There’s been a surge of hacker activity lately leading to malware on WordPress sites. If your are experiencing any of the following issues, then this guide on how to remove malware may help you clean up the damage done to your site and/or server. Please note this guide is written for beginners and the common WordPress use. Therefore, I intentionally do not cover advanced technical trouble-shooting.

What is Malware?

Firstly, we have to understand what the heck malware is – after all, you can’t fight something you can’t define. So let’s go with the definition given to us by Wikipedia:

Malware, short for malicious software, consists of programming (code, scripts, active content, and other software) that is designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, or gain unauthorized access to system resources, or that otherwise exhibits abusive behavior.

Now we know that malware is essentially code that somehow got onto your site or server. The first step is figuring out whether your site actually has malware. Here are some common symptoms of malware on WordPress sites:

This guide consists of the following sections so that you can follow along step-by-step:

1. Determine If Site is Infected with Malware
2. Backup current site (as-is)
3. Review and remove erroneous files
4. Timthumb Notes
5. Update WordPress files
6. Update wp-config.php file
7. Update / Remove Themes and Plugins
8. Update Usernames and Passwords
9. Clear Browser and Site Cache
10. Re-Scan Site for Malware
11. Conclusion

The guide assumes the following:

• you wish to avoid starting your site fresh, in which case, you could simply delete the entire site and wordpress database and start over without completing any of these steps.
• you wish to restore your site to its pre-infected state.

Let’s begin…

A few hours ago I moved a site from HostGator’s shared hosting to their VPS server offering. While the process could have been much smoother, it had several bumps along the way. None more annoying than the following error when attempting to upload images or media on a post within WordPress:

The uploaded file could not be moved to /var/www/vhosts/yourdomainname.com/httpdocs/wp-content/uploads/2011/11.

In short, WordPress could not upload the image file. This is the last thing one would want to deal with when migrating a site. However, it is clearly a permissions issue and needs to be resolved on the server. Since most people are not server administrators, and neither am I, here are all the solutions I researched throughout the web in order from easiest to most difficult. Hopefully, one of these hacks will work for you.

Set the Default Folder for Uploads in WordPress

1) Login to WordPress and go to Settings > Media.

2) For the input labeled: Store uploads in this folder, specify the following as the value if it is blank:

wp-content/uploads

3) Save changes and test your ability to upload images. If you still have issues, move on to the next solution.

Changing Folder Permissions via FTP

On most VPS servers, you have to set permissions and ownership. Said differently, if you have the ability to set permissions but you are not the owner, then you will not be able to move or copy files into that folder.

WordPress tries to move uploads to the designated folder. However, if it does not have permission to do so, that would result in an error. It will only succeed if your write permissions are valid. Therefore, make sure your write permissions are correctly set and that you own the /uploads folder. Your FTP client displays the owner of the folder and is usually the username connected to the ftp server.

Below are instructions on how to change folder permissions via FTP:

1) FTP to your server, and navigate to the wp-content/uploads directory.

2) There, change the permissions of the /uploads directory to 777 (i.e., chmod to 777). In most FTP clients, you can right-click on the folder to get to the screen that allows you to change the folder permissions. If it asks you whether you would like to apply changes recursively, enable that as well.

3) Check WordPress by adding a new post and uploading an image. If it works, move on to the next step. If it doesn’t, then move on to the next solution.

4) If the previous step worked, now we’ll go back and change the permission of the /uploads folder to 755 (apply changes recursively). We’re doing this to avoid having a write-able (777) folder which is a security vulnerability.

NOTE: Do not leave your permission set at 777 – it exposes your site to hackers.

5) Check WordPress by adding a new post and uploading an image. If it works, then your issue is resolved. If it doesn’t, then move on to the next solution.

Changing Folder Permissions via Hosting Control Panel

Sometimes, the FTP user does not have the same privileges as the account owner. To ensure that changing folder permissions isn’t the solution, try logging into your host’s control panel and check the folder permissions from the File Manager. If they are correct, then move on to the next step. If is is not correct, edit the folder permission there and re-test the upload function through WordPress.

Creating a New Uploads Folder

1) FTP to your server, and navigate to the wp-content/uploads directory.

2) Rename the uploads directory to uploads-old.

3) Now, create a new folder named uploads. Change its permissions to 755.

4) Copy all sub-folders and files from the /uploads-old directory to the new /uploads directory.

5) Check WordPress by adding a new post and uploading an image. If it works, then your issue is resolved. If it doesn’t, then move on to the next solution.

Turn Off PHP Safe Mode

For some folks, turning off PHP Safe Mode may be the solution to this issue. However, not all users will be able to do this as many hosts restrict access or edit privileges to this file.

1) Navigate to your server

2) Locate the php.ini file. It is usually in your /etc directory from the root.

3) Open php.ini in a text editor and change the PHP Safe Mode value (if it exists):

On

to this:

Off

4) If the line does not exist, then add it.

5) Test your upload capabilities in WordPress.

Other Solutions

There are other potential solutions available however they are far more technical and require understanding of critical server files. Therefore, in the interest of preventing you from causing damage to your site and server, I won’t go into those here. At this point, if you are still having the issue, contact your host and have them resolve it.

Conclusion

I hope this was useful for folks having this image upload issue. Please let me know which solution worked for you in the comments below.