Reply to thread

Message: <blockquote data-quote="10xlinks" data-source="post: 29881" data-attributes="member: 12093"><p>A security plugin helps, but after an actual infection I would treat it as one layer, not the fix. Malware in WooCommerce usually gets in through an outdated plugin or theme, a nulled extension, or reused admin passwords, so the scan only tells you something happened. A few things worth doing now: change every password, including hosting, FTP, database and all admin users, and regenerate the salts in wp-config.php. Delete any plugins and themes you are not actively using rather than just deactivating them. Compare your core files against a fresh WordPress download, and check the uploads folder for PHP files, because they should never be there. Also look for admin accounts you did not create. Then set up off-site daily backups so a clean restore point exists next time. Wordfence or Solid Security are both fine for ongoing scans, but a firewall at the host or Cloudflare level stops more junk before WordPress even loads.</p></blockquote><p></p>