One-time cleaning and restoration of website security on WordPress

Exit Conditions

• The site was and currently is hacked.

• The server is administered by our server administrators:

  • all changes to server settings (open_basedir, SSH, ClamAV, etc.) are made through them or with their involvement.

• Information about WP / PHP / MySQL / plugins versions:

  • is provided after access to WordPress admin + (if necessary) SSH.

• Backups:

  • automatic backups were recently enabled, the presence of a complete “clean” backup is not guaranteed.

Goal

Completely clean the site of malicious code and eliminate the causes of repeated hacking.

Scope of Work

1. Preparation

• Enable site maintenance mode.

• Conduct an initial review of WordPress (admin panel, files, database).

2. Security Checks (together with server admins)

• Check site isolation (open_basedir).

• Antivirus scanning of the site via SSH (ClamAV or similar).

• Access checks:

  • SSH by key;

  • disabling passwords (by agreement with admins).

3. Cleaning

If the antivirus does not provide a clear result:

• Archive:

  • active theme;

  • the folder /uploads.

• Document:

  • full list of plugins;

  • non-standard settings;

  • API keys (if any).

• Delete all site files, except for:

  • theme files;

  • /uploads;

  • wp-config.php.

• Write and execute a server script:

  • check /uploads for the presence of .php files.

4. Restoration

• Upload clean, up-to-date version of WordPress.

• Reinstall plugins, only from the official repository.

• Check the correct operation of the site.

5. Completion

• Disable maintenance mode.

• Brief report:

  • what was found;

  • what was fixed;

  • recommendations to prevent recurrence.

Requirements for the Executor

• WordPress backend (security, file structure, database).

• PHP / MySQL.

• Understanding of the server environment (working together with admins).

• Experience in real cleaning of hacked WP sites (mandatory).

The site is hacked. This is a one-time job.
The server is configured by our admins, but SSH access will be available.
WP / PHP / plugin versions — after access to the admin panel.
Backups were enabled recently, we do not rely on a “clean” backup.
Full cleaning + elimination of the causes of repeated hacking is required.