WPMU DEV as a member.

Also, make sure that you have enabled the plugin’s settings as shown below for the Safe Repair feature to work.

Defender Settings
The above settings must be enabled for Safe Repair to work.

If you have installed Defender Pro v4.1 or higher, and have set up the configurations mentioned above, initiate a new Malware Scan by navigating to Defender, selecting Malware Scanning, and clicking on New Scan.

Defender - Malware scan
Run a malware scan in Defender.

Once the scan is completed, check for modified or suspicious files.

Defender Malware Scan results
A scan for malicious software has revealed altered files and potentially harmful code.

Next, click on the Malware Scanning > Issues tab.

Defender - Malware Scan Safe Repair

Select a file and click on the Safe Repair button.

You will have the choice to fix and/or isolate the chosen file.

Defender Repair File feature
We recommend quarantining files before repairing them.

Note that by default, quarantined files will remain isolated for 30 days before being automatically deleted. You can configure quarantine duration in the Malware scanning settings if you want to change this default period.

Defender Quarantine settings
You can change the quarantine period in the Malware Scanning settings section.

Restoring Quarantined Files

There are two methods for retrieving files that have been quarantined.

  1. Via WordPress Admin: Go to Defender > Malware scanning > Quarantined section.
  2. Via The Hub: Use the Quarantined Hub widget under the Security tab.

Restoring Quarantined Files Via The WordPress Admin

Quarantined files are listed under the new quarantine tab.

Defender Quarantined section
Defender stores all of your quarantined files in the Quarantined section.

To restore quarantined files from your WordPress admin, log into your WordPress site, and go to Defender Pro > Malware Scanning > Quarantined.

Defender Pro - Malware Scanning - Quarantined section
Access all the files that have been placed in quarantine within the Malware Scanning area.

This section lets you go through your quarantined files and choose to either restore or permanently delete these.

Defender Quarantined Fles - Options
Restore or delete your quarantined files.

Files can also be manually retrieved by downloading them from/wp-content/.defender-security-quarantine.

Restoring Quarantined Files Via The Hub

The Hub’s Security tab lists your most recent quarantined files (up to a maximum of 5 files) and provides the following options, depending on whether the website is running or not.

  • If the website is up – files can be restored from the Hub.
  • If the website is not functioning, there will be instructions provided on how to manually recover the quarantined file(s) through FTP/SSH.
The Hub - Quarantined Files widgets
Monitor quarantined files in The Hub’s Security section.

Repair Files Safely Using Defender

Defender 4.1 now offers the ability to quarantine and repair altered or questionable files, as well as isolate them rather than completely remove them. This reduces the chance of damaging your website, as quarantined files can be recovered if necessary.

For full details on using the new Safe Repair feature and all of its options, see the Defender plugin documentation section.

In today’s digital age, the importance of data security and website uptime cannot be overstated. Whether you’re a business owner, blogger, or just someone who relies on their computer for everyday tasks, the last thing you want is to lose important files or have your website go down unexpectedly. That’s where Defender Safe Repair comes in – a tool designed to prevent accidental file deletion and site downtime.

Defender Safe Repair is a software solution that provides an extra layer of protection for your files and website. It works by creating regular backups of your data, so that if something goes wrong, you can quickly restore your files and get your site back up and running. This means that even if you accidentally delete a file or your website is hacked, you won’t lose any important information.

One of the key features of Defender Safe Repair is its user-friendly interface. The software is easy to install and set up, and once it’s running, it does all the work for you. You can schedule regular backups to occur at a time that’s convenient for you, and you can also choose which files and folders you want to include in the backup. This means that you can tailor the software to your specific needs, ensuring that all your important data is protected.

Another benefit of Defender Safe Repair is that it can help prevent site downtime. If your website goes down, it can be a major inconvenience for you and your customers. With Defender Safe Repair, you can quickly restore your site from a backup, minimizing the amount of time it’s offline. This can help you avoid lost revenue and damage to your reputation.

In addition to its backup and restore capabilities, Defender Safe Repair also includes a range of other features designed to keep your files and website safe. For example, it includes a malware scanner that can detect and remove any malicious software that may have made its way onto your computer or website. It also includes a firewall that can block unauthorized access to your files and site.

Overall, Defender Safe Repair is an essential tool for anyone who wants to protect their files and website from accidental deletion and downtime. With its user-friendly interface, regular backups, and additional security features, it provides peace of mind and ensures that your data is always safe and secure. Whether you’re a business owner or just someone who relies on their computer for everyday tasks, Defender Safe Repair is a tool you can’t afford to be without.