My site has hacked three times, and as forced by host provider, now there is no option in front of me, except restoring a healthy backup for around 3 weeks ago. (Hacker had created a backdoor in my site, and was using my site for sending mass spam emails, and i couldn't find that backdoor. I could only remove bad files which was uploaded by hacker).

Before restoring that old backup (for 3 weeks ago), what i must to backup - or download- to add posts created during these 3 weeks. I mean, if restore backup of 3 weeks ago, i lose all posts created during this 3 weeks. what must i do to get my site to current state with all posts, pictures, ...

Thanks in advance (and sorry for bad english)


To backup only posts,pages and related media files for 3 week.

You need to do the following:-

  1. Backup Database of website for post/page text.
  2. Backup wp-content\uploads folder for media.

Then you can delete all files and restore old files.Once all old files uploaded then you can upload wp-content\uploads folder of current site.

PS: check uploads and folders in it for any backdoor code.


Once restoration is done install Anti-Malware WordPress plugin and scan for any malware files in them. It is better plugin.

| improve this answer | |
  • Thanks. I need subfolders of Uploads folder for current and last month OR all of uploads folder? also, in uploads folder, I should check php files or picture files may be malicous, too. (I faced another qusetion. Do we have wp-xmlrpc.php in wordpress? it sounds a suspicious file!!!) – ALalavi Sep 11 '14 at 19:49
  • You are welcome.Yes,only current and last month sub folder. PHP files should not be in uploads folder. xmlrpc.php is a WordPress core file. wp-xmlrpc.php is not. – Gyanendra Giri Sep 11 '14 at 19:54
  • wp-xmlrpc.php may be virus file. – Gyanendra Giri Sep 11 '14 at 20:01
  • I uploaded above file to speedy.sh/UYkaK/wp-xmlrpc.php – ALalavi Sep 11 '14 at 20:17
  • Yes.it is a malware file.you can delete it. – Gyanendra Giri Sep 11 '14 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.