1

I have a client whose site was broken by a plugin and instead of deactivating plugins, they deleted some kind of 'visual editor' plugin.

We managed to get the site back up and running and updated all the plugins.

HOWEVER - they don't remember the plugin for the visual editor.

Is there any place in the security logs or someplace where we can identify what the plugins WERE before they deleted them.

Does anyone know a way to check the logs so we can identify the name of the plugin my client deleted?

Thanks!

4
  • 2
    I would search the wp-options table for meta_key values that were left behind. They may betray what plugin they came from.
    – Jos
    Jan 19 '19 at 23:18
  • You could check the post contents. If there were shortcodes left behind by the visual editor this could give you a clue as to which visual editor was used.
    – admcfajn
    Jan 20 '19 at 0:43
  • 1
    Most hosting companies have backups, you could look in the plugins folder of a backup Jan 20 '19 at 5:39
  • You might be able to determine this from the server access logs, I think WP includes the list of plugins to delete in the request URL.
    – J.D.
    Jan 22 '19 at 17:09
0

I know this is a bit late so I am going to post my answer for people who might encounter the same scenario. There are few things that you can do:

Option 1: Request a backup of your website from hosting company and then compare live version with that backup (as suggested by @RiddleMeThis)

Option 2: You can you check meta_key column of wp-options table to see if there are any unused meta_key entries (as suggested by @Jos) but if the website has changed a lot in the past then you may get false positives with a never ending search.

Option 3: Check your server access logs (as suggested by @J.D.) for those specific dates you may find a link similar to this :

http://your-wp-site.com/wp-admin/plugins.php?action=delete-selected&checked%5B0%5D=akismet%2Fakismet.php&plugin_status=all&paged=1&s&_wpnonce=4d4ca3d352

note that checked parameter it contains the name of the plugin that is requested to be deleted.

Option 4: If you suspect it was a visual editor plugin then you should look for left over shortcodes used commonly used by these kind of page editors this will give a hint about the plugin that was installed. If it was not page editor plugin then you may still find broken shortcode left over (only if this plugin was providing any shortcode)

Option 5: Some complex plugins make new custom tables in your database which are not deleted even after uninstalling the plugin. There you can check for tables that are not currently available in your plugin list.

My suggestion would be to get the backup from hosting company and compare your plugin list with that backup.

Best of luck.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.