Moatline

WordPress files deleted: how we rebuilt a site from its database

In October 2026 a small wellness clinic’s WordPress site lost every file: WordPress, the theme, the plugins and all the images. There was no backup. What survived was a database export and an error log. That turned out to be enough to bring the whole site back, and to find the malware that had been living in it.

By the Moatline team at Next Nova Technologies · Published 29 October 2026 · 5 min read

Worried your site is affected?See what your visitors and Google see. Free, no sign-up, about 20 seconds.
Check my site free

When a site’s files are wiped, by an attacker, a host’s malware clean-up or a mistake, it is tempting to start again from scratch. Check what is left first. On this site, phpMyAdmin still had the database, and an export of it was the most valuable thing we had.

What the database still had

  • All the content: 15 pages, 19 blog posts, the menus and six saved page-builder templates, including every page’s full Elementor layout.
  • The settings: the site title and addresses, permalinks, SEO plugin settings and redirects, review widgets and the email settings.
  • The theme’s options: colors, fonts, header layout, logo and favicon, stored in one database row.
  • A list of every image: 216 uploaded images, each with the address of the file and of all its smaller sizes (760 files in all).

What was gone: WordPress itself, the theme, the plugins and the uploaded images. The first three can be downloaded again. The images needed another source.

Clean the database first

The files didn’t disappear by accident, so we looked for what the attackers left in the database before using it. We imported the export into a test database and found:

  • A fake plugin still switched on. The list of active plugins included one called advanced-cache-booster-4b5f, a name pattern used by malware that poses as a caching plugin. The list had been edited by hand: one real plugin appeared twice.
  • A fake CAPTCHA loader’s settings. An option named wp_15384834c4_cfg held the encrypted script behind the fake “verify you are human” attacks, which reads its server address from the Polygon blockchain.
  • Sign-ins from six different IP addresses on the only administrator account within ten days, which suggests the password had been stolen.

We removed the fake plugin from the active list, deleted the loader’s option, cleared every saved login session and the temporary cached data, and checked posts, pages, page-builder code snippets and scheduled tasks for injected code. Then we exported the cleaned copy.

Never import a hacked site’s database as it is. The files may be gone, but the malware’s settings in the database will wait for the next copy of its code.

Rebuild WordPress, the theme and plugins

  1. Create a new database and database user with a new password, and import the cleaned export.
  2. Install a fresh copy of WordPress and point wp-config.php at the new database, with the same table prefix and new security keys.
  3. Install the theme fresh from the seller’s site or WordPress.org. Use the same theme folder name as before, so WordPress finds its settings.
  4. Install each plugin fresh from WordPress.org or the developer’s account. The database tells you which ones were active. Leave out anything you don’t recognise.

Fresh copies are safer than the originals would have been: anything the attackers changed in the old files is simply gone.

Get the images back

The Internet Archive’s Wayback Machine keeps copies of many sites’ images. Instead of clicking through archived pages, we used the image list from the database to ask the archive for every file directly. Adding id_ after the date in an archive address returns the original file rather than the archive’s viewer page:

https://web.archive.org/web/20260608id_/https://example.com/wp-content/uploads/2025/09/logo.png

We wrote a short script that goes through all 760 addresses, saves each file into the right wp-content/uploads folder, lists the files the archive doesn’t have and pauses between requests so the archive doesn’t block it. Afterwards, the Regenerate Thumbnails plugin rebuilds any smaller sizes that are missing.

To build the list yourself, the database has it in two places: the _wp_attached_file entries in wp_postmeta give each original file, and _wp_attachment_metadata lists its smaller sizes.

Theme settings

Many premium themes keep all their options in a single wp_options row. This site’s theme stored 971 settings under a row named after the theme’s brand name. Once the same theme was installed and active, they came back on their own. As a safety net we also exported them in the theme’s own import format, so they could be pasted into its Import/Export screen if needed.

Finishing touches

  • Page builder: Elementor → Tools → Regenerate CSS & Data, so pages pick up their styles again.
  • Memory: the first page load stopped with “Allowed memory size exhausted” in Elementor’s icon code. The fix is to raise the PHP memory limit to 512 MB, both in wp-config.php and in the host’s PHP settings.
  • PHP version: the old site ran PHP 8.1, which no longer gets security fixes. A rebuild is the right moment to move to 8.3 or newer.
  • Lock it down: a new administrator password and two-factor login, permalinks saved once, and a full malware scan. See our guide to the first hour after a hack for the rest of the list.
  • Backups: set up daily backups that are stored away from the server. A database export saved this site; a full off-site backup would have made it a ten-minute restore.

Related: how to remove malware from WordPress and host suspended your site for malware?

Other plugins are being attacked right now too. See the live list of WordPress plugins under active attack.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

I only have a database export. Can my site really come back?
Usually, yes. Pages, posts, menus, users, page-builder layouts and most plugin and theme settings live in the database. Files you can download again: WordPress, the theme and the plugins. Only your uploaded images and documents need another source.
Can I import the old database as it is?
Not if the site was hacked. Malware often leaves settings, fake plugins in the active list or scripts in the database. Look through it first, or have it checked, then import the cleaned copy.
Will the Wayback Machine have all my images?
Often most of them, especially images that appeared on pages it archived. Images that were never shown on a public page, or very new uploads, may be missing. Your own computer, your designer and old emails are the next places to look.
My theme is a paid theme. Will its settings come back?
The settings are in the database, so they come back once the same theme is installed and activated. Install the latest copy from your account with the theme seller, then check the theme options page.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →