These are safe.
Normally the contents of wp-salt.php is in the wp-config.php. The reason you site became inaccessible is due to the change in wp-config.php to include wp-salt.php. I.e. include(‘wp-salt.php’);
You can delete wp-salt.php, but be sure to copy the defines into the wp-config.php were the “include(‘wp-salt.php’);” line is and remove the “include(‘wp-salt.php’);” line.
The wp-cli.yml file is part of WP-Cli. I suspect is was created when you ran “wp core verify-checksums”. To be sure, you should read the contents.
Related Posts:
- Verifying that I have fully removed a WordPress hack?
- If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
- Tips for finding SPAM links injected into the_content
- What should I do about hacked server?
- How can I find security hole in my wordpress site?
- How to prevent bot or someone to modify any file automatically?
- wp-config.php modified?
- Suspicious Files
- How to prevent wp-login brute force attack from thousand of different IP? [duplicate]
- Malware script in database post table only? [closed]
- Verifying that I have fully removed a WordPress hack?
- How can I safely hide the fact that my website runs on WordPress? [closed]
- My WordPress Websites are always under attack
- How to find exploited wordpress plugin [closed]
- Any known bugs that could cause disappearance of the wp_users table?
- On new server, site got hacked, permissions a bit strange? Please help
- Replace domain in database
- Remove hacked code – out of ideas! [closed]
- WordPress Database Re-installed (Hacked)
- Verifying that I have fully removed a WordPress hack?
- Could a user account with a stolen password compromised entire WP site?
- how to find the way they hacked my WP site
- How to stop repeated hack on header.php of custom theme? [closed]
- Is my WP site being hacked?
- Should WordPress Add Options to Enhance Security or Leave it to plugin developers? [closed]
- WordPress Hacks/Defacing [closed]
- what is a auth_user_file.txt?
- How to view PHP on live site
- Is moving wp-config outside the web root really beneficial?
- Hide the fact a site is using WordPress?
- Best way to eliminate xmlrpc.php?
- Are Nonces Useless?
- What is the difference between esc_html filter vs attribute_escape filter?
- Which KSES should be used and when?
- How do WordPress Nonces Work?
- Disable comment windows for all existing posts (pages/blogposts)
- How Attackers write script into my php files?
- Generate WordPress salt
- Stop wordpress automatically escaping $_POST data
- how can i embed wordpress backend in iframe
- Handling nonces for actions from guests to logged-in users
- Can I force a password change?
- How brute-forcer knows that the password is cracked for target username?
- What is pclzip.lib.php file that wordfence think it’s a malicious code
- Can someone (Support of my themeprovider) get access to my server If I send them my admin login?
- How to disable XML-RPC from Linux command-line in a total way?
- How to remove javascript malware in wordpress site [closed]
- Securing my WordPress Files and Directories
- Single sign-on: wp_authenticate_user vs wp_authenticate
- How to allow internal links using wp_kses filtration
- hSite has no css on mobile [closed]
- How does Cross Site Scripting (XSS) work exactly? [closed]
- Relative security of different releases of WordPress
- How does the “authentication unique keys and salts” feature work?
- vs WordPress Security
- esc_html__ security : what for in this example?
- Using HTACCESS for Secret Access
- wp-config.php being written by attacker
- XML-RPC errors they know my username?
- Is [admin / admin] acceptable for all local websites?
- Simple Online Payment for Event Registration [closed]
- What may be causing failure of auto-install features in WordPress (v3.0.3)?
- Client side HTTP parameter pollution (reflected)
- Local file inclusion critical security issue [closed]
- Best practices to assert current_user_can() with guests
- wordpress website host price and security [closed]
- XMLRPC slow and weird websites/services
- Is it safe to hand over the admin rights?
- how much information can we hide when using wordpress cms?
- How I can open back door for myself?
- System setting changed by system user
- How can I force a specific password?
- malware undetectable by multiple scans
- Are SVG image files safe to upload? Why WP defines them as a security risk? [duplicate]
- Who updates the wp-admin/core file?
- How WordPress sanitizes post content on save? Or it doesn’t?
- Does this code indicate an exploit?
- Checking for origin of a xmlrpc request
- Has anyone developed a anti-spam plugin to simply allow users to BLOCK whatever they wish to, but one that will also go easy on IP addresses?
- User generated content and security
- HSTS header not being added correctly
- how to protect wordpress content from crawler
- Securing WordPress running on Azure platform
- Can WordPress admin user + database credentials be used to gain Cpanel or FTP access?
- Should I worry about SQL injection when using REST API?
- Spam Registrations
- Links to root domain from search engines don’t work, but direct links and links from other referrers do
- How can I backup my site if it gets hacked?
- How can I have more confidence that WP plugins aren’t getting and storing user data?
- Secure Multiple WordPress Installations on shared hosting
- Any way to disable /wp-login.php redirecting to the site folder?
- Able to go to WordPress admin even after deleting auth cookies from request headers
- Is WordPress ready for GDPR compliance? [closed]
- suspicious boolean.php file in wp web root [closed]
- Bank account number and Sort Code in a form [closed]
- WP-JSON: Cross Origin Resource Sharing Vulnerability?
- Why should I firewall servers?
- Does drilling a hole into a hard drive suffice to make its data unrecoverable?
- Fix CVE-2017-5487 vulnerability
- Content Security Policy blocking images from installed plugins’ popup info window, as they are from external domains – global fix?