SiteHealth

Several client WordPress sites on the same shared server could be compromised by malware. Detecting and restoring each one by hand was slow.

A colleague wrote the first draft for a single site; Edson turned it into a set of scripts for many sites. One script checks the official WordPress checksums; another, meant to run from cron, logs each failure, picks the right cPanel backup and swaps the public folder. It is a prototype: the last commit says it still had to be tested on the server.

1. 01

   Official checksums instead of antivirus

   WP-CLI compares core files with the checksums published by WordPress. It is fast, needs no malware signatures and gives a clear answer: healthy or not.

2. 02

   Backup chosen by day of the week

   The script follows the cPanel rotation (daily, weekly) to fetch the most recent backup that still exists.

3. 03

   Keep the compromised copy

   Before restoring, the infected public folder is moved aside instead of deleted, so what happened can be analysed.

No publishable screens: the system needs real data to run or is no longer online.

• Bash
• WordPress

WordPress installations on the monitored list

9

Automating a restore is easy to write and hard to prove. Today it would start with a test server and send an alert before swapping any folder.