Free malware scan/clean

Yes, the scan from Wordfence (free) can help you identify and remove some bad stuff, as can other plugins. However, we recommend doing that as well as taking the manual route:

Get a fresh cup of coffee, take a deep breath and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures

https://www.ads-software.com/support/article/faq-my-site-was-hacked/

https://www.ads-software.com/support/article/hardening-wordpress/

If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

Thanksm, I will ployugh through it.

My hosting provider meanwhile says the opnly way to clean the site is to restore a clean backup. Is this correct?

That’s one way. See links above.

Will do. I raised the issue with Malcare, as I have a premoum version, and they say they have now removed the infectionsd and amended their plugin to make sure they are noit missed again.

Do I stillneed to follow the above guide?

According to https://sitecheck.sucuri.net/results/www.andrewstucken.com, your site is hacked and serving malware. So, yes, you need to de-louse it.

@steven Stearn I can’t see a way to DM users so I hope it’s Ok to post this here:

Would it be possible to anonymise my site’s name [that contains my actual name [in the link you posted in your above post]? It’s for privacy reasons, happy to explain more back channel if you like…

@androidandreas Your website is still infected with SEO spam as you can see in this screenshot https://snipboard.io/MJ8CiY.jpg . You may need to search your db/files for it first hopefully you can find and remove it and it may be encoded or hidden somewhere else in any files or any db entries. so a full check may be needed.

Thanks @moe, I am aware there are nearly 1500 infections and have submitted the data to Malcare, with who I \ahve a premium subscruption.

The alert I received )from anoyther plugin, Wordfence) shows the infwections to be in subfolder called wp-content/updraft/themes-old/

I am waiting on a res[ponse form Malcare but was wondering (a) if Wodpress by defualt stores deeleted them and plugins on folders qwith names like “tehmes-old” or “plugins-old” or whether I may have created these myself.

Either way, is it safde to deleet these folders as the data appears to be of no use whatsoever and is obviosly just presetng aqn easy target for hackers.

The old folder updraft/themes-old/ is associated with your updraft plugin. Check the exact malware warning or check the content of this folder as it may contain malicious/suspicious files.

That’s interesting…I do not have a plugin called Updraft installed, nor do I ever remeber having one.

Maybe it was used previously by you or your developer/webmaster. If you have other valid backups for your site then you can safely remove this folder if you want.