🚨 Use UpdraftPlus? Please check your site today!!

Hey Reader,

I wanted to send you a quick heads-up because this one is important.

If you use UpdraftPlus to back up your WordPress site, please set aside five minutes today to check it. I’ve already checked all my and my clients' sites, so I’ll walk you through exactly what to look for.

What happened?

Over the weekend of 17 to 18 October, hackers broke into the website of TeamUpdraft, the company behind UpdraftPlus. They got hold of the keys for UpdraftCentral, a remote management feature built into the plugin. Then they used those keys to quietly install hidden “backdoor” plugins on WordPress sites.

The tricky part? Your site could be connected to UpdraftCentral even if you’ve never used it. If you ever logged in to your TeamUpdraft account from inside the plugin, a box that’s ticked by default may have connected your site without you noticing.

Your backups themselves are fine, and TeamUpdraft has now released a fix. Here’s what to do.

Step 1: Update UpdraftPlus

Go to Plugins and make sure UpdraftPlus is on version 1.26.13 (or 2.26.13 if you have Premium) or newer. This update switches off the old, stolen connections.

Step 2: Check for UpdraftCentral keys

Go to UpdraftPlus, click the Advanced Tools tab, then choose UpdraftCentral from the menu on the left.

If it says “There are no UpdraftCentral dashboards that can currently control this site”, you’re fine.

If you see any keys listed, delete every one of them. Your backups will keep working. Only the remote management feature stops, and you almost certainly don’t need it.

Step 3: Look for anything strange

⚠️ Important: If you spot something odd here, don’t click, delete or deactivate anything yet. Just make a note of it and keep reading. I’ll show you exactly what to do below.

Plugins: Is there anything you don’t remember installing? Check the deactivated ones too. Many of the fake plugins are called “Site Health Cache”. They all have this description: “Small maintenance toolkit: keeps option storage tidy.”
Users: Is there anyone you don’t recognise? Pay special attention to Editors, because the fake account hides there.
Errors: Has your site shown a white screen or an error page since last weekend?

If everything looks normal, you’re all done! Just check your Plugins and Users again next week to be safe 😊

Step 4: Change your TeamUpdraft password

If you have a teamupdraft.com account, change your password there. Type teamupdraft.com into your browser instead of clicking a link in an email. If you’ve used the same password anywhere else, change it there too. And be careful with any unexpected emails claiming to be from TeamUpdraft.

Found something suspicious?

Don’t panic and start deleting things. Here’s the safe order:

Delete the UpdraftCentral key first, before anything else.
Don’t try to fix or repair the strange plugin. Doing that can actually switch the backdoor on.
The fake user stays on your site even after the plugin is gone, so this needs to be cleaned up properly. You’ll most likely need to restore from a backup made before 17 October and change all your passwords.

Take a deep breath. Here’s the safe way to handle it:

Delete any UpdraftCentral keys (Step 2), if you haven’t already.
Don’t delete the strange plugin and don’t try to fix it. It’s built to cover its tracks when it’s deleted, and “fixing” it can switch it on. Leave it where it is.
Restore a clean backup from before 17 October. You can ask your host to do this for you, or do it yourself with UpdraftPlus (see below).
Change all your passwords once the site is cleaned up: WordPress, hosting and TeamUpdraft.

The fake user doesn’t disappear when the plugin goes, so restoring a clean backup is the best way to get rid of everything at once.

The easiest option: ask your host

Contact your hosting company’s support team and tell them: “I think my site was hit by the UpdraftCentral backdoor attack. Can you help me restore a backup from before 17 October?” Hosts deal with this all the time, and many keep their own backups of your site.

Prefer to do it yourself?

If you have an UpdraftPlus backup from before 17 October, you can restore it yourself. Go to Settings > UpdraftPlus Backups, open the Backup / Restore tab, find a backup dated before 17 October and click Restore. Make sure you tick every part (database, plugins, themes, uploads and others).

A few things to know:

Anything you’ve added since that backup (new posts, comments, orders) will be gone, so make a note of what you’ll need to redo.
After restoring, do Steps 1 and 2 again. The old backup brings back the old version of UpdraftPlus, so update it and check for UpdraftCentral keys again.
Then check your Plugins and Users once more. If the strange plugin or user is still there, stop and contact your host.

If your oldest backup is from after 17 October, don’t restore it. Ask your hosting company instead, as they often keep older copies.

If you’re comfortable with the technical side and want to clean things up yourself, Patchstack has step-by-step instructions for removing the backdoor. You can also read TeamUpdraft’s official update.

Let’s keep your digital home safe ☺️

Monika