The only way that I have found (and used) to get rid of ‘unauthorized’ code is to manually check everything. This includes
- changing access credentials for hosting, ftp, databases, admin-level users. Strong passwords, of course.
- reinstalling everything (themes, plugins, custom code) from known good sources via a manual FTP process. Also, reinstalling WP from the Admin, Update area.
- checking all folders for files that shouldn’t be there. Since you updated all files, sort by datestamp, which should make unauthorized files stand out from the recently updated files.
- look for unauthorized WP users
There is more to this procedure; I’ve developed a good checklist that I use here. It takes a bit of time, but my process has been successful in cleaning up sites for my clients. There are lots of googles/bings/ducks on cleaning a hacked site, also.
Related Posts:
- How to distinguish between a hack and an encoding error?
- Advice On How to Backup WordPress
- How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
- What’s the best approach for generating a new API key?
- Is it possible to decrypt SHA1
- How does the SQL injection from the “Bobby Tables” XKCD comic work?
- Error `sec_error_revoked_certificate` when viewed in Firefox only
- Convert .pfx to .cer
- how fix “this certificate cannot be verified up to a trusted certification authority”
- How can bcrypt have built-in salts?
- Getting a List of Currently Available Roles on a WordPress Site?
- Why should I use the esc_url?
- How safe / sanitized is wp_insert_posts()?
- From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
- Where to securely store API keys and passwords in WordPress?
- Why are passwords exportable as plain text in WordPress?
- Full path disclosure on rss-functions.php
- What to use instead of wp_kses() in user output
- Are the default salts secure?
- Is there a way to force ssl on certain pages
- Subscribe to email for security fixes?
- What is the purpose of having a token in cookies?
- How to escape custom css?
- Understanding SVG vulnerabilities in WordPress related to a specific fix
- How is password strength calculated?
- How to secure or disable the RSS feeds?
- Regular security checks – what steps should be included?
- What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
- Do Cookies Need to be Sanatized Before Being Saved?
- Disable external access to REST API Endpoint
- Make password invalid once logged out of password-protected page
- What is the wp-includes/certificates/ca-bundle.crt used for?
- Do you need to escape hard coded plain text?
- Encrypt emails?
- WordPress salts set in config and database
- Disallow file edit not preventing plugin install
- How to secure WordPress XMLRPC?
- Protecting HTML5 video [closed]
- How can I find security hole in my wordpress site?
- Does WP show me if I’m logged in from multiple locations?
- Do I need to use the esc_html() function on hard coded links?
- WordPress Malware Problem help! [duplicate]
- Frontend Password change
- Restrictive File Permissions
- Downloading File from Outside Web Root
- Why are xmlrpc.php and wp-cron.php being called so often?
- Using esc_html with HTML purifier and CSSTidy: Overkill?
- wordfence scan warning on W3 Total Cache [closed]
- site get login attempts after htaccess ip restriction
- Is it good security advice to install wordpress in subdirectory but link to root?
- wp-config.php modified?
- Moving wp-config.php up 2 levels
- How Could I sanitize the receive data from this code
- WordPress SQL Injections through User Agent
- How to save iframe tag into a post?
- How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
- What permissions should I give directories if I want to make WordPress more secure?
- How to protect wp-admin through .htaccess?
- Something is unescaping all html entities before output to browser [closed]
- Is wp_kses the right approach in sanitizing this string?
- Renaming install.php for security?
- Limit Login Attempts BEFORE PHP is executed?
- Which Versions of WordPress Ship with the Patched TimThumb?
- Safe to say WordPress security releases don’t have database upgrades
- Use global variables or function that returns said variables for site-wide private-ish WP settings?
- fail2ban to prevent Brute Force Attacks on WordPress?
- Use Google authentication for pages within a website [closed]
- How to give the same error message when the wrong password or wrong username is used?
- should I escape a literal url added in functions.php
- Adding Security Keys?
- How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
- Secret keys in SCM
- Secure Server after configuration
- Uploading attachment (pdf) and prevent download for anonymous user
- After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
- Specific Page/Post Need to Stay Non SSL
- Block JSON access over the net
- Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
- Security: AWS (shared hosting) claims template file malicious
- Cannot access wp admin of WordPress website (security plugin issue) [closed]
- Why are the latest visits to my website originating from my own website?
- PHP Code Sniffer – WordPress VIP Coding Standards
- How do I hide WordPress users from security scanning?
- Background Updates Not Happening
- wp-config.php file and code injection
- Trying to understand nature of hacking
- FORCE_SSL_ADMIN affecting subdomains
- What is the best security $_POST method?
- Is my WP site being hacked?
- Directory to store secure file
- checking the form submit in right order
- How can I give someone server access to only duplicate and modify a site?
- Our security auditor is an idiot. How do I give him the information he wants?
- I am under DDoS. What can I do?
- How can I implement ansible with per-host passwords, securely?
- How do I protect my company from my IT guy? [closed]
- Does changing default port number actually increase security? [closed]
- Can you alter the default wordpress strong password requirements?
- WordPress – tracking options
- how to sanitizing $_POST with the correct way?