Wp-config.php Malicious or Unsafe

Hi @hiphopculture,

If Wordfence is reporting a specific infection, there is a good chance this is a real infection that needs to be cleaned. To confirm, are you able to include a screenshot using a service such as Snipboard of the scan results reporting the backdoor so that I can see the specifics? Feel free to obscure your site address if it appears on the screenshot using the editing tools available.

I will get back to you ASAP once I see that.

Peter.

Sure, here it is.

Screenshot

Hi @hiphopculture,

These strings are used in malware where the code has been obfuscated. The scan has flagged it to notify you for this reason. There can be false positives from time to time, but we think it’s best to get it checked out in this case.

Please can you please drop an email to samples @ wordfence . com with your wp-config.php attached, and a link to this ticket so that my colleagues know you have been speaking with me. It’s very important that you first remove your database access credentials and the Authentication Unique Keys and Salts.

Thanks,

Peter.`

Hi @hiphopculture,

I understand that you were in touch with our team through the samples email, and they gave you further advice as it seemed the include code had been inserted into your site as you suspected.

For the benefit of yourself and others who may have experienced an issue such as this, I will provide our site-cleaning instructions should you need to use them starting with our checklist: https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/

Make sure and get all your plugins and themes updated and update WordPress core too. If you are on an older branch (WordPress 4.x etc) because you wanted to wait before installing the latest version because of Gutenberg or a custom theme compatibility you still need the latest update in that version. Those can be found here:
https://www.ads-software.com/download/releases/

WordPress sometimes patches their older releases if they find a vulnerability so make sure to update your version if needed. We, of course, recommend that you update to the latest version.

As a rule, any time I think someone’s site has been compromised I also tell them to update their passwords for their hosting control panel, FTP, WordPress admin users, and database. Make sure and do this.

Additionally you might find the WordPress Malware Removal section in our free Learning Center helpful.

If you are unable to clean this on your own there are paid services that will do it for you. Wordfence offers one and there are others. Regardless if you choose to clean it yourself or let someone else do so, we recommend that you make a full backup of the site beforehand.

Thanks again,

Peter.