0

My site has been hacked and I want to start with a clean slate, but when I delete some of the folders, the site stops working.

So how do I know what I can delete safely or not? enter image description here

Here is the list of files:

  1cache
  advanced-cache.php
  ai1wm-backups
  aiowps_backups
  cache
  index.php
  plugins
  themes
  upgrade
  uploads
  w3tc-config
  wflogs
  wp-cache-config.php

Here are the plugins used:

 akismet.4.0.8
 all-in-one-schemaorg-rich-snippets
 all-in-one-wp-security-and-firewall
 child-theme-generator
 disable-comments
 google-sitemap-generator
 index.php
 ninja-forms
 official-statcounter-plugin-for-wordpress
 simple-wp-sitemap
 siteorigin-panels
 so-css
 so-widgets-bundle
 sucuri-scanner
 velvet-blues-update-urls
 wordfence
 wordpress-seo
 wp-sitemap-page
 wp-super-cache
3

The only safe thing to do is to restore the site from a known clean backup. Hacker could have inserted backdoor users or other vulnerabilities in your DB, something you are not going to be able to find based on any list of files, which means that even if you remove all files which obviously are "bad", it will not take long before the hacker will hack your site again.

Once restored, remove write permissions that the web server might have from all directories except for the uploads directory. This way even if you are breached again at least the hacker will not be able to modify your code files.

2
  • Right now this is on localhost, Xampp, and I am changing hosting company, so starting from scratch, will change permissions as you recommend also, but about the folders...what can I delete safely and the still loads? I mean, what are the minimum requirements to run the site? Some folders I deleted, then the site crashed – Bruno Vincent Sep 16 '18 at 5:31
  • 1
    In theory you can delete all of wp-content except for the uploads directory. You might need to reinstall plugins and theme and refresh the core translation if you use localized version. OTOH it does not seem like any of the files you list obviously do not belong there, but this is again why you need to restore from backup as hackers are not idiots and when possible they will either modify files or add files which look legit. – Mark Kaplun Sep 16 '18 at 5:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.