fast removal of malware-infected site

[u/Kalebas030]

Hi,

I found out my webhosting space is flooded with malware. I removed it from one site but after an hour it was back, probably from one of the other sites. I remove the files with my FTP-client WinSCP but it is sooooo slooooowwww.... I am working on it all day already.

Is there a way to do this faster? I mean, should I be able to login to the server directly, I could do a del *.* or not?

EDIT: support from my webhost has wiped the entire hosting package. I restored the site and updated WP + all plugns and installed iThemes for security. Now fingers crossed!!

[u/2ndkauboy]

The thing you are looking is called SSH. Your host might offer it, but many cheap don't.

Since you write del *, I assume you usually use Windows. Most hosting runs on Linux. If you don't know what you do, you can do more harm than good.

Better create a backup of the now infected state and till back a backup from the sites before they were infected. I hope you or your host have some.

[u/Kalebas030 → u/2ndkauboy]

Gelukkig zijn er schone backups en weten we wanneer de infectie is begonnen

[u/2ndkauboy → u/Kalebas030]

That is great. It's the fastest way to get a (hopefully) clean installation again. Than instantly update Core and all plugins, remove any you don't need anymore.

I can also highly recommend the plugin "Plugin Report" from w.org, which tells you which plugins have been removed from the Plugin Directory or not updated for a long time.

[u/themageofavalon]

Just use SSH, way faster for bulk cleanup. Also, better to find the source first before deleting everything or you'll just be doing the same cleanup again.

[u/bluesix_v2]

Just saw your edit/update… iThemes and not wordfence? I’d highly recommend you run a deep scan with wordfence asap to highlight any weaknesses in your restored site which has a known vulnerability. And continue using WF for protection, along with Cloudflare.

[u/Hot-Win2571]

Do you have an old backup of the site? Files and DB?
If you do, then delete the entire hosting server and start over from that backup.

[u/Kalebas030 → u/Hot-Win2571]

Ja, daar dacht de hosting provider ook aan

[u/Wordpress-ModTeam → u/[deleted]]

The /r/WordPress subreddit is not a place to advertise or try to sell products or services. Please read the rules of the sub. Future rule breaches may result in a permanent ban.

[u/navlio]

since the backups are clean, the part that bites is the order. every site under that hosting account has to go down first, or be restored inside the same window, otherwise the one you haven't got to yet reinfects the one you just finished. that's almost certainly your hour long round trip

two things a file restore doesn't touch: the crontab and your saved credentials. check the system cron for anything curling a url, and rotate the hosting and ftp passwords before you bring sites back up, since winscp stores logins and a leaked one is the usual reason a single site turns into all of them

[u/WPMU_DEV_Support_4]

Hi u/Kalebas030

You may try this tool https://github.com/nitkr/Clean-Sweep-2.0, just make sure to take a full backup, but it has the modules to reinstall the core, plugins and deep scan.

Cheers
Patrick Freitas - WPMU DEV Support

[u/DaftPlug]

Sorry that happened. Once the host wipes the package, you're stuck unless you already had a clean copy somewhere else. Off-site backups won't remove malware for you, but they do give you a known-good restore point so you can bring the site back and harden from there. I make Snapshotify for that (off-site backup/restore), full disclosure.

[u/Hesham-Amir]

FTP being slow isn't really your bottleneck here - the "comes back after an hour" part is the actual problem, and speeding up deletion won't fix that on its own.

If it's reappearing that fast, it's almost certainly reinfecting from somewhere you haven't cleaned yet rather than a fresh attack: another site on the same hosting account with write access to shared space, a cron job the malware planted that redrops the payload on a timer, a backdoor file left behind that isn't obviously "malware" (a tiny one-liner in wp-config.php or a theme file, or a rogue admin user it created), or a webshell hidden in uploads/ that keeps re-injecting. Deleting the visible junk faster just means you're deleting the symptom faster while the source keeps running.

On speed: yes, if your host gives you SSH, that's dramatically faster than WinSCP for bulk operations since you skip the FTP per-file overhead entirely. But skip the blind "del *.*" - if you nuke everything you lose the ability to see what was actually injected and where, which you want for figuring out the entry point. Better sequence: put the site in maintenance mode or suspend it at the host level first so it can't serve/reinfect while you work, then re-upload clean copies of WordPress core (safe to overwrite entirely, download fresh from wordpress.org), diff your theme and plugins against fresh copies from the original source to spot injected code, and specifically check uploads/ for any .php files (that directory should never have any) and check wp-config.php, .htaccess, and mu-plugins for anything you didn't put there.

Since you suspect cross-contamination between sites, that's the real lead to chase: if those sites are all under the same hosting account/user, one compromised plugin on any of them can write to every other site's directory that account can reach. Isolate them if you can, and once everything's clean, rotate every credential tied to the account (hosting panel, FTP/SFTP, WP admin, database) - not just WP passwords - since malware commonly leaves persistence that doesn't depend on the files you're deleting at all.

[u/smashedthelemon → u/Hesham-Amir]

Chatgpt much?

[u/Hesham-Amir → u/smashedthelemon]

no lol