Is Your WordPress Site Hacked? This is How You Can Fix the Content In It

In case you want to partiaYou can still manually remove and replace individual information if you wish to change your site files partially. However, since it might not replace the infected files, you should do this.

.htaccess file

The hackers add a code to the default WordPress.htaccess file. It would be ideal to create a new.htaccess file and erase the old, compromised one entirely:

1. Using FTP, log in to your server.

2. Check that your FTP client is set to view hidden files.

3. If the old hacked .htaccess file is present, delete it.

4. Go to WordPress Dashboard, find Setting > Permalinks and re-save its permalink settings.

• The direct URL for the page is http://example.com/wp-admin/options-permalink.php (here replace example.com with your WordPress site).
• The base .htaccess gets recreated.

How to Handle Unused Installs?

In case you have an old installs that you aren’t using now, you should upgrade it to strengthen the security or delete it completely.

Upgrading in the WordPress Dashboard

• Whenever a new version of WordPress is launched, you get a notification on every screen that an upgrade is available:
• Click on ‘Updates’ in the left-hand column to update.

You will get the following page:

Upgrading via SSH

It is possible to upgrade WordPress via SSH as below:

First check if SSH is enabled on your account by the web host. Next, login to your server by typing the below code on the command line:

ssh user@mydomain.com

After this you will asked for your password. Generally, the user and the password are same as your FTP account but they might differ sometimes.

Once logged in, browse the public_html directory present where WordPress is installed. Navigate to the sub-directory if you are using it. Then, type the below code to download the latest WordPress files:

wget http://wordpress.org/latest.tar.gz

Next, type the below code to decompress the file:

tar xfz latest.tar.gz

Now, you will need to delete the wp-admin and wp-includes directories using the following commands:

rm -rf ./wp-includes
rm -rf ./wp-admin

Then move the new wp-admin and wp-includes directories to the root with the below commands:

mv ./wordpress/wp-admin ./
mv ./wordpress/wp-includes ./

Enter the WordPress directory with

cd wordpress

Next, copy its content to the parent directory (i.e. root directory) by overwriting the old ones:

cp -rpf -f * ../

Go back to the root directory by typing “cd..” and delete both the tar files you previously downloaded and wordpress directory using the below code:

rm -rf ./wordpress/
rm -f latest.tar.gz

Finally, you will just need to run the upgrade script on your WordPress install (i.e., domain.com/wp-admin/upgraded.php).

Upgrading WordPress via Softaculous

1. Click on Softaculous App Installer.

2. Go to the All Installations icon in the top toolbar.

3. You will land on a Scripts Installations page. Then click on the upgrade icon as below:

Note: Prior to upgrading, make sure you take the backup of your website. For this, tick the box besides Create Backup.

4. Click on the Upgrade button.

5. You will see a progress bar on the screen and when the upgrade process gets completed the following message will get displayed:

Congratulations, the software was upgraded successfully.

Deleting a WordPress Install Through Softaculous

Prior to starting with the deletion process, you will need to have an access to your hosting control panel.

Note: In case you have old WordPress install at example.com and one more site at example.com/othersite/ and if you click on Delete all Files button, it will delete everything right from  the non-WordPress site at example.com/othersite.

1. Firstly, take the backup of your website. Since you have installed your WordPress CMS using Softaculous App Installer, you can remove WordPress within few clicks.

2. Go to control panel and open Softaculous App Installer.

3. Then search for the WordPress icon on the Top Scripts page.

4. You will see your current WordPress installations. Find the Options section and press on “X” in red.

5. You will now be asked for confirmation of removing the installation so click on Remove Installation. Now you will get a notification informing that the installation is successfully removed.

Deleting WordPress Using FTP

1. Check that your FTP client is set up to view hidden files.

2. Next, delete all files that start with “wp-“.

3. Delete all directories that start with “wp-“.

4. Delete the below files (if present):

• htaccess
• index.php
• xmlrpc.php
• readme.html
• license.txt

Now, only the files that you have uploaded will be available in the directory. If you still find the files there that you don’t recognize, check them carefully as those might be placed there by a hacker. If you are confident that you won’t require these files, you can delete them.

Deleting a WordPress Install Using SSH

1. Log into your server using SSH.

2. Go to your WordPress install directory.

3. Execute following command all on one line. This will delete all WordPress files:

[server]$ rm wp-*;rm .htaccess;rm index.php;rm xmlrpc.php;rm readme.html;rm license.txt;rm -R wp-*

Note: With this command all files will get deleted permanently and there is no way to recover them once you run the command. Confirm first if you wish to permanently delete all WordPress files prior to running this command.

How to Manually Manage Plugins?

You should always keep your plugins updated. This is to avoid being hacked. Check the below article for instructions on keeping your plugins updated:
• Updating WordPress plugins

Updating Plugins via SSH

The WP CLI interface can be used to update plugins via SSH. Check the below steps to update plugins via SSH:

It’s assumed that you are already connected to your server via SSH. Run the below command, here the plugin to be updated is Akismet. You will just need to replace the plugin name:

wp plugin update akismet

Disabling Plugins via FTP

You can also disable plugins via FTP with the below steps:

1. Log into your server using FTP or SSH. (In this example Filezilla is used).

2. Ensure that you have logged in to your WordPress site’s directory.

3. Click on the ‘/wp-content’ directory. Here you will see the /plugins directory.

4. Change the name of the /plugins directory to /plugins_OFF. This will immediately disable all plugins.

5. Check your site again to see if the plugins have been disabled.

Keep Your Theme Up To Date

Check the below article for keeping your theme up to date:
• Update Your WordPress Theme

In this way, you can fix a specific content in a hacked WordPress site.