wordpress-hardeninglisted

# WordPress Hardening A defensive-security skill for diagnosing and hardening WordPress installations, with a focus on **shared-hosting environments where one compromised sub can pivot across the whole account**. ## When to invoke Trigger this skill when any of these signals appear: - `wp-content/uploads/**/*.php` exists (uploads should never contain PHP) - Admin users you do not recognize, or `wp_users` entries with creation dates that don't match the site history - `wp-config.php` modified recently with no deploy - `mu-plugins/` contains files you did not place there - Posts/options contain base64-encoded blobs, `eval(`, `gzinflate(`, `str_rot13(`, or hex-escape strings - The site serves a different language/title to bots than to humans (cloaking) - A shared-hosting account contains 1 dirty sub and N other subs — assume lateral movement until proven otherwise ## Detection — file-system indicators Run these from the doc-root. Adjust paths for the hosting layout. ```bash # 1. Any PHP in uploads is suspicious — production WP never writes PHP there find wp-content/uploads -name '*.php' -o -name '*.phtml' -o -name '*.phar' 2>/dev/null # 2. Recent PHP changes outside core/plugins/themes you control find . -name '*.php' -mtime -30 -not -path './wp-content/cache/*' 2>/dev/null # 3. Common webshell signatures (Sid Gifari, WSO, FilesMan, b374k, c99) grep -rEl 'Sid[ _]Gifari|WSO [0-9]|FilesMan|c99shell|b374k|eval\(base64_decode|eval\(gzinflate|@eval\(\$_(POST|GET|REQUEST|COOK