{"id":189618,"date":"2020-07-14T03:57:14","date_gmt":"2020-07-14T03:57:14","guid":{"rendered":"https:\/\/premium.wpmudev.org\/blog\/?p=189618"},"modified":"2024-05-10T00:08:33","modified_gmt":"2024-05-10T00:08:33","slug":"delete-suspicious-code-defender","status":"publish","type":"post","link":"https:\/\/wpmudev.com\/blog\/delete-suspicious-code-defender\/","title":{"rendered":"Been Hacked? Here’s How To Quickly Find and Delete Suspicious Code with Defender"},"content":{"rendered":"

If you’re not careful, suspicious code within your sites can easily go unnoticed and wreak havoc. Whether you’ve been hacked and need a resolution ASAP, or you simply want to check your sites for suspicious activity, Defender can help you quickly detect and eliminate malware for good. See how it’s done in this tutorial.<\/p>\n

Looking for a convenient and hassle-free way to locate and delete suspicious code from your sites?<\/p>\n

In this tutorial we’re showing you, step-by-step, how Defender<\/a>‘s vast suite of security features can help banish and keep suspicious code at bay.<\/p>\n

You\u2019ll also learn how to keep your sites protected from these kinds of issues going forward.<\/p>\n

Let’s not delay, the health of your sites is at stake!<\/p>\n

How To Detect and Resolve Suspicious Code and Files With Defender<\/h2>\n

First order of business…<\/strong> Detecting and removing suspicious files and code can only be done with the Pro version of Defender.<\/strong><\/p>\n

You can get Defender Pro<\/a>, along with our suite of Pro WordPress plugins and site management tools for a low $3\/month.<\/strong> Which is incredible value, especially if you own or manage critical sites that are particularly susceptible to malware or attacks.<\/p>\n

The first step is to enable the Suspicious Code<\/strong> setting via Malware Scanning > Settings.<\/strong><\/p>\n

You also need to ensure that File Change Detection<\/strong> is enabled for both ‘Scan Core Files’ and ‘Scan Plugin Files.’ This will help reduce the occurrence of false positives in your scans.<\/p>\n

\"A
Enable these vital security settings before proceeding any further.<\/figcaption><\/figure>\n
\n

Once you’ve enabled these settings, you’re ready to scan your site for malware.<\/p>\n

To do this, go to Malware Scanning<\/strong> via the WordPress admin sidebar or from the main Defender dashboard.<\/p>\n

\n
\n
\"A
Start a new malware scan with a click and identify threats in seconds.<\/figcaption><\/figure>\n<\/div>\n<\/div>\n

Once here, you can initiate a new scan with a click.<\/p>\n

Then sit back and let Defender work its magic. The scan should only take a few minutes, depending on the size of your site.<\/p>\n

\n
\"A<\/div>\n<\/div>\n

Once the scan is completed, you will be alerted to any issues found relating to file change detection, known vulnerabilities, and suspicious code.<\/p>\n

\n
\n
\n
\n
\"A
The Issues tab details all of the vulnerabilities or suspicious behavior detected.<\/figcaption><\/figure>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

Next, simply click on the Issues<\/strong> tab. Here you will find a list of all the potentially harmful files that have been compromised or changed in some way.<\/p>\n

\"A
Defender quickly identifies issues for you to address.<\/figcaption><\/figure>\n

Click on any of the detected files to get more details about the issue and its exact location.<\/p>\n

In the example below, the suspicious code has been detected inside of a WordPress plugin. Defender specifically points out the error and the file in which it was found.<\/p>\n

\n
\n
\"A
Quickly see where the detected issue was found.<\/figcaption><\/figure>\n<\/div>\n<\/div>\n
\n

Along with seeing important details like the plugin URL, location of the issue, date added, and developer, you have three options when it comes to addressing suspicious files or code.<\/p>\n

You can either ignore<\/strong>, delete<\/strong>, or Safe Repair<\/strong> the file.<\/p>\n

Caution:<\/strong> It\u2019s strongly recommended to ensure that something is harmless before choosing to delete and\/or ignore it. If you’re unsure or need advice, you can consult our 24\/7 WordPress experts.<\/a><\/em><\/p>\n

It’s important to note there is a chance that reported issues or vulnerabilities could be false positives, meaning that legitimate code being flagged as suspicious due to its resemblance to malicious code.<\/p>\n

This can happen for various reasons, such as a function being modified by a plugin or theme, or if something is directly modified in the file or theme editor.<\/p>\n

Fortunately, Defender is designed to minimize the occurrence of false positives. However, malicious code often mimics legitimate code, making it almost impossible to avoid completely.<\/p>\n

To help verify suspicious code, you can take a couple of steps:<\/p>\n