The only safe thing to do is to restore the site from a known clean backup. Hacker could have inserted backdoor users or other vulnerabilities in your DB, something you are not going to be able to find based on any list of files, which means that even if you remove all files which obviously … Read more
Firstly add this two line to your functions.php file. Sorry I forgot to mention about this earlier. require_once ABSPATH . ‘wp-admin/includes/class-wp-filesystem-base.php’; require_once ABSPATH . ‘wp-admin/includes/class-wp-filesystem-direct.php’; now you can use WP_Filesystem_Direct::get_contents($path) instead of file_get_contents($path)
Can they theoretically develop a WP plugin to access the files (or even WP config, including DB credentials) of another WP installation? Yes. If your folders are owned by the same user, run as the same user in Apache/Nginx or have read/write access to each other, then it’s possible. Your installations are sandboxed at the … Read more
What is the best way to load the dependencies for the WP_Filesystem? The first or the second code part? WP_Filesystem() is used in conjunction with the global $wp_filesystem variable, so if you use it, then the second code part should be used. And WP_Filesystem() must be called so that the global $wp_filesystem variable is properly … Read more
Short answer, but adequate I think. While I have not tested this, I doubt that there would be a problem if you used the Filesystem API provided by the Core.
Your files should be owned by your account. Period. They should not be owned by the “apache” user. This is insecure. The files may need to be readable by the apache user. The recommended permissions are 755 for folders and 644 for files. With the exception of the wp-config.php file, which should be set to … Read more
How to know which ajax file or function is called for action
WordPress doesn’t use sessions. User authentication is done with cookies. But, there are many plugins that use sessions for some purpose, and it is possible that you are using one (or even more) plugin that is using sessions. You should try to determine which plugin does that and start from there. Search for the session_start() … Read more
How to block access to files without modifying .htaccess or ngnix config? [closed]
accessing files in custom folder in wordpress