Scan multiple websites for malware that are in same webhost root?

The only way that I have found (and used) to get rid of ‘unauthorized’ code is to manually check everything. This includes

  • changing access credentials for hosting, ftp, databases, admin-level users. Strong passwords, of course.
  • reinstalling everything (themes, plugins, custom code) from known good sources via a manual FTP process. Also, reinstalling WP from the Admin, Update area.
  • checking all folders for files that shouldn’t be there. Since you updated all files, sort by datestamp, which should make unauthorized files stand out from the recently updated files.
  • look for unauthorized WP users

There is more to this procedure; I’ve developed a good checklist that I use here. It takes a bit of time, but my process has been successful in cleaning up sites for my clients. There are lots of googles/bings/ducks on cleaning a hacked site, also.

Related Posts:

  1. How to distinguish between a hack and an encoding error?
  2. Advice On How to Backup WordPress
  3. How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
  4. What’s the best approach for generating a new API key?
  5. Is it possible to decrypt SHA1
  6. How does the SQL injection from the “Bobby Tables” XKCD comic work?
  7. Error `sec_error_revoked_certificate` when viewed in Firefox only
  8. Convert .pfx to .cer
  9. how fix “this certificate cannot be verified up to a trusted certification authority”
  10. How can bcrypt have built-in salts?
  11. Getting a List of Currently Available Roles on a WordPress Site?
  12. Why should I use the esc_url?
  13. How safe / sanitized is wp_insert_posts()?
  14. From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
  15. Where to securely store API keys and passwords in WordPress?
  16. Why are passwords exportable as plain text in WordPress?
  17. Full path disclosure on rss-functions.php
  18. What to use instead of wp_kses() in user output
  19. Are the default salts secure?
  20. Is there a way to force ssl on certain pages
  21. Subscribe to email for security fixes?
  22. What is the purpose of having a token in cookies?
  23. How to escape custom css?
  24. Understanding SVG vulnerabilities in WordPress related to a specific fix
  25. How is password strength calculated?
  26. How to secure or disable the RSS feeds?
  27. Regular security checks – what steps should be included?
  28. What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
  29. Do Cookies Need to be Sanatized Before Being Saved?
  30. Disable external access to REST API Endpoint
  31. Make password invalid once logged out of password-protected page
  32. What is the wp-includes/certificates/ca-bundle.crt used for?
  33. Do you need to escape hard coded plain text?
  34. Encrypt emails?
  35. WordPress salts set in config and database
  36. Disallow file edit not preventing plugin install
  37. How to secure WordPress XMLRPC?
  38. Protecting HTML5 video [closed]
  39. How can I find security hole in my wordpress site?
  40. Does WP show me if I’m logged in from multiple locations?
  41. Do I need to use the esc_html() function on hard coded links?
  42. WordPress Malware Problem help! [duplicate]
  43. Frontend Password change
  44. Restrictive File Permissions
  45. Downloading File from Outside Web Root
  46. Why are xmlrpc.php and wp-cron.php being called so often?
  47. Using esc_html with HTML purifier and CSSTidy: Overkill?
  48. wordfence scan warning on W3 Total Cache [closed]
  49. site get login attempts after htaccess ip restriction
  50. Is it good security advice to install wordpress in subdirectory but link to root?
  51. wp-config.php modified?
  52. Moving wp-config.php up 2 levels
  53. How Could I sanitize the receive data from this code
  54. WordPress SQL Injections through User Agent
  55. How to save iframe tag into a post?
  56. How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
  57. What permissions should I give directories if I want to make WordPress more secure?
  58. How to protect wp-admin through .htaccess?
  59. Something is unescaping all html entities before output to browser [closed]
  60. Is wp_kses the right approach in sanitizing this string?
  61. Renaming install.php for security?
  62. Limit Login Attempts BEFORE PHP is executed?
  63. Which Versions of WordPress Ship with the Patched TimThumb?
  64. Safe to say WordPress security releases don’t have database upgrades
  65. Use global variables or function that returns said variables for site-wide private-ish WP settings?
  66. fail2ban to prevent Brute Force Attacks on WordPress?
  67. Use Google authentication for pages within a website [closed]
  68. How to give the same error message when the wrong password or wrong username is used?
  69. should I escape a literal url added in functions.php
  70. Adding Security Keys?
  71. How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )
  72. Secret keys in SCM
  73. Secure Server after configuration
  74. Uploading attachment (pdf) and prevent download for anonymous user
  75. After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What’s the best solution now?
  76. Specific Page/Post Need to Stay Non SSL
  77. Block JSON access over the net
  78. Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
  79. Security: AWS (shared hosting) claims template file malicious
  80. Cannot access wp admin of WordPress website (security plugin issue) [closed]
  81. Why are the latest visits to my website originating from my own website?
  82. PHP Code Sniffer – WordPress VIP Coding Standards
  83. How do I hide WordPress users from security scanning?
  84. Background Updates Not Happening
  85. wp-config.php file and code injection
  86. Trying to understand nature of hacking
  87. FORCE_SSL_ADMIN affecting subdomains
  88. What is the best security $_POST method?
  89. Is my WP site being hacked?
  90. Directory to store secure file
  91. checking the form submit in right order
  92. How can I give someone server access to only duplicate and modify a site?
  93. Our security auditor is an idiot. How do I give him the information he wants?
  94. I am under DDoS. What can I do?
  95. How can I implement ansible with per-host passwords, securely?
  96. How do I protect my company from my IT guy? [closed]
  97. Does changing default port number actually increase security? [closed]
  98. Can you alter the default wordpress strong password requirements?
  99. WordPress – tracking options
  100. how to sanitizing $_POST with the correct way?