- \n
- Viruses<\/strong>: Much like a human infection, a virus is a malicious file that attaches itself to clean files and then spreads.<\/li>\n\n\n\n
- Trojans<\/strong>: This malware type is often disguised as legitimate software, or are included in compromised programs. Trojan horses help other malware access and infect your system.<\/li>\n\n\n\n
- Ransomware<\/strong>: You\u2019ll find this on computer networks, where the ransomware attack will lock your computer down until you\u2019ve paid to have the malware removed.<\/li>\n\n\n\n
- Spyware<\/strong>: With this malware, your sensitive information is at risk, as it runs in the background and logs every action and keystroke you make.<\/li>\n\n\n\n
- Worms<\/strong>: These are often used to infect entire networks and devices, and each compromised machine is used to spread the worm even further.<\/li>\n<\/ul>\n\n\n\n
Now that we\u2019ve covered the basics, let\u2019s discuss how you can become affected by malware.<\/p>\n\n\n\n
How Does Malware Work?<\/h2>\n\n\n\n
Unfortunately, becoming infected with malware is common. There are two main starting points<\/a> for hackers looking to infect sites across the web. They might:<\/p>\n\n\n\n
- \n
- Create a website that\u2019s infected with malware from the onset, or<\/li>\n\n\n\n
- Attack an already-vulnerable website.<\/li>\n<\/ol>\n\n\n\n
The latter is the easiest and most prevalent approach. In fact, three-quarters of websites have a vulnerability that can be exploited, which includes many top-ranking sites with millions of daily hits.<\/p>\n\n\n\n
There are a number of ways malware can spread, such as through JavaScript vulnerabilities, drive-by downloads<\/a>, and much more. Once a machine has been infected, you\u2019ll often experience<\/a> attempts to steal personal information and login credentials like passwords, generate spam content such as phishing emails, and spread false links. In some cases, attackers may carry out fraudulent purchases.<\/p>\n\n\n\n
As you can see, a malware attack can be crippling. This means you need to ascertain if you\u2019re infected, and if so, how to remove it.<\/p>\n\n\n\n
How to Detect Malware<\/h2>\n\n\n\n
There are plenty of methods to detect malware<\/a>, but only two that we recommend for WordPress users. Let\u2019s take a look at both!<\/p>\n\n\n\n
Use WordPress Plugins<\/h3>\n\n\n\n
WordPress offers a plethora of security plugins<\/a> that will help rid your site of pre-existing malware. These work by constantly monitoring your site, and automatically blocking any malicious hacking attempts. What\u2019s more, they usually provide plenty of other features to protect your site.<\/p>\n\n\n\n
For WordPress users, the plugin approach means that you can secure your website directly from your dashboard, and you\u2019ll often get instant notifications of any breach. However, because the plugin is essentially part of your website, there\u2019s nothing to stop the malware from affecting it too. After all, if your site goes offline, so does your plugin.<\/p>\n\n\n\n
Check Out Google\u2019s Free Malware Checker<\/h3>\n\n\n\n
Google also offers a free online method<\/a> of checking for malware:<\/p>\n\n\n\n
![\"Google\u2019s](\"https:\/\/wpengine.com\/wp-content\/uploads\/2018\/07\/malware-resource1.png\")
<\/figure>\n\n\n\nThe good news is that if you are infected, this tool will let you know. However, you may only realize it after the damage has been done. This means you\u2019ll still need to do the removal work, and deal with the fallout of being infected.<\/p>\n\n\n\n
How to Remove Malware From Your Site<\/h2>\n\n\n\n
Fortunately, we\u2019ve previously covered<\/a> how to remove a malware threat from an infected site. In summary, there are six steps to follow:<\/p>\n\n\n\n
- \n
- Review the notification from Google\u2019s malware checker.<\/li>\n\n\n\n
- Back up your site.<\/li>\n\n\n\n
- Assess the damage, using a tool such as Sucuri<\/a>.<\/li>\n\n\n\n
- Repair any damage.<\/li>\n\n\n\n
- Take steps to prevent a re-infection.<\/li>\n\n\n\n
- Submit your now clean site to Google for reassessment.<\/li>\n<\/ol>\n\n\n\n
The article linked above goes into much more detail about the exact process. Fortunately, these steps are relatively easy to tackle for practically any user (and WP Engine users can contact support<\/a> for additional help).<\/p>\n\n\n\n
Best Third-Party Malware Detection Services<\/h2>\n\n\n\n
Finally, let’s look at some of the best third-party malware solutions available for WordPress users.<\/p>\n\n\n\n
Sucuri<\/a><\/h3>\n\n\n\n
![\"Best](\"https:\/\/wpengine.com\/wp-content\/uploads\/2018\/07\/malware-resource2.png\")
<\/figure>\n\n\n\nWe mentioned Sucuri<\/a> in the last section, and it\u2019s arguably the best third-party tool you can use. Its service not only contains malware detection, it offers a whole suite of security-related solutions.<\/p>\n\n\n\n
Since Sucuri runs on your server, it offers a layer of protection that plugins can\u2019t provide. The cost may be prohibitive, but it\u2019s an excellent solution if you have the budget for it.<\/p>\n\n\n\n
Cloudflare<\/a><\/h3>\n\n\n\n
![\"Cloudflare\"](\"https:\/\/wpengine.com\/wp-content\/uploads\/2018\/07\/malware-resource3.png\")
<\/figure>\n\n\n\nMany people know Cloudflare<\/a> for its Content Delivery Network (CDN). However, it can also combat a malware attack effectively.<\/p>\n\n\n\n
Its basic security software uses IP reputations<\/a> to stop malicious intent at the source. Higher tiers also employ a Web Application Firewall (WAF)<\/a> to stop malware in its tracks. However, there is a cost attached, which could turn away some users.<\/p>\n\n\n\n
Wordfence<\/a><\/h3>\n\n\n\n
![\"Wordfence](\"https:\/\/wpengine.com\/wp-content\/uploads\/2018\/07\/malware-resource4.png\")
<\/figure>\n\n\n\nAs we mentioned, WordPress plugins can be the ideal solution to malware. Wordfence<\/a> is arguably the best option.<\/p>\n\n\n\n
This plugin offers robust tools for scanning your site, detecting malware, and removing it (among other features). While it\u2019s great for complementary security, we\u2019d suggest also using a server-based solution such as CloudFlare or Sucuri alongside it. This should prevent the majority of attacks on your site.<\/p>\n\n\n\n
SiteLock<\/a><\/h3>\n\n\n\n
![\"Malware](\"https:\/\/wpengine.com\/wp-content\/uploads\/2018\/07\/malware-resource5.png\")
<\/figure>\n\n\n\nMuch like Sucuri, SiteLock<\/a> is a suite of security software solutions that incorporates malware removal<\/a>. In fact, its lowest-tier plan is essentially an automated malware removal tool, backed up by a few other features.<\/p>\n\n\n\n
SiteLock isn\u2019t free, and you arguably get less features for your money than with Sucuri. Both are worth recommending, however, and you\u2019ll want to compare them to determine which is best for your needs.<\/p>\n\n\n\n
Incapsula<\/a><\/h3>\n\n\n\n
![\"Wordpress](\"https:\/\/wpengine.com\/wp-content\/uploads\/2018\/07\/malware-resource6.png\")
<\/figure>\n\n\n\nFinally, we have Incapsula<\/a>. This service is similar to CloudFlare, since it offers a CDN along with supporting tools and features.<\/p>\n\n\n\n
There\u2019s also a full-featured security package<\/a>, with a backdoor malware shell detector<\/a>. Plus, you\u2019ll get a Web Application Firewall (WAF)<\/a> to help protect your site. However, this solution arguably has the highest price for the least features. As with SiteLock, you\u2019ll need to determine whether the cost per feature suits your needs and budget.<\/p>\n\n\n\n
Get Support for More Common WordPress Questions from WP Engine<\/h2>\n\n\n\n
If you\u2019re unfortunate enough to have to deal with malware, you\u2019ll want to know that your WordPress hosting<\/a> provider has your back. A secure WordPress host<\/a> with stellar support (such as WP Engine<\/a>) is invaluable if your site is ever attacked. If your site is ever affected by malware, we will perform and deep-level scan and malware cleaning to help you get back up and running. Check out our managed hosting plans<\/a>!<\/p>\n\n\n\n
- Trojans<\/strong>: This malware type is often disguised as legitimate software, or are included in compromised programs. Trojan horses help other malware access and infect your system.<\/li>\n\n\n\n