Recognising compromise.
WHAT TO LOOK FOR
PHP files in directories that should contain only images Files with random or meaningless names Recently modified files you did not change Files with unusual permissions Very large files you do not recognise
WHERE TO LOOK FIRST
The uploads directory The web root Theme and plugin directories
SORTING BY DATE
File Manager can sort by modification date.
Anything modified recently that you did not touch deserves examination.
WHAT LEGITIMATE FILES LOOK LIKE
Recognisable names, consistent with the application.
WHAT SUSPICIOUS FILES LOOK LIKE
Long random names Names mimicking legitimate ones with a small difference
Obfuscated code inside: long strings of encoded text
WHAT TO DO IF YOU FIND SOMETHING
Do not simply delete it and continue. The entry point is still open.
Open a ticket and follow the cleanup process properly.
FOR ROUTINE CHECKING
Run a malware scan periodically. ImunifyAV is available in cPanel.
