{"id":176,"date":"2026-05-29T22:18:06","date_gmt":"2026-05-29T22:18:06","guid":{"rendered":"https:\/\/blog.offshorekaka.in\/?p=176"},"modified":"2026-08-27T05:43:50","modified_gmt":"2026-08-27T05:43:50","slug":"malware-scan-wordpress-offshore-hosting","status":"publish","type":"post","link":"https:\/\/offshorekaka.in\/blog\/malware-scan-wordpress-offshore-hosting\/","title":{"rendered":"WordPress Malware Scanning on Offshore Hosting"},"content":{"rendered":"<div class=\"ok-pro-panel\">\n<p><span class=\"ok-pro-kicker\">Server Security<\/span><\/p>\n<h2>How you find out you have a problem<\/h2>\n<p>Almost nobody discovers a WordPress infection by scanning for it. They find out because Google flags the site, because a customer says the pages redirect to a betting site on mobile, or because the host suspends the account for sending spam. By then the malware has usually been sitting there for weeks.<\/p>\n<p>This guide covers finding it on an <a href=\"https:\/\/offshorekaka.in\/offshore-web-hosting\/\">offshore hosting<\/a> account, cleaning it properly, and closing the hole it came in through. That last part is the one people skip, which is why the same site gets reinfected three days later.<\/p>\n<div class=\"ok-pro-grid\">\n<div class=\"ok-pro-card\"><strong>Time<\/strong><span>A scan takes minutes. A proper clean takes an hour.<\/span><\/div>\n<div class=\"ok-pro-card\"><strong>You need<\/strong><span>SSH, or File Manager plus a security plugin.<\/span><\/div>\n<div class=\"ok-pro-card\"><strong>First move<\/strong><span>Take a backup, even of the infected site.<\/span><\/div>\n<\/div>\n<\/div>\n<div class=\"ok-toc\"><strong>On this page<\/strong><a href=\"#signs\">Signs worth checking<\/a><a href=\"#backup\">Back up before you touch anything<\/a><a href=\"#scan\">Scanning the files<\/a><a href=\"#find\">Finding it by hand<\/a><a href=\"#clean\">Cleaning up<\/a><a href=\"#hole\">Closing the hole<\/a><a href=\"#faq\">FAQ<\/a><\/div>\n<h2 id=\"signs\">Signs worth checking<\/h2>\n<ul>\n<li>Pages redirect somewhere else, but only on mobile, or only for visitors arriving from Google.<\/li>\n<li>Google Search Console shows pages you never wrote, often in Japanese or about pharmacy products.<\/li>\n<li>New admin users you did not create.<\/li>\n<li>The server is sending mail you know nothing about.<\/li>\n<li>Files in <code>wp-content\/uploads<\/code> with a <code>.php<\/code> extension.<\/li>\n<\/ul>\n<p>That last one is the strongest single signal. The uploads folder is for media. A PHP file living in it is a backdoor roughly nine times out of ten.<\/p>\n<h2 id=\"backup\">Back up before you touch anything<\/h2>\n<p>Take a full copy of the site and database before you delete a single file, even though it is infected. Two reasons. If you delete something that turns out to be a real plugin file, you need it back. And if you ever want to work out how they got in, the evidence is in those files.<\/p>\n<pre><code>tar czf \/root\/infected-$(date +%F).tgz \/var\/www\/yourdomain.com\nmysqldump -u dbuser -p dbname &gt; \/root\/infected-$(date +%F).sql<\/code><\/pre>\n<p>Store it off the server. Our <a href=\"https:\/\/offshorekaka.in\/blog\/backup-strategy-for-offshore-servers\/\">backup guide<\/a> covers doing this properly on a schedule.<\/p>\n<h2 id=\"scan\">Scanning the files<\/h2>\n<p>ClamAV is free, it runs on any Linux box, and it catches the common web shells. Install it and update the signature database first, because the packaged database is usually months old.<\/p>\n<pre><code>apt install clamav -y\nfreshclam\nclamscan -ri --exclude-dir='^\/proc' \/var\/www\/yourdomain.com<\/code><\/pre>\n<figure class=\"wp-block-image size-large ok-inline-visual\"><img decoding=\"async\" src=\"https:\/\/offshorekaka.in\/blog\/wp-content\/uploads\/2026\/08\/ok-malware-scan-run.webp\" alt=\"ClamAV scan output showing one infected PHP webshell found inside the WordPress uploads directory\" loading=\"lazy\" width=\"2296\" height=\"800\"><figcaption>One hit, and it is exactly where you would expect: a PHP file inside uploads.<\/figcaption><\/figure>\n<p>Be realistic about what ClamAV gives you. It is signature based, so it catches known families and misses anything freshly obfuscated. A clean scan is good news, not proof. Treat it as one input, not a verdict.<\/p>\n<h2 id=\"find\">Finding it by hand<\/h2>\n<p>The manual checks catch things the scanner does not, and they take about a minute.<\/p>\n<pre><code>find public_html\/wp-content\/uploads -name '*.php' -o -name '*.phtml'\nfind public_html -type f -name '*.php' -mtime -3<\/code><\/pre>\n<figure class=\"wp-block-image size-large ok-inline-visual\"><img decoding=\"async\" src=\"https:\/\/offshorekaka.in\/blog\/wp-content\/uploads\/2026\/08\/ok-suspicious-php-find.webp\" alt=\"Terminal find command locating a PHP file in the uploads folder and listing recently modified PHP files\" loading=\"lazy\" width=\"2296\" height=\"518\"><figcaption>Two commands that find most backdoors faster than a full scan does.<\/figcaption><\/figure>\n<p>The second command lists PHP files changed in the last three days. On a site you have not touched, that list should be empty or close to it. Anything on it deserves a look.<\/p>\n<p>A few more patterns worth grepping for. None of these are proof on their own, since legitimate code occasionally uses them, but together with a recent modification date they are a strong hint:<\/p>\n<pre><code>grep -rl \"eval(base64_decode\" public_html\ngrep -rl \"gzinflate(base64_decode\" public_html\ngrep -rl \"$_POST['pass']\" public_html<\/code><\/pre>\n<p>Also check <code>wp-config.php<\/code> and <code>.htaccess<\/code>. Injections love both, and people rarely open them. In <code>.htaccess<\/code>, look for redirect rules keyed on the user agent or the referrer, which is how a site redirects Google visitors and mobile users while looking normal to you.<\/p>\n<h2 id=\"clean\">Cleaning up<\/h2>\n<p>Replacing is safer than editing. WordPress core, plugins and themes are all downloadable, so do not try to surgically remove injected lines from them.<\/p>\n<ol>\n<li><strong>Reinstall core.<\/strong> In the dashboard, Updates then Reinstall Now. Or over SSH, <code>wp core download --force<\/code>.<\/li>\n<li><strong>Reinstall every plugin and theme<\/strong> from the repository. Delete anything you do not actively use rather than leaving it deactivated, because a deactivated plugin with a vulnerability is still a file on the disk that can be reached directly.<\/li>\n<li><strong>Delete the files that do not belong<\/strong>, starting with the PHP files in uploads.<\/li>\n<li><strong>Check the database.<\/strong> Look in <code>wp_users<\/code> for admin accounts you did not create, and in <code>wp_options<\/code> at <code>siteurl<\/code> and <code>home<\/code> to make sure they still point at your own domain.<\/li>\n<li><strong>Rotate every credential.<\/strong> All admin passwords, the database password in <code>wp-config.php<\/code>, FTP and SSH keys, and the WordPress salts. Generate new salts and paste them into <code>wp-config.php<\/code>. That logs out everyone, including whoever else was logged in.<\/li>\n<\/ol>\n<figure class=\"wp-block-image size-large ok-inline-visual\"><img decoding=\"async\" src=\"https:\/\/offshorekaka.in\/blog\/wp-content\/uploads\/2026\/08\/ok-gui-wp-updates.webp\" alt=\"WordPress Updates screen showing core and plugin updates\" loading=\"lazy\" width=\"2552\" height=\"2800\"><figcaption>Reinstall rather than patch. Core, plugins and themes are all downloadable.<\/figcaption><\/figure>\n<h2 id=\"hole\">Closing the hole<\/h2>\n<p>If you clean the site and change nothing else, expect it back within the week. The way in is nearly always one of these:<\/p>\n<ul>\n<li><strong>An outdated plugin.<\/strong> By far the most common. Check the plugin against the WPScan vulnerability database before you reinstall it. If it has been abandoned by its author, replace it rather than updating it.<\/li>\n<li><strong>A weak or reused admin password.<\/strong> Fixed by the rotation above, plus two factor authentication.<\/li>\n<li><strong>Loose file permissions.<\/strong> Directories should be 755, files 644, and <code>wp-config.php<\/code> tighter still.<\/li>\n<li><strong>The server itself was never hardened.<\/strong> If the attacker came in over SSH rather than through WordPress, cleaning the site changes nothing. Our <a href=\"https:\/\/offshorekaka.in\/blog\/secure-offshore-vps-server-checklist\/\">VPS security checklist<\/a> covers that side.<\/li>\n<\/ul>\n<figure class=\"wp-block-image size-large ok-inline-visual\"><img decoding=\"async\" src=\"https:\/\/offshorekaka.in\/blog\/wp-content\/uploads\/2026\/08\/ok-file-permissions.webp\" alt=\"Terminal showing directory and file permission listings and the find commands that reset them\" loading=\"lazy\" width=\"2296\" height=\"428\"><figcaption>Resetting permissions across the whole install in three commands.<\/figcaption><\/figure>\n<p>One more worthwhile step: stop PHP from running inside the uploads folder at all. Then even if a backdoor is uploaded again, it cannot execute. On nginx:<\/p>\n<pre><code>location ~* \/wp-content\/uploads\/.*.php$ { deny all; }<\/code><\/pre>\n<figure class=\"wp-block-image size-large ok-inline-visual\"><img decoding=\"async\" src=\"https:\/\/offshorekaka.in\/blog\/wp-content\/uploads\/2026\/08\/ok-gui-wp-users.webp\" alt=\"WordPress Users list showing account roles\" loading=\"lazy\" width=\"2508\" height=\"286\"><figcaption>Check this list. An admin you did not create is the clearest sign.<\/figcaption><\/figure>\n<h2 id=\"test\">How to check the clean worked<\/h2>\n<ol>\n<li>Rescan with ClamAV and confirm zero infected files.<\/li>\n<li>Run the uploads and recently modified searches again.<\/li>\n<li>Open the site in a private window on a phone, and again with a Google referrer, since that is when the redirect usually fires.<\/li>\n<li>Check the admin user list for accounts you do not recognise.<\/li>\n<li>In Search Console, request a review under Security Issues if the site was flagged.<\/li>\n<li>Come back in three days and run the recently modified search once more.<\/li>\n<\/ol>\n<h2 id=\"trouble\">When something breaks<\/h2>\n<table>\n<thead>\n<tr>\n<th>What you see<\/th>\n<th>Why<\/th>\n<th>Fix<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Site is blank after cleaning<\/td>\n<td>A file the theme needed got deleted<\/td>\n<td>Reinstall the theme, then restore just that file from the backup<\/td>\n<\/tr>\n<tr>\n<td>Redirect only happens on mobile<\/td>\n<td>Injected rule in <code>.htaccess<\/code> or a mu-plugin<\/td>\n<td>Check <code>.htaccess<\/code> and <code>wp-content\/mu-plugins<\/code><\/td>\n<\/tr>\n<tr>\n<td>Infection comes back within days<\/td>\n<td>The way in was never closed<\/td>\n<td>Update or remove the vulnerable plugin, rotate all credentials, block PHP in uploads<\/td>\n<\/tr>\n<tr>\n<td>ClamAV finds nothing but the site clearly misbehaves<\/td>\n<td>Obfuscated code with no signature, or an injection in the database<\/td>\n<td>Use the manual searches, and check <code>wp_options<\/code> and <code>wp_posts<\/code><\/td>\n<\/tr>\n<tr>\n<td>clamscan is killed partway through<\/td>\n<td>Not enough memory on a small VPS<\/td>\n<td>Scan one directory at a time, or add swap<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2 id=\"checklist\">Checklist<\/h2>\n<ul>\n<li>Full backup of files and database taken before touching anything.<\/li>\n<li>ClamAV database updated, then a full scan run.<\/li>\n<li>Uploads folder searched for PHP files.<\/li>\n<li>Recently modified PHP files reviewed.<\/li>\n<li><code>wp-config.php<\/code> and <code>.htaccess<\/code> read line by line.<\/li>\n<li>Core, plugins and themes reinstalled rather than patched.<\/li>\n<li>Every password, key and salt rotated.<\/li>\n<li>The original way in identified and closed.<\/li>\n<li>Re-checked three days later.<\/li>\n<\/ul>\n<div class=\"ok-cta-box\">\n<p><strong>Moving off a compromised host?<\/strong><\/p>\n<p>OffshoreKaka runs Imunify on our shared platform and gives you full root on VPS plans, so you can scan whenever you want rather than waiting for a support reply.<\/p>\n<p><a class=\"btn ok-cta-link\" href=\"https:\/\/offshorekaka.in\/offshore-web-hosting\/\">See the hosting plans<\/a><\/p>\n<\/div>\n<h2 id=\"faq\">FAQ<\/h2>\n<h3>Is a security plugin enough on its own?<\/h3>\n<p>Wordfence and similar plugins are useful and worth running, but they are PHP running inside the site they are trying to protect. If the attacker got there first, they can hide from it. A scan from outside WordPress, at the file level, sees things the plugin cannot.<\/p>\n<h3>Should I just restore from a backup instead?<\/h3>\n<p>Only if you are certain the backup predates the infection, and most people are not, because the malware sat quietly for weeks first. Restoring a backup that already contains the backdoor puts you straight back where you started. Either way you still have to close the hole.<\/p>\n<h3>Does getting hacked hurt my rankings?<\/h3>\n<p>Yes, and this is one of the few security things that genuinely does. If Google flags the site as compromised, the listing gets a warning label and traffic drops immediately. Recovery takes a review request and then time. Preventing it is much cheaper than fixing it.<\/p>\n<h3>What should I send support if I am stuck?<\/h3>\n<p>The domain, the exact path of the files you found, the scan output, when you first noticed something wrong, and what you have already changed. Do not send passwords.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Almost nobody finds an infection by scanning. Here is how you actually find out, how to clean it, and how to close the way in.<\/p>\n","protected":false},"author":1,"featured_media":1023,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-176","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server-security"],"_links":{"self":[{"href":"https:\/\/offshorekaka.in\/blog\/wp-json\/wp\/v2\/posts\/176","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/offshorekaka.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/offshorekaka.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/offshorekaka.in\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/offshorekaka.in\/blog\/wp-json\/wp\/v2\/comments?post=176"}],"version-history":[{"count":5,"href":"https:\/\/offshorekaka.in\/blog\/wp-json\/wp\/v2\/posts\/176\/revisions"}],"predecessor-version":[{"id":1009,"href":"https:\/\/offshorekaka.in\/blog\/wp-json\/wp\/v2\/posts\/176\/revisions\/1009"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/offshorekaka.in\/blog\/wp-json\/wp\/v2\/media\/1023"}],"wp:attachment":[{"href":"https:\/\/offshorekaka.in\/blog\/wp-json\/wp\/v2\/media?parent=176"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/offshorekaka.in\/blog\/wp-json\/wp\/v2\/categories?post=176"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/offshorekaka.in\/blog\/wp-json\/wp\/v2\/tags?post=176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}