How-To: Clean Up a WordPress Site After Your Web Host Gets Breached

When a host like DreamHost says FTP/SFTP passwords were stolen, resetting the password is step one, not the last step. Here’s a checklist for a WordPress site.

1. Lock the doors

• Change FTP/SFTP, hosting panel, database and WordPress admin passwords, each one unique
• Switch to SFTP or SSH keys if your host allows it, and turn off plain FTP
• Turn on two-factor for the hosting panel and every WordPress admin

2. Look for changes

• Run wp core verify-checksums and wp plugin verify-checksums --all with WP-CLI to find modified core and plugin files
• List recently changed files: find . -type f -mtime -90 -name "*.php"
• Check wp-content/uploads for PHP files. There shouldn’t be any
• Look over wp-config.php, .htaccess and mu-plugins for anything you don’t recognize

3. Check accounts and mail

• wp user list --role=administrator: remove any admins you didn’t create
• Check webmail forwarding rules and filters
• Rotate the salts in wp-config.php to log everyone out

4. Keep a known-good copy

Keep off-host backups with versions so you can compare against a copy from before the breach.

Back up first: take a full file and database backup before you change or delete anything.

God Bless, and Happy hacking!

References & Further Reading

• DreamHost confirms data breach exposed FTP logins and webmail sessions (BleepingComputer)
• Hardening WordPress (WordPress Developer Resources)