When I delete plugins via ftp (meaning all its files recursively) does WordPress remove its settings from the database?

I want to delete all plugins on one of my websites and reinstall them, since I suspect it to be infected with a virus. However, I want the plugins options to be kept if possible.

up vote 5 down vote accepted

Deleting the plugins' files (as opposed to deleting via deactivate and delete) will not affect settings. The plugin's deactivation/deletion code (if any, not all have that) might clear out the plugin's options. But most plugins will keep the options in case you want to reinstall things.

So, deleting via FTP, will not affect the plugins' options.

But if you think that you have an infected site, there is more to do than just deleting and reinstalling plugin files (via FTP or whatever), although that is certainly a good start.

A proper cleanup process will reinstall/update everything (WP core, plugins, themes). And manually looking for files that shouldn't belong. I've created a process I use (there are many similar info to be found via the googles). I've used it to successfully clean infected sites. It takes a bit of work, but a cleanup can be done. My process is here: https://securitydawg.com/recovering-from-a-hacked-wordpress-site/ .

You have to make sure that you 'look' everywhere. And change credentials everywhere. And use strong passwords. Not just reinstalling plugin files.

WordPress doesn't know which option comes from which plugin. So WP itself is unable to delete settings of deleted plugins.

If you delete a plugin using FTP, then it has no chance to do anything with DB - so all its settings stay in there.

But if there is a malware/virus involved... I would advice to do it this way:

  1. Block the site with htaccess, so WP won't work.
  2. Delete plugin files using FTP.
  3. Upload original plugins using FTP.
  4. Unblock WP.

PS. You should also take care of theme files, WP core files, uploads, and DB.

While Rick Hellewell and Krzysiek Dróżdż already gave a very correct answer I'd like to add that some plugins have cleanup/reset script upon activation (even though this isn't in alignment with WP code standards).

I'd advice to create a DB backup to be sure. If anything breaks you could still fix it manually.

They usually do. but mind you tha reinstall the may restastrt some of these values. To avoid that, don´t use the wordpress installer, and upload them via ftp instead. Also I would download all plugins and scan them with an antivirus first (Avast detects most php malicius scripts)

  • Well, Avast (and other anit-virus software) doesn't detect most PHP malicious scripts - it detects just few of them...) Such programs are not designed to detect PHP malicious code, but to protect your desktop. – Krzysiek Dróżdż Sep 27 at 21:20

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.