If you use UpdraftCentral to manage your WordPress sites, please disconnect and check every connected site today, even if everything looks fine.

On 18 October, the team behind the popular UpdraftPlus backup plugin announced a security breach of their website, teamupdraft.com. They believe attackers obtained UpdraftCentral connection keys, which can be used to send commands to the WordPress sites they are linked to.

We are already seeing the result of this on sites across the web: malicious plugins being quietly installed through the UpdraftCentral connection. Below we explain what has happened in plain terms, what you need to do now, and how we can help if your site has been affected.

What UpdraftPlus have said

This is the statement the UpdraftPlus team sent to their customers:

On 18 October our security team detected unauthorised access to the teamupdraft.com website. We acted immediately to close the access route, signed out every account and reset the affected keys and credentials. We are continuing to investigate and we will update you if there is any further information.

During the incident, we believe our customer database was accessed. This includes your name, email address, and order history. Passwords are stored using one-way hashing, so they are not visible in plain text, and payment details are never stored on our systems.

As a precaution, we recommend you:

• Change your teamupdraft.com password. Type teamupdraft.com into your browser rather than following a link.
• Change it anywhere else you use the same password.
• Reset two-factor authentication in My Account if you use it on teamupdraft.com.
• Treat unexpected emails claiming to be from us with caution. We will never ask for your password or keys.

We believe UpdraftCentral connection keys were also compromised. These keys are used to send commands to your connected sites, and we can’t see that traffic from our side. So we are asking every UpdraftCentral customer to disconnect and check each site now, even if everything looks normal:

1. Log in to the site’s own WordPress dashboard, not through UpdraftCentral.
2. Disconnect it: Settings > UpdraftPlus > Advanced Tools > UpdraftCentral, then delete the connection key.
3. Check Users and Plugins for anything you don’t recognise, and remove it.
4. Change the site’s administrator passwords.
5. Update UpdraftPlus to the latest version, which removes the old connection automatically.
6. Reconnect your site to UpdraftCentral

We take the security of your data extremely seriously, and we’re sorry for the concern this causes.

What this means, in plain English

The stolen connection keys work like a spare set of keys to your website, and attackers can use them without knowing your WordPress password.

UpdraftCentral is a dashboard that lets you manage lots of WordPress sites from one place: run backups, install updates, add plugins and so on. To make that work, each site is given a connection key. Whoever holds that key can send instructions to the site, and the site trusts them.

If those keys have been copied, an attacker can send instructions too. The most common one we are seeing is “install this plugin”. These fake plugins can:

• create hidden administrator accounts so the attacker can get back in later
• inject spam links or redirect your visitors to scam websites
• steal customer or form data
• send spam email from your hosting account

Because the instructions come through a trusted connection, nothing looks out of place at first. Your site may look completely normal while the damage happens in the background.

A few important points:

• You are only at risk from this specific issue if your site is connected to UpdraftCentral. Using the free UpdraftPlus plugin just to take backups, without UpdraftCentral, is not the route being exploited here.
• Changing your WordPress password alone does not close the door. The connection key has to be removed as well.
• Your teamupdraft.com account details may also be exposed, so watch for phishing emails pretending to be from UpdraftPlus. Type the address into your browser rather than clicking links in emails.

Not affected yet? Act now, not later

If your sites are connected to UpdraftCentral and look fine, please change your keys and passwords today: a clean site today can still be targeted tomorrow while the old keys work.

For each connected site:

1. Log in to the site’s own WordPress dashboard directly (yoursite.co.uk/wp-admin), not through UpdraftCentral.
2. Go to Settings > UpdraftPlus > Advanced Tools > UpdraftCentral and delete the connection key.
3. Check Users for any administrator accounts you don’t recognise, and Plugins for anything you didn’t install. Remove anything suspicious.
4. Change the passwords for every administrator account. Use a long, unique password for each.
5. Update UpdraftPlus to the latest version.
6. Only then reconnect the site to UpdraftCentral with a fresh key.

While you’re at it:

• Change your teamupdraft.com password, and anywhere else you’ve used the same password.
• Reset two-factor authentication on your teamupdraft.com account if you use it.
• Change your cPanel and hosting control panel passwords if they match any of the above.

If you manage a lot of sites, start with the busiest ones and any online shops, as these are the most valuable targets.

Think your site has been compromised? Get in touch

If you find a plugin or user you don’t recognise, contact our support team before doing anything drastic: we can check whether a clean backup from before the attack exists.

Every D9 Hosting plan includes backups taken on our side, separate from any backup plugin you run yourself:

Plan	Backups we keep
All plans	1 weekly backup
Premium plans	30 days of backups

Because these backups are stored independently of WordPress and UpdraftPlus, they can’t be touched through an UpdraftCentral connection.

Signs your site may have been affected:

• a plugin you didn’t install, often with a generic or official-sounding name
• new administrator users you don’t recognise
• visitors being redirected to other websites, especially on mobile
• warnings from Google, your browser or your security plugin
• complaints of spam email coming from your domain

When you contact us, let us know the website address, roughly when you first noticed something wrong, and anything you’ve already changed. The sooner we hear from you, the more likely it is that a clean restore point is still available. Please don’t simply delete the suspicious plugin and carry on, as attackers often leave more than one way back in.