How to Use Solid Security After Malware Infection Cleanup
Recovering a WordPress site after malware is only the first step.
Knowing how to use Solid Security after malware helps you verify the cleanup, close the entry point, and strengthen the site before attackers return.
Solid Security, formerly iThemes Security, is designed to reduce risk through hardening, login protection, file change detection, and audit logging.
Used correctly after an incident, it becomes part of a practical recovery workflow rather than just another plugin.
Start with a clean baseline
Before changing settings, make sure the site has been cleaned by a trusted process.
If you removed malware manually or with a security service, confirm that suspicious files, injected code, rogue admin accounts, and hidden cron jobs are gone.
- Restore core WordPress files from a known-good source if needed.
- Replace compromised plugins and themes with fresh copies from the vendor.
- Review the database for injected scripts, spam links, and unfamiliar users.
- Rotate passwords for WordPress, hosting, SFTP, database, and email accounts.
Once the cleanup is complete, install or activate Solid Security and treat the site as if it were newly exposed.
Run the security setup immediately
The first thing to do in Solid Security is complete the setup wizard and apply the recommended defaults.
This gives you a consistent starting point and helps ensure that core protections are enabled instead of relying on manual memory.
Focus on these early tasks:
- Enable security hardening recommendations.
- Turn on two-factor authentication for administrators and other privileged users.
- Configure strong password requirements for all accounts.
- Review user roles and remove any account that does not need access.
If the site was compromised through stolen credentials, two-factor authentication is one of the most important controls you can add right away.
Use file change detection to spot leftovers
File change detection is useful after malware because attackers often leave backdoors in themes, mu-plugins, upload folders, or custom directories.
Solid Security can alert you when files change unexpectedly, which helps you find suspicious modifications faster.
After cleanup, compare the alerts against known site activity.
A plugin update or theme edit may be legitimate, but a new PHP file in an upload directory often deserves immediate review.
- Monitor WordPress core files, plugins, and themes.
- Watch for changes in unusual locations such as
/wp-content/uploads/. - Investigate files with recent timestamps that do not match deployment activity.
- Remove anything that looks encoded, obfuscated, or unrelated to the site.
This feature is especially valuable during the first days after recovery, when hidden persistence mechanisms are most likely to reveal themselves.
Lock down login access
Most malware incidents begin with weak passwords, brute force attacks, phishing, or stolen credentials.
Solid Security helps reduce repeat compromise by making login abuse much harder.
Enable two-factor authentication
Require two-factor authentication for all accounts that can install plugins, edit themes, manage users, or access sensitive content.
Even if a password is exposed, the attacker still needs the second factor.
Limit login attempts
Brute force attacks often continue after cleanup, especially if the attacker knows the site is valuable.
Configure login protection so repeated failures trigger temporary lockouts or increased friction.
Use reCAPTCHA or similar challenge tools
If the site receives automated login or registration abuse, challenge tools can reduce noise and protect system resources.
This is particularly useful for membership sites, stores, and blogs with open registration.
Audit users and permissions
After a malware event, user review is just as important as plugin scanning.
Attackers frequently create hidden administrator accounts or elevate existing low-privilege users.
Use Solid Security alongside a manual audit to answer these questions:
- Which users have administrator access?
- Are there inactive accounts that should be deleted?
- Did any account role change unexpectedly?
- Are email addresses and usernames recognized by the site owner?
Remove accounts that do not need elevated privileges, and set the minimum role required for each person.
If a contractor, editor, or developer no longer needs access, delete the account rather than leaving it dormant.
Review audit logs for signs of persistence
Audit logs help you reconstruct what happened before, during, and after an infection.
Solid Security can record events such as login attempts, file changes, user creation, and settings updates, which gives you evidence for incident response.
Look for patterns like:
- Successful logins from unfamiliar IP addresses.
- Repeated failed logins followed by a success.
- Plugin installation or activation outside normal change windows.
- New users created shortly before suspicious file changes.
When possible, compare the log timeline with hosting logs, email alerts, and backup timestamps.
Correlating those sources can reveal the original access point, whether it was a vulnerable plugin, a reused password, or a compromised admin inbox.
Harden WordPress settings that attackers target
Solid Security includes hardening controls that reduce common attack surfaces.
After malware removal, these controls matter because they close shortcuts that attackers often use on infected sites.
- Disable file editing in the WordPress dashboard.
- Protect sensitive files such as
wp-config.php. - Hide login and administration paths if appropriate for your workflow.
- Reduce information leakage from author archives, XML-RPC, or REST endpoints when those features are not needed.
Not every hardening feature is right for every site, especially if you use mobile apps, external publishing tools, or integrations.
Test each change before rolling it out broadly.
Set up alerts you will actually read
Security tools only help if you see their warnings in time.
Configure Solid Security notifications so important events reach the right people through email or another reliable channel.
Prioritize alerts for:
- New admin account creation.
- Multiple failed login attempts.
- File modifications in sensitive directories.
- Critical settings changes.
Avoid alert fatigue by limiting low-value notifications.
After an infection, the goal is timely detection of meaningful events, not a cluttered inbox that gets ignored.
Combine Solid Security with backup and recovery practices
Security plugins are strongest when paired with good backup hygiene.
If malware returns, recent backups let you restore quickly without rebuilding the site from scratch.
Use a backup strategy that includes:
- Off-site storage separate from the web server.
- Multiple restore points spanning several days or weeks.
- Regular test restores to confirm the backup is usable.
- Versioning for both files and the database.
If your backup system stores infected copies, restoration can reintroduce the problem.
Keep at least one known-clean backup from before the compromise, and verify it against the timeline of the incident.
Perform a post-cleanup validation check
After configuring Solid Security, validate the site as if you were an attacker looking for weak points.
This final review helps you confirm that the recovery is complete and the protections are active.
- Attempt a login with a test account and verify two-factor authentication works.
- Confirm unnecessary accounts are removed.
- Check that file change alerts trigger when expected.
- Review the firewall, login protection, and hardening settings one more time.
- Make sure plugin, theme, and WordPress updates are current.
A careful validation pass is what turns cleanup into real recovery.
It reduces the odds that a hidden backdoor, stolen credential, or weak configuration will undo the work you already completed.
Keep the site monitored after the incident
Using Solid Security after malware is not a one-time task.
The best results come from ongoing monitoring, regular updates, and periodic permission reviews.
For the first several weeks after recovery, watch the site more closely than usual.
Attackers often return to recently compromised targets, and a consistent monitoring routine gives you a better chance of catching early warning signs before the next outbreak spreads.