My website was compromised, and a suspicious file named "Trojan" was found. My hosting provider deleted several files, but the WordPress installation stopped working afterward. I'm considering restoring a copy of the site, including its database and theme, inside Docker. Would that protect my computer, or could the existing malware still affect the host? The site already contains many themes and plugins, some of which I didn't choose myself, so identifying the original infection may be difficult.
3 Answers
The safest approach is to treat the entire installation as compromised and rebuild it from a known-clean WordPress download. Keep only carefully reviewed data, such as an export of the database and the uploads directory. Reinstall themes and plugins from trusted sources, then change every password involved—including WordPress, database, hosting, file-transfer accounts, and administrator users. Also review accounts and permissions, since they may have been altered.
Docker does provide isolation and makes it easier to destroy and recreate an application, but it does not make infected software safe. Malicious code can still run inside the container, and anything stored in mounted folders, volumes, or the database survives a container rebuild. If the database or uploaded JavaScript and media files are compromised, restoring them into a fresh container can simply bring the problem back.
A clean reinstall is the better option. Avoid unknown, modified, or unofficial themes and plugins, since they’re common malware sources. You can separate the database into its own container for easier management and keep regular backups, but that improves maintenance rather than removing an existing infection.
The site already had around 20 themes and 10 plugins before I took over, so finding the one responsible would be extremely difficult. Starting with a clean installation seems more reliable.