A /proc folder in wp-content?

Question

I inherited a WordPress site that a series of consultants built and who are all long-gone. As I grep'd to find where they defined a strange shortcode they keep using, grep dumped a sequence of errors as it tried to read files from ABSPATH/wp-content/proc.

Comparing the contents and dates of ABSPATH/wp-content/proc to the real /proc on my server, I suspect somebody copied over the contents of their /proc during development (but why?).

Before I delete it:

1. I want to be sure this isn't needed by WordPress for some weird situation I haven't ever encountered. Grepping through the files in the custom theme, I don't see any references to the directory. A few web searches also turned up nothing, so I think I'm safe here...but...
2. I am functionally literate with Linux but far from expert, so I hoped somebody could tell me how to check this rogue /proc directory to be sure deletion won't damage my operating system because of a link or reference or...something I don't know about yet.

Answer 1

Check the .htaccess file first, and the Settings > General area first to make sure it's not a level of security-by-obscurity that one of the initial users tried to implement.

The easiest way is to change the name of the folder then see if your site breaks, since you can rename a folder a lot faster than moving directories, deleting then re-uploading, etc.

You could also get a clean WP and check what the core file names are, then make sure that none of the /proc folder content matches that (or it still exists in the core folders in your installation).

I'd have to recommend to start documentation for the site, that way if someone works on it after you they won't be scratching their heads in confusion either. :)

Answer 2

Are you able to ssh into the server and do a proper ls? I've seen a hacked server where someone made symbolic links to folders outside of the website root, in an attempt to expose some system data. Vague memories now, but if you use Plesk's or cPanel's file browser maybe you can check that / delete the symlink (don't delete via an FTP client that will recurse into the symlink's target!)

Answer 3

Thanks to everybody for the advice. Here's what I did and based upon comments and further web searches. It appears to have worked out. I'm sharing with a new answer because I see this process as useful for many "is this being used?" maintenance situations, such as with random files that might find their way into the wrong directories.

1. I ran the stat command against several of the files in the directory and checked the access date to see if any of the files were recently used.
2. Next, I compared contents of the two /proc directories, using diff to help with this. I also manually reviewed the contents of the rogue /proc directory to be sure no WordPress files were hiding in there.
3. When the results to this point looked clear, I used the mv command to rename the directory as comments suggested.
4. I "tested, tested, tested" both WordPress and OS functionality. I also rebooted the server, just in case.
5. Finally, after taking one last backup, I deleted the renamed directory. I tested again. I rebooted again. No problems. Yay.

In this situation, everything worked out OK. Somebody probably copied their /proc along with the source files so it didn't really impact on my server. Looking at these steps, it is clear the same techniques will be useful when I'm trying to figure out if any other directories or files are in use on my system. Given how often I find strange stuff in WordPress installs that I inherit, this will probably be useful as it reduces guesswork.