A couple months back, I installed UpdraftPlus (free version) on my WordPress.org site. To my horror, immediately afterwards we started getting popups that would redirect to spam sites when you clicked 'Ok'.

I uninstalled UpdraftPlus but the problem persisted. Google yielded a link to someone with a very similar problem - a reply told me where to find any extra files which may have been leftover. Sure enough, in that location I found some UpdraftPlus German language files remaining. As soon as I deleted these, the popups disappeared.

Now I'm in need of a WP backup, but I'm too scared to install another plugin. I'd really like to use UpdraftPlus because it's highly reviewed (and free), but I don't want to go through possible malware issues again.

Has anyone ever encountered this? Any ideas as to what could have happened and what I can do in the future to stay safe? Our WordPress, as well as most of our plugins, need to be updated to the latest versions. So we probably aren't as safe as we could be. But it's best practice to have backups before you update, so I feel I'm in a catch 22.

closed as off-topic by Mark Kaplun, Jack Johansson, cjbj, Max Yudin, Howdy_McGee Sep 12 '17 at 15:34

This question appears to be off-topic. The users who voted to close gave these specific reasons:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I'm not sure about the UpdraftPlus because I nerver use it. About the second part of you question, If you use a VPS/Server, a simple bash script can help you backup without any plugin, and sure, without any malware. – Tung Du Jul 12 '17 at 15:40

It can be time-consuming to 'clean' a WP site, but it can be done with dogged determination. You'll need to reinstall WP/plugins/themes, change hosting and FTP and database credentials, look for rouge files, and more.

This might help http://securitydawg.com/recovering-from-a-hacked-wordpress-site/ (disclosure: I wrote this after people kept asking me about this; it's sort of notes to myself).

You should be able to back up your site through your hosting control panel. This is a better option than adding bloat to your WP install to duplicate functionality you already have elsewhere.

Not the answer you're looking for? Browse other questions tagged or ask your own question.