Knowing how to backup WordPress before malware cleanup can prevent data loss, preserve evidence, and make recovery far safer.
The right backup strategy lets you clean infections without accidentally deleting content, settings, or clues that explain how the site was compromised.
Why a Pre-Cleanup Backup Matters
When a WordPress site is infected, the instinct is often to remove suspicious files immediately.
That can be risky because malware cleanup may also remove legitimate code, customized theme changes, uploads, or database records needed to rebuild the site correctly.
A pre-cleanup backup serves three purposes:
- Recovery: You can roll back if cleanup breaks the site.
- Forensics: You preserve infected files for analysis by a security professional or incident response team.
- Verification: You keep a snapshot of the site before changes, which helps compare what was modified.
This is especially important for business sites, WooCommerce stores, membership sites, and any WordPress installation with custom plugins, custom post types, or frequent database updates.
What to Back Up Before Malware Cleanup
A complete WordPress backup has two core parts: files and database.
For malware recovery, you should capture both, along with any server-side configuration that affects the site.
Files to include
- WordPress core files: The root installation, including wp-admin, wp-includes, and main PHP files.
- wp-content: Themes, plugins, uploads, mu-plugins, and any custom code.
- Configuration files: wp-config.php, .htaccess, nginx rules if accessible, and any security or caching configuration.
- Hidden files: Dotfiles and environment files that may contain important settings.
Database to include
- Posts and pages: Published content, drafts, revisions, menus, and attachments metadata.
- Users and roles: Admin accounts, editor accounts, and suspicious unauthorized users.
- Plugin settings: Security plugins, SEO plugins, forms, and ecommerce configuration.
- Logs or custom tables: If your plugins store operational data in the database, export those tables as well.
How to Backup WordPress Before Malware Cleanup Safely
If malware is active, use a method that minimizes site changes.
The goal is to capture the site exactly as it exists before cleanup, while avoiding unnecessary interaction that could trigger more damage.
1. Put the site in maintenance mode if possible
If the site is still functioning and you have access, place it in maintenance mode or restrict public access.
This reduces the chance of new orders, comments, user registrations, or infected content being added while you work.
2. Copy files through hosting tools or SFTP
Use your hosting control panel, SSH, or SFTP to copy the full site directory to a secure local location or isolated storage.
Avoid editing infected files during the backup process.
If available, create an archive from the server side so file permissions and timestamps are preserved.
3. Export the database separately
Use phpMyAdmin, Adminer, a hosting backup tool, or the command line to export the database as a SQL file.
A database dump is usually safer than trying to clean the database first, because it preserves the compromised state for later review.
4. Store the backup outside the compromised environment
Do not leave the only copy on the same hosting account or server if the compromise may have affected broader access.
Save copies to a trusted local machine, encrypted external drive, or secure cloud storage with versioning.
5. Verify the backup
Check that the archive opens, the SQL file is complete, and the file structure looks normal.
A backup that cannot be restored is not useful during an incident.
Best Tools for WordPress Backup During a Malware Incident
The right tool depends on the level of access you still have.
In an active malware case, reliability matters more than convenience.
- Hosting backups: Many managed WordPress hosts such as SiteGround, Kinsta, WP Engine, and Bluehost provide snapshot-style backups.
- Backup plugins: Plugins like UpdraftPlus, BlogVault, and Duplicator can create archives, though they may be less ideal if the admin area is unstable.
- Server-level backups: cPanel backups, JetBackup, or provider snapshots are often faster and less affected by the infected WordPress admin.
- Manual exports: FTP or SFTP for files plus database export gives the most control when plugin access is unreliable.
If the infection may have compromised WordPress admin access, avoid relying only on a plugin installed inside the site.
Prefer host-level or server-level methods when possible.
What Not to Do Before You Have a Backup
Several common actions can destroy evidence or make restoration harder.
Before you begin malware cleanup, avoid these mistakes:
- Deleting suspicious plugins or themes without saving copies first.
- Running automated “cleanup” tools before preserving the infected state.
- Resetting passwords only after cleanup without checking for unauthorized admin users.
- Overwriting files with a fresh WordPress install before backing up wp-content and the database.
- Restoring from an old backup that may already contain the infection.
If you suspect file tampering, note file names, modified timestamps, and unusual user activity before changing anything.
How to Tell Whether Your Backup Is Good Enough
A good pre-cleanup backup should let you rebuild the site exactly as it was at the time of compromise.
Use this checklist to confirm completeness:
- All site files were captured, including wp-content and configuration files.
- The database export completed without errors.
- You know the backup date and time.
- The archive is stored somewhere safe and separate from the infected server.
- You can identify which copy is the pre-cleanup version and which copy is the cleaned version later.
If the backup process failed partway through, create another copy before moving forward.
Partial backups are especially risky during malware recovery because hidden threats may remain in the sections you missed.
How to Prepare for Cleanup After the Backup
Once you have a verified copy, you can move into malware cleanup with much less risk.
At that point, secure the site by changing passwords, reviewing admin users, and scanning files and the database for unauthorized changes.
Useful next steps include:
- Updating all WordPress core, theme, and plugin versions after assessing compatibility.
- Checking wp-config.php for unexpected code or database changes.
- Reviewing recent uploads, especially PHP files in the uploads directory.
- Auditing cron jobs, redirect rules, and rogue .htaccess entries.
- Scanning the database for injected scripts, malicious iframes, or spam links.
Keeping the pre-cleanup backup intact gives you a safe fallback if the first cleanup attempt removes valid content or misses part of the infection.
When to Use Professional Help
Some infections are too complex for a straightforward DIY cleanup.
Consider a WordPress security specialist if the site has repeated reinfection, hidden admin accounts, obfuscated PHP, database backdoors, or evidence of server-level compromise.
Professional incident response teams often preserve the evidence, analyze the infection path, and restore the site with less downtime.
That approach is especially valuable for ecommerce, healthcare, finance, or any site with sensitive user data.
Quick Backup Checklist Before Malware Cleanup
- Freeze public changes if possible.
- Copy all WordPress files, especially wp-content and config files.
- Export the full database.
- Store copies outside the compromised server.
- Verify the archive and SQL export.
- Record the backup time and location.
- Only then begin malware cleanup.
If you follow that sequence, you dramatically reduce the chance of losing content, hiding the root cause, or making recovery more difficult than it needs to be.