The proper process.
THE PRINCIPLE
Remove the compromise and close the entry point.
Doing only the first means it returns.
THE PROCESS
- Back up the compromised state
- Identify the entry point
- Change every credential
- Remove or replace compromised files
- Check the database
- Remove unauthorised accounts and cron jobs
- Update everything
- Verify it is clean
- Monitor
THE ORDER MATTERS
Cleaning before changing credentials means the attacker can return during cleanup.
THE MOST RELIABLE METHOD
Replace rather than clean.
Fresh core files, fresh plugins and themes from legitimate sources, keeping only your own content and configuration.
WHY REPLACE
You cannot be certain you found everything.
WHAT TO KEEP
Your uploads, after checking them Your database, after checking it Your configuration, after checking it
WHAT TO DISCARD
Everything else, replaced with clean copies.
