WordPress RCE Aftermath: Incident Response Checklist

If your WordPress site has been hit by an unauthenticated remote code execution (RCE) attack, you need to act fast to contain the damage, find how the attacker got in, and restore a clean, secure site. This checklist walks you through the immediate steps to take after discovering an RCE compromise, from isolating the server to auditing logs and rebuilding from trusted backups.

First Response: Contain the Breach

The moment you suspect an RCE, your priority is to stop the attacker from doing more damage. Do not log into the WordPress admin panel or start deleting files yet—that can alert the attacker and destroy evidence. Instead:

• Take the site offline or block external access using a firewall rule, .htaccess, or your hosting control panel. A simple maintenance page or a 503 status can buy you time.
• Change all passwords immediately: hosting account, FTP/SFTP, database user, and WordPress admin accounts. Use a password manager to generate long, unique passwords.
• Revoke all active sessions by deleting the wp_session_tokens user meta or using a security plugin that forces logout.
• Rotate any API keys, SMTP credentials, or third-party service tokens stored in wp-config.php or environment files.
• If you have a snapshot or backup from before the attack, make a copy of the current compromised site for forensic analysis before you restore.

Identify the Entry Point

An unauthenticated RCE means the attacker exploited a vulnerability in a plugin, theme, or core file without needing to log in. Common vectors include vulnerable plugins like file managers, page builders, or contact forms, as well as outdated themes. To find the entry point:

• Check your server access logs for POST requests to suspicious files like wp-ajax.php, wp-cron.php, or xmlrpc.php around the time of the compromise.
• Look for unusual user agent strings, requests with long parameter values, or attempts to access wp-content/uploads with PHP extensions.
• Review the list of installed plugins and themes and cross-reference with known CVE databases (e.g., WPScan’s vulnerability database) to see which ones have recent RCE disclosures.
• Check wp-content/uploads for PHP files—attackers often upload a webshell here.

Preserve Evidence for Forensics

Before you clean anything, make a forensic copy of the server and database. This is critical if you need to understand the attack or if law enforcement or your hosting provider requires evidence. At minimum:

• Download a full file backup via SFTP or your host’s file manager.
• Export the entire database using phpMyAdmin or a command-line tool like mysqldump.
• Copy the server access and error logs for the past 30 days.
• Note the exact date and time you first noticed the compromise.

Clean the Site Thoroughly

After you have evidence, you can start cleaning. The safest approach is to wipe everything and reinstall from a clean backup, but if you must clean in place, follow these steps:

1. Delete all suspicious files, especially any PHP scripts in wp-content/uploads or root directories that you did not put there.
2. Update WordPress core, all plugins, and themes to the latest versions—or better, reinstall them fresh from wordpress.org.
3. Scan the database for injected content: look for eval(), base64_decode, or gzinflate in wp_options and wp_posts tables.
4. Remove any unknown admin users and reset all user passwords.
5. Check wp-config.php for modified database credentials or added code.

Restore from a Known-Good Backup

If you have a clean backup from before the attack, restoring it is often faster and safer than trying to clean a fully compromised site. However, be careful:

• Ensure the backup predates the attack (check file modification dates and logs).
• After restoring, change the database password and update the wp-config.php accordingly.
• Re-apply all security patches and update plugins/themes immediately after restore, because the backup may contain the same vulnerability.
• Test the site thoroughly: check all forms, login, and file uploads.

Harden Your WordPress Security

Once the site is clean, you need to prevent a repeat attack. Implement these security measures:

• Enable a web application firewall (WAF) that blocks known exploit patterns.
• Disable file editing in the admin by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php.
• Implement two-factor authentication (2FA) for all admin accounts.
• Limit login attempts and block brute-force attacks.
• Regularly update WordPress core, themes, and plugins—set up automatic updates where possible.
• Remove unused plugins and themes entirely.

Monitor for Re-Infection

After recovery, keep a close eye on your site for signs of a second attack. Set up monitoring for:

• New admin users being created.
• Unexpected file modifications in core WordPress directories.
• Unusual outbound traffic from your server (could indicate a backdoor).
• Google Search Console alerts for malware or spam.

Frequently Asked Questions

How do I know if my WordPress site was actually compromised by an RCE?

Signs include unexpected admin users, files in uploads with PHP extensions, strange redirects, or a sudden spike in server resource usage. You can also run a security scan with tools like Wordfence or Sucuri, but these may not catch everything—manual log review is often needed.

Can I just delete the malicious files and keep using the site?

Deleting visible malicious files is not enough because attackers often leave backdoors in legitimate-looking files or in the database. You should assume the worst and restore from a clean backup or do a thorough audit of every file and database entry.

What if I don’t have a clean backup?

If you lack a backup, you must manually clean the site: reinstall core, plugins, and themes from official sources, scan for malicious code, and change all credentials. This is time-consuming but can work. Going forward, always keep off-site backups.

Should I report the attack to my hosting provider?

Yes, contact your hosting provider immediately. They can help isolate the server, provide logs, and may have security tools to assist. They also need to know if the attack is part of a larger campaign.

How long does it take to recover from a WordPress RCE attack?

The timeline varies. A simple restore from a clean backup can take a few hours, while a full forensic investigation and manual cleaning can take days. The key is to act methodically and not rush the cleanup.

Can I prevent an RCE attack entirely?

No method is 100% foolproof, but keeping everything updated, using a WAF, and following security best practices dramatically reduces the risk. RCE vulnerabilities are often patched quickly, so staying current is your best defense.

Related

• Google Play Music to YouTube Music Transfer Tool
• IBM Bob vs GitHub Copilot Business: On-Premises Data Control
• AI Boom vs. Dot-Com Crash: What Developers Should Watch