wordpress-hardening

WordPress Hardening

A defensive-security skill for diagnosing and hardening WordPress installations, with a focus on shared-hosting environments where one compromised sub can pivot across the whole account.

When to invoke

Trigger this skill when any of these signals appear:

• wp-content/uploads/**/*.php exists (uploads should never contain PHP)
• Admin users you do not recognize, or wp_users entries with creation dates that don't match the site history
• wp-config.php modified recently with no deploy
• mu-plugins/ contains files you did not place there
• Posts/options contain base64-encoded blobs, eval(, gzinflate(, str_rot13(, or hex-escape strings
• The site serves a different language/title to bots than to humans (cloaking)
• A shared-hosting account contains 1 dirty sub and N other subs — assume lateral movement until proven otherwise

Detection — file-system indicators

Run these from the doc-root. Adjust paths for the hosting layout.

# 1. Any PHP in uploads is suspicious — production WP never writes PHP there
find wp-content/uploads -name '*.php' -o -name '*.phtml' -o -name '*.phar' 2>/dev/null

# 2. Recent PHP changes outside core/plugins/themes you control
find . -name '*.php' -mtime -30 -not -path './wp-content/cache/*' 2>/dev/null

# 3. Common webshell signatures (Sid Gifari, WSO, FilesMan, b374k, c99)
grep -rEl 'Sid[ _]Gifari|WSO [0-9]|FilesMan|c99shell|b374k|eval\(base64_decode|eval\(gzinflate|@eval\(\$_(POST|GET|REQUEST|COOKIE)' \
  --include='*.php' --include='*.phtml' . 2>/dev/null

# 4. Suspicious file names dropped by mass-compromise tools
find . \( -name 'wp-conflg.php' -o -name 'wp-info.php' -o -name 'radio.php' \
      -o -name 'about.php' -o -name 'license.php' -o -name 'lock360.php' \) 2>/dev/null

# 5. Files with execute-but-no-owner mismatch (often dropped by web user via writable dir)
find . -name '*.php' -user www-data 2>/dev/null  # adjust user for the host

The single highest-value query is (1): a PHP file in uploads/ is a near-certain indicator. Investigate every hit.