Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I am looking for a way to edit or reset the .htaccess for a wordpress site without access to the filesystem, working only with the wp-admin web interface and/or plugins* (see below for the back story if you're interested or think it's relevant).

A quick search on WordPress SE revealed something promising:

Plugin to edit htaccess file

I tried installing both the plugins suggested there, but neither worked** (see below for explanation of why these plugins didn't work, if you think it's relevant).

And searching on google, the only other promising option I could find is a plugin called "WP htaccess Editor", which claims to do exactly what I want -- simply provide a direct textbox editor for the .htaccess. But I can't install this plugin. When I try, it fails, saying "Could not create directory. wp-content/upgrade/wp-htaccess-editor.1.1.12/wp-htaccess-editor".

Any ideas on how I can change or remove the .htaccess with a plugin or some aspect of the wp-admin interface?


*Back story:

My friend recently discovered that her WordPress site has been compromised, containing malware redirects. She doesn't know where it is hosted or who is hosting it. Apparently someone else set it up for her several years ago, and she's been unable to contact him recently. So I'm stuck working only with the wp-admin web interface.

Using a plugin called "BackupBuddy" I managed to download a copy of their site and discovered the source of the malware. The .htaccess contains redirects to malware sites.

The problem is, I can't for the life of me figure out how to remove these lines. Again, I don't have access to the file system (I wish I did, it would be such a simple fix).


**Explanation for why the plug-ins I tried didn't work:

Firstly, the wordpress plugin admin interface for the most part doesn't work for me, because almost all pages (including the plugin install pages) redirect because of the malware lines in htaccess. Luckily, the "upload zip file" plugin install method still works, so that's how I installed the plugins.

When I tried the first listed plugin ("WP htaccess Control"), it let me go to the plugin settings and fill in all the options and even showed me the resulting output that would supposedly be written to .htaccess (and the output looked fine). The problem is, clicking "Save Changes", though reporting success, appeared to do nothing at all to the redirects. Another download via backup buddy confirmed that the .htaccess file was not modified.

The second plugin ("All-in-one htaccess Plugin") is a Catch-22; before doing anything it requires you to launch a series of tests, but clicking the "Initiate Tests" button on the plugin settings page leads to a page that is redirected to the maleware page by the .htaccess. So it's impossible for me to use this plugin.

share|improve this question
    
Hacking questions/fixes are outside the scope of WPSE. See the FAQ: wordpress.stackexchange.com/faq#close Beyond that, you can do absolutely nothing without file system access. –  songdogtech Jul 11 '12 at 18:26
    
@EAMann, not sure how this applies, since it seems that prohibition is under a sub-heading that doesn't apply here. Posted a meta for clarification: meta.wordpress.stackexchange.com/questions/1170/… –  Ben Lee Jul 11 '12 at 18:32
1  
I have edited the question, but I think it is still too long. On the other hand it is a good example for documenting the asker’s research efforts, so I’ll leave it as is for now. –  toscho Jul 11 '12 at 18:51
2  
@toscho, I further edited the question, putting all the meat of the question at the top and putting the back story and research efforts towards the bottom. Doesn't make it shorter, but hopefully is better structured this way. –  Ben Lee Jul 11 '12 at 19:06
    
Close-voted as too localized: "This question is unlikely to help any future visitors; it is only relevant to...an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet." The only way it gets around the restriction against recovering-from-hacks question is that it is narrowly tailored to recovering from a hack by using a Plugin to get around the "hands-on involvement" clause. –  Chip Bennett Aug 2 '12 at 14:01
show 1 more comment

2 Answers 2

up vote 7 down vote accepted

You can delete files per plugin if the server’s PHP user has write permissions. The trick is to delete it immediately on activation. Here is a basic sample code:

<?php # -*- coding: utf-8 -*-
/**
 * Plugin Name: Delete .htaccess
 * Description: Deletes the .htaccess file on activation, deactivates itself then.
 * Plugin URI:  http://wordpress.stackexchange.com/q/58183/73
 *
 * Delete .htaccess, Copyright (C) 2012 Thomas Scholz
 */

register_activation_hook( __FILE__, 'wpse_58183_delete_htaccess' );
add_action( 'admin_notices', 'wpse_58183_admin_notice' );

function wpse_58183_delete_htaccess()
{
    $root = trailingslashit( $_SERVER['DOCUMENT_ROOT'] );
    unlink( $root . '.htaccess' );
}

function wpse_58183_admin_notice()
{
    echo '<div class="updated"><p><code>.htaccess</code> deleted.<br>Plugin deactivated.</p></div>';
    deactivate_plugins( basename( __FILE__ ) );
}

Download as ZIP file or see the code on GitHub.

But move the site to another server! As long as you cannot control the files per SSH or FTP chances are the site will be hacked again.

share|improve this answer
    
This did the trick, thanks! To be safe, I inspected the contents of the zip file before installing, to make sure you didn't inject any malware ;). –  Ben Lee Jul 11 '12 at 18:49
    
Very good. Don’t trust anybody. :) –  toscho Jul 11 '12 at 18:51
add comment

There really isn't a whole lot of options. (that I personally know of). If you are limited to wp-admin, this is what I'd do: see if you can find who is hosting it and see if you can find a hosting ip address or contact somebody. Firstly can you run a whois on the domain? Sometimes contact information is listed within there. If your friend's contact info is there, then try going to whoishostingthis.com and typing in the domain to see who the host is and see about contacting them. Most shared hosting companies can help you in some way. Lastly, I've known a few people to use Sucuri Security to remove malware from websites with high success. It however will set your friend back $89.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.