How to Migrate Blog Posts (only) from One Server to Another

Question

I have a heavily infected and hacked server. I have setup a new server and created a fresh install of WordPress (fyi...it was a Joomla install on my server that got hacked and took the server down, not WordPress).

So, now that I have a new and fresh install of WordPress on the new server I have a couple questions:

1. if I run a check table query on my current server, would that detect any malicious data in the WP Tables? I know the tables contain just data but I want to be completely sure that I guard against any possible way of transporting the malicious data from my current server to the new server.
2. what WP Tables do I need to move over to the new server now that I already installed a fresh WP copy. I have tweaked the new WP options a bit and all I want to do is move my blog posts and their related data -- nothing else. Which of the following tables should I be moving:

wp_commentmeta wp_comments wp_links wp_options wp_postmeta wp_posts wp_terms wp_term_relationships wp_term_taxonomy wp_usermeta wp_users

Thank you.

Answer 1

Check the header.php, index.php, home.php and footer.php for malicious code. I had that recently few times, so I just deleted it and changed all passwords (panel, WP and database). Just try. If you won't find anything suspect - I'll help to move the blog to another host.

Answer 2

First things first: A check table query will NOT find any malicious code. Please have a look further down on my answer on security.

About transporting ("migrating") your tables:

Since you have already set up a fresh install in a new server, I think that instead of trying to decide which tables to copy over you could use the Wordpress Importer or (to pick the tables you need) WP-DB-Backup or even BackWPup. You could also try a migration plugin like WP Migrate DB (this one works a bit different). In any case I believe you will be better off with any of these plugins since when migrating to another server you will have to change your old to the new URLs and these plugins do this for you. On the other hand if you finally decide to do this manually the Search and Replace plugin will be of great help. You can also use it as a tool for a final check-up. Don't forget to have a read as well at the codex about Moving WordPress.

On Security:

After you have downloaded couple of backups (using different methods) and before completing the migration of the tables you need (or even your whole DB), why don't you try some security tools on your old site (you want to move it anyway) and see what may be wrong there. You can use plugins like: Wordfence Security, WP Security Scan, BulletProof Security, or AntiVirus. Give it a try with this PHP script as well.

Even if they don't find anything to help you much, you will at least know what actions to take when securing your new installation.

In any case I think that reading the codex, My site was hacked and Hardening WordPress is a must.

You can now "safer" decide on how to do the migration. Let us know how it goes.