Skip to content

Malware

Findings and quarantine

Pro and AgencyAbout Malware Scanning

What to do with each scan finding: look at the file, move it safely out of the way, restore an original WordPress file, delete it, or mark it as harmless.

What it does

Findings sit in three lists: Open (needs a decision), Quarantined (moved to a safe folder) and Ignored (marked as harmless).

Quarantine moves the file into a locked folder where it cannot run, and remembers where it came from so you can put it back.

Restore original replaces a changed WordPress core file with the official copy for your version.

Delete removes the file for good. Ignore hides the finding for that exact file content.

Why it matters

Deleting a file you do not understand can break a site. Quarantine is the safe middle ground: the threat stops running, and you can undo it if the file turns out to be needed.

Handle a finding

  1. Take a backup of the site.
  2. On the Malware tab, open a finding and click View file to see where the match is.
  3. For a WordPress core file, use Restore original. For anything else you do not recognise, use Quarantine.
  4. Check the site still works. If something broke, open the Quarantine vault in section Response and restore the file.
  5. If a finding is a harmless file you trust, click Ignore.

Good to know

If an ignored file changes later, it is reported again.

Files WordPress cannot run without, such as wp-config.php, index.php, wp-load.php, wp-settings.php and .htaccess, are never moved or deleted. Clean those by hand or ask your host.

Finding malware means someone got in. After cleaning, change passwords, rotate the security keys and update everything.

Which plan includes it

Viewing and ignoring findings is in every plan. Quarantine, Delete and Restore original are part of Pro.

How it works, for developers
  • Quarantine folder: wp-content/stack-guard-quarantine/, with deny rules rewritten on every use. Files are renamed to .quarantine with a .meta file holding the original path. Restore refuses if a file already exists there.
  • Restore original downloads the file from core.svn.wordpress.org for your version, keeping the current file in the quarantine folder as a backup.
  • Ignore stores the file's MD5 hash with the finding; a different hash is a new finding.
  • Delete also refuses anything inside wp-admin and wp-includes. Findings live in the smg_malware_issues table.

Quick answers about findings and quarantine

What does Findings and quarantine do in Stack Guard?

Findings sit in three lists: Open (needs a decision), Quarantined (moved to a safe folder) and Ignored (marked as harmless). Quarantine moves the file into a locked folder where it cannot run, and remembers where it came from so you can put it back. Restore original replaces a changed WordPress core file with the official copy for your version. Delete removes the file for good. Ignore hides the finding for that exact file content.

Why use findings and quarantine on a WordPress site?

Deleting a file you do not understand can break a site. Quarantine is the safe middle ground: the threat stops running, and you can undo it if the file turns out to be needed.

How do I set up findings and quarantine?

1. Take a backup of the site. 2. On the Malware tab, open a finding and click View file to see where the match is. 3. For a WordPress core file, use Restore original. For anything else you do not recognise, use Quarantine. 4. Check the site still works. If something broke, open the Quarantine vault in section Response and restore the file. 5. If a finding is a harmless file you trust, click Ignore.

Which Stack Guard plan includes findings and quarantine?

Viewing and ignoring findings is in every plan. Quarantine, Delete and Restore original are part of Pro.

More in Malware

Not running Stack Guard yet? It is free.

Download Free