Wordfence deleted a file. Where is the quarantine?

There is not one. Wordfence 9.0.0 deletes the file through the filesystem API with no copy taken first, on both the single Delete File button and the bulk delete. The only file it refuses to remove is wp-config.php. If you saw the word quarantine in a Wordfence scan result, it was about somebody else's files: Wordfence flags quarantine folders and leftover files that other security tools abandoned where your server serves them over HTTP, and it offers to delete those too. Your recovery route is an upstream copy or a host backup.

I use Anti-Malware Security and the quarantine folder is empty.

It keeps quarantined files in your database, not on disk. They are rows in the posts table with the type GOTMLS_quarantine, holding the original bytes encoded. Open Anti-Malware, then View Quarantine. One catch worth knowing before you go looking: restore writes the bytes back to the original path only while that path still exists, so a file that was unlinked reports that restoration was aborted even though the copy is still sitting in the database.

How long do I have before the quarantine empties itself?

It depends entirely on the plugin. WP Cerber deletes quarantined files after 30 days by default, on a daily scheduled job, and the setting is called Delete quarantined files after. NinjaScanner and Anti-Malware Security keep theirs until you clear them, with no expiry at all. Wordfence, Sucuri, MalCare and Malcure keep nothing locally, so there is no clock to beat. Solid Security keeps database dumps by count rather than by age, which is a different thing from a quarantine.

Which of these plugins should I be running instead?

That is the wrong question to answer while your site is down, and the honest ranking depends on what your site is made of. If most of your code comes from WordPress.org, a plugin that deletes costs you little, because every deleted file is downloadable again. If your theme is custom or your plugins are paid, a plugin that deletes is a poor fit, because nothing it removes can be fetched back. NinjaScanner is the only one here that both quarantines and lets you supply the pristine copy of a paid component yourself, as a ZIP you drop into its local folder.

The file is gone and I have no backup. Is the site lost?

Almost certainly not. Most deleted files came from WordPress.org, so the exact original is still downloadable: core files from the release archive, plugin and theme files from the version you had installed. The files with no upstream copy are the ones that hurt, which usually means a custom theme, a paid plugin, or your own code. Restore from your host's nightly backup for those, and take the file out of the scanner's reach afterwards.

Does restoring the file bring the malware back?

It brings back exactly the bytes that were removed, so if the file was infected, yes. That is why the order matters: work out whether the detection was real before you restore, and compare the restored file against the upstream copy of the same version afterwards. If the two match byte for byte, the file is the original and the detection was wrong about it.

When the cleanup went wrong

A security plugin deleted your files. Here is how to get them back.

Some scanners move a flagged file somewhere you can reach. Most of the popular ones just delete it. Which one you are running decides whether this takes two minutes or an afternoon, so start there.

Checked against a live WordPress install on 18 August 2026.

What your scanner actually did

Quarantine sounds like a holding area you can walk into. For most of these plugins there is no such area. Three of the eleven below keep your file somewhere you can get it back from. The rest either delete it or never touch it at all. The table comes from reading the code that ships in each plugin today, on 18 August 2026, rather than from their marketing pages, because the two do not always agree.

Plugin	Version	What it does to a flagged file	Copy kept	For how long
NinjaScanner	3.3.1	Moves the file to a quarantine folder	The whole file	Until you restore or delete it
WP Cerber	9.5.7	Moves the file to a quarantine folder	The whole file	30 days, then a daily job deletes it
Anti-Malware Security (GOTMLS)	4.23.90	Cleans in place, deletes only if the result is empty	The original, in your database	Until you clear it
Wordfence	9.0.0	Deletes the file	Nothing	Not applicable
Sucuri Security	2.7.4	Deletes files it marked as added to core	Nothing	Not applicable
Malcure Malware Shield	19.9.8	Deletes the file, on the paid plan	Only its SHA-256, in the plugin's log	Not applicable
MalCare	6.65	Deletes on a signed command from their dashboard	Nothing on your server	Ask their support
All-In-One Security	5.4.9	Removes no flagged file	Not applicable	Not applicable
Solid Security	10.0.3	Removes no flagged file	Not applicable	Not applicable
NinjaFirewall	4.9	Scans no files, the feature was removed	Not applicable	Not applicable
Quttera	4.1.0.28	Reports only	Not applicable	Not applicable

Versions are the ones current on WordPress.org on 18 August 2026. Check yours under Plugins in the admin, because an older release can behave differently.

Three rows carry most of the surprise. Wordfence keeps nothing. Its delete path removes the file outright, and its repair path overwrites the file with the pristine copy without reading the old bytes first, so neither action leaves you anything to restore. Anti-Malware Security keeps everything, in your database. Its quarantine is a set of rows in the posts table, which is why looking for a folder finds nothing. NinjaScanner has the quarantine people assume the others have, complete with a rollback that undoes a move which would have taken the site down.

One naming trap before you go looking. There are two similarly named products here. MalCare is an agent that acts on instructions from its own dashboard. Malcure Malware Shield is a different plugin from a different vendor, and its delete button is on the paid plan. Check which one is in your plugins list before you follow a recovery route for the other.

Find out what was removed

You need the list of paths before you can do anything useful. Try these in order, because the first one that works saves you the rest.

The scan report inside the plugin. Every scanner keeps its last results, and the row for a removed file usually still names the path even after the file is gone. Copy the paths out before you run another scan, because the next scan overwrites the report.
The site's error log. A deleted file that PHP still tries to load names itself in the fatal error, complete with the line that tried to include it. That is the fastest route when only one file matters.
Modification times on disk. Over SSH, find . -newermt "2 hours ago" -type d from the WordPress root shows the directories touched during the scan. A directory whose timestamp jumped without its contents changing is usually one that just lost a file.
Your host's file manager. Most panels keep a trash or recycle folder for files deleted through the panel. It will not catch a file PHP unlinked, but it costs nothing to look.
The plugin or theme's own file list. Download the same version from where you got it and compare the folder against yours. Any file present upstream and missing locally is a file something removed.

Get the file back

NinjaScanner

Open NinjaScanner and go to the Quarantine tab. Select the paths and restore them. Each file is written back to exactly where it came from, and nothing in the plugin ever expires it. Its scheduled cleanup job walks the cache directory and leaves the quarantine alone.

The one way to lose it is uninstalling the plugin, which deletes the whole wp-content/ninjascanner tree unless you turned on the option that keeps it. Restore your files before you remove the plugin, not after.

To reach the files without the admin, look in wp-content/ninjascanner/ for a directory whose name starts with nscan, then quarantine inside it. The name is generated per site, so yours will not match anybody else's. Each quarantined file is named as the MD5 of its original directory, an underscore, then its original filename, so the filename you are looking for is the readable half. The quarantine.php file in the same directory is the index that maps each one back to its full original path.

WP Cerber

Cerber moves the file rather than deleting it, so the bytes are still on your server. Go to Cerber Security, then Site Integrity, then the Quarantine tab, find the entry and restore it. The file is written back to the path it came from.

If the admin is unreachable, the files sit under your uploads directory in a folder named wp-cerber- followed by sixteen to twenty random characters, then quarantine, then one directory per scan named with a unix timestamp. Each scan directory holds a .restore manifest listing where every file came from, which is what you need to put them back by hand.

Anti-Malware Security (GOTMLS)

Open Anti-Malware in the admin menu and choose View Quarantine. Select the entries and restore them. The originals live in your database, so a database restore from before the scan also brings them back, and deleting the plugin without clearing the quarantine leaves those rows behind.

MalCare

The plugin on your site is an agent. It deletes files when their dashboard tells it to, and it keeps no local copy, so the recovery route is their dashboard or their support, not your server.

Malcure Malware Shield

Deleting is a paid action and it keeps no copy of the file. What it does keep is the SHA-256 of what it removed, in its own event log, which is enough to prove later whether the file you restore is the same one it took. There is no restore screen.

Wordfence, Sucuri, and anything else in the table with nothing kept

There is no copy to restore. Skip to the next section, which is the route that works whether or not your scanner kept anything.

Worth knowing before you press Repair on either of them. Repair does not mean recovering your file. In Wordfence, Sucuri, Malcure and NinjaScanner alike it means downloading the vendor's published copy and writing it over whatever is there, so any edit you made to that file is gone either way. Wordfence goes further and hides the control entirely for a file it cannot match to a WordPress.org release, which means custom code has no repair path at all rather than a worse one. Sucuri's repair covers WordPress core and nothing else.

When nothing was kept

A deleted file is only a problem if you cannot get the same bytes from somewhere else. For most files you can, and the copy you fetch is better than a quarantine copy because it is guaranteed clean.

WordPress core files. The release archive holds every version. Download the one you are running and copy the missing file out of it.
Plugins and themes from WordPress.org. Every past version stays downloadable, so you can fetch the exact version you had rather than upgrading in the middle of an incident.
Paid plugins and themes. Your account with the vendor has the version you licensed. Download it there, and match the version number rather than taking the newest.
Custom code with no upstream anywhere. Your host's nightly backup, your own version control, or the staging copy. This is the case that hurts, and it is the reason a scanner that deletes is a poor fit for a site with a custom theme. Every repair path in every plugin above is gated on recognising the file as WordPress core, a WordPress.org plugin, or a WordPress.org theme. Custom code matches none of the three.
wp-config.php. Nothing can restore it, because no published copy of your database credentials exists. Several of these plugins special-case it and refuse to delete it for that reason. Wordfence tells you to handle it outside the plugin. Your host's backup is the only route.

The full procedure for each of the three file classes, including the paths you must never overwrite, is in restore modified core, plugin and theme files.

Was the file infected at all?

Restore first if the site is down. Then answer this, because putting an infected file back and moving on is how a site gets cleaned three times.

The quickest test costs nothing: compare the file you restored against the upstream copy of the exact version you have installed. If they are identical, the file was the original and the detection was wrong. If they differ, read the difference. Injected code announces itself, usually as one long line at the top or the bottom of an otherwise readable file.

A file with no upstream copy has to be read rather than compared. Telling a real detection from a false flag walks through what an injection looks like next to code that is merely obfuscated, and what to do when you still cannot tell.

Check it before it goes back

Once the file is in place, three things are worth doing while you still have the incident in your head.

Load the page that was broken, then load the admin. A fatal error that moved to a different file means a second file went with the first.
Run a full scan again. One removed file is rarely the whole story, and a scanner that found one injection usually finds the rest on a second pass now that the site loads.
Change the passwords for the admin accounts and rotate the database password if your host makes that easy. Whatever wrote the file usually had a way in that a deleted file does not close.

Stop the next scan doing it again

A scanner that offers Delete as its main remedy will offer it again next week. Three things reduce the odds of losing a file you needed.

Turn off automatic removal. Every plugin here that deletes has a setting to require a click first. Review beats speed on a site with custom code.
Exclude the paths that always trip it. Minified bundles, licence checkers and caching layers that write PHP are the usual repeat offenders.
Keep an upstream copy reachable. A custom theme in version control turns this whole page into a two-minute job.

It is also worth knowing what your scanner does before you need it. Delete, overwrite, and remove the injected lines are three different answers, and only the last one keeps a file that has code in it you cannot download from anywhere.

Questions

Wordfence deleted a file. Where is the quarantine?: There is not one. Wordfence 9.0.0 deletes the file through the filesystem API with no copy taken first, on both the single Delete File button and the bulk delete. The only file it refuses to remove is wp-config.php. If you saw the word quarantine in a Wordfence scan result, it was about somebody else's files: Wordfence flags quarantine folders and leftover files that other security tools abandoned where your server serves them over HTTP, and it offers to delete those too. Your recovery route is an upstream copy or a host backup.
I use Anti-Malware Security and the quarantine folder is empty.: It keeps quarantined files in your database, not on disk. They are rows in the posts table with the type GOTMLS_quarantine, holding the original bytes encoded. Open Anti-Malware, then View Quarantine. One catch worth knowing before you go looking: restore writes the bytes back to the original path only while that path still exists, so a file that was unlinked reports that restoration was aborted even though the copy is still sitting in the database.
How long do I have before the quarantine empties itself?: It depends entirely on the plugin. WP Cerber deletes quarantined files after 30 days by default, on a daily scheduled job, and the setting is called Delete quarantined files after. NinjaScanner and Anti-Malware Security keep theirs until you clear them, with no expiry at all. Wordfence, Sucuri, MalCare and Malcure keep nothing locally, so there is no clock to beat. Solid Security keeps database dumps by count rather than by age, which is a different thing from a quarantine.
Which of these plugins should I be running instead?: That is the wrong question to answer while your site is down, and the honest ranking depends on what your site is made of. If most of your code comes from WordPress.org, a plugin that deletes costs you little, because every deleted file is downloadable again. If your theme is custom or your plugins are paid, a plugin that deletes is a poor fit, because nothing it removes can be fetched back. NinjaScanner is the only one here that both quarantines and lets you supply the pristine copy of a paid component yourself, as a ZIP you drop into its local folder.
The file is gone and I have no backup. Is the site lost?: Almost certainly not. Most deleted files came from WordPress.org, so the exact original is still downloadable: core files from the release archive, plugin and theme files from the version you had installed. The files with no upstream copy are the ones that hurt, which usually means a custom theme, a paid plugin, or your own code. Restore from your host's nightly backup for those, and take the file out of the scanner's reach afterwards.
Does restoring the file bring the malware back?: It brings back exactly the bytes that were removed, so if the file was infected, yes. That is why the order matters: work out whether the detection was real before you restore, and compare the restored file against the upstream copy of the same version afterwards. If the two match byte for byte, the file is the original and the detection was wrong about it.