If your WordPress site was hacked, the first thing most people do is panic, then sigh in relief: “Ah, at least I have a backup.”
But here’s the catch: not all backups are created equal. Some can be just as compromised as the site you’re trying to save.
Let’s look at how to tell if your backup is actually safe and what to do if you’re not sure.
Why a hacked backup is a real problem
A backup is only useful if it’s clean. Restoring a compromised backup can:
- Reintroduce malware or backdoors
- Reinstate modified spam content
- Cause repeated reinfections
- Waste your time and money
So assuming your backup is automatically safe can turn a fix into a nightmare.
Common ways backups get infected
Even if you’re diligent, backups can still be compromised in several ways:
- Backing up an already infected site
If malware is hiding in core files or plugins, a full backup captures it too. - Database infections
Hacks can leave hidden scripts or rogue admin accounts in your database, which get restored along with the site. - Backup tools that don’t scan
Some plugins simply copy files without checking for malicious code. - Old backups
Malware evolves. A backup from a few months ago might be clean, or it might contain undetected scripts that have lingered for ages.
How to check if your backup is safe
While no method is 100% foolproof without expert review, you can reduce risk by:
- Scanning the backup: Use malware scanning tools on the backup files before restoring. Wordfence, Sucuri, or manual virus scanners can help.
- Inspecting the database: Look for unknown admin users, strange tables, or suspicious scripts.
- Checking plugin and theme files: Ensure versions are current and from trusted sources.
- Testing in a safe environment: Restore the backup on a staging or local environment first, not directly to your live site.
When to consider a fresh rebuild
Sometimes the backup isn’t trustworthy, and cleaning it could take longer than starting fresh. Signs you might need to rebuild include:
- Multiple previous hacks
- No clear “clean” backup exists
- Infection in core files, themes, and the database
- Business-critical site where downtime must be minimised
A rebuild isn’t always fun, but it ensures you’re not repeatedly reintroducing the same vulnerabilities.
Best practices for future backups
To avoid uncertainty in the future:
- Keep multiple backups, separated by date and storage location
- Use reputable backup tools with integrity checks
- Store backups offline or in a secure cloud service
- Test restoring backups periodically
- Keep WordPress, plugins, and themes up to date
This way, the next time a hack occurs, you’ll have a clean copy you can trust.
Bottom line
A backup is only as safe as the site and process that created it. Never assume it’s clean. Always scan, inspect, and test before restoring.
When in doubt, it’s safer to review the backup with an expert or consider rebuilding rather than risk reinfection.
After all, the whole point of a backup is peace of mind—not a recurring panic.