Your site was hacked. You ran a scanner, deleted what it reported, and now you wonder what else to look at. Aftersweep \u2013 After-Hack Checklist goes through ten places where a hack usually leaves traces and tells you, item by item, what it found and what it compared it to. It also tells you what it did not look at.<\/p>\n\n
It never says \"your site is fine\". It lists findings, each with a level:<\/p>\n\n
At the top of the report: \"N anomalies, N suspects, N to identify, N points not looked at\". For each finding, the report says what you can check by hand or show to your host.<\/p>\n\n
The plugin changes nothing on your site. It does not delete, move or edit any file, user, content or setting. It only writes its own options and transients (names starting with The report always ends with this list, so you know where it stopped:<\/p>\n\n Checks 1 and 2 need the checksums published by WordPress.org. The plugin downloads them only if you tick \"Download the checksums from api.wordpress.org and downloads.wordpress.org\" next to the \"Run the check\" button. The box is unticked the first time; your choice is remembered. Unticked, checks 1 and 2 are listed under \"not looked at\". Details in the FAQ and in the Privacy section.<\/p>\n\n An optional, separate Pro plugin adds a reference snapshot with a \"changed since\" section, scheduled re-checks by e-mail, and a printable HTML export. This free plugin is complete on its own: nothing in it is time-limited or locked. Details: https:\/\/timaub.fr\/after-hack-checklist\/<\/p>\n\n Votre site a \u00e9t\u00e9 pirat\u00e9. Vous avez pass\u00e9 un scanner, supprim\u00e9 ce qu'il signalait, et vous ne savez pas quoi regarder d'autre. Aftersweep \u2013 After-Hack Checklist passe en revue dix endroits o\u00f9 un piratage laisse d'habitude des traces. Pour chaque point, il dit ce qu'il a trouv\u00e9 et \u00e0 quoi il l'a compar\u00e9, puis ce qu'il n'a pas regard\u00e9.<\/p>\n\n Il ne conclut jamais que tout va bien. Chaque constat a un niveau : anomalie<\/strong> (\u00e9cart prouv\u00e9 \u00e0 une r\u00e9f\u00e9rence, par exemple un fichier du c\u0153ur dont la somme de contr\u00f4le diff\u00e8re de celle de WordPress.org), suspect<\/strong> (motif fr\u00e9quent dans les piratages mais qui a aussi des usages normaux, par exemple un script dans un widget), \u00e0 identifier<\/strong> (\u00e9l\u00e9ment que vous seul pouvez reconna\u00eetre, par exemple un mu-plugin ou une page modifi\u00e9e depuis la date choisie). Pour chaque constat, le rapport indique ce que vous pouvez v\u00e9rifier \u00e0 la main ou montrer \u00e0 votre h\u00e9bergeur.<\/p>\n\n Les dix contr\u00f4les : fichiers du c\u0153ur compar\u00e9s aux sommes officielles et Non regard\u00e9 : les th\u00e8mes (WordPress.org ne publie pas de sommes pour eux), les extensions sans sommes publi\u00e9es (nomm\u00e9es une \u00e0 une), les tables hors WordPress, les commentaires, les fichiers hors du dossier de WordPress, la configuration du serveur, les autres sites de l'h\u00e9bergement et du r\u00e9seau, la date des changements de r\u00f4le, les fichiers illisibles ou de plus de 5 Mo, les fichiers de plus de 32 Mo \u00e0 la racine, dans Le plugin ne modifie rien : aucun fichier, compte, contenu ni r\u00e9glage. Il n'\u00e9crit que ses propres options ( No. It reads files, users, content, settings and scheduled tasks, and writes nothing but its own options and transients ( No. It tells you what it found in the places it looked, how sure each finding is, and where it did not look. An empty list of anomalies means only that these ten checks found no proven difference.<\/p><\/dd>\n Only if you tick \"Download the checksums from api.wordpress.org and downloads.wordpress.org\". The box is unticked the first time the page opens. When it is ticked, during a check:<\/p>\n\n The requests go through the WordPress HTTP API, which by default sends your WordPress version and your site address in its User-Agent header; WordPress.org also sees your server's IP address. WordPress.org's privacy policy: https:\/\/wordpress.org\/about\/privacy\/. Answers are kept 24 hours in transients, so a second check the same day sends no new request. Unticked, nothing leaves your site and checks 1 and 2 are listed under \"not looked at\".<\/p><\/dd>\n WordPress.org does not publish checksums for themes, so there is no official reference to compare them to. Themes are listed under \"not looked at\". The uploads, The plugin cannot say. Premium plugins, plugins that are not or no longer on WordPress.org, and some versions have no published checksums. The report names each of them and says which case applies. Compare them yourself with a fresh copy from their author.<\/p><\/dd>\n WordPress does not record when a role was changed. The date you give marks \"recent\": administrators created after it and content created or modified after it are listed. Pick the day before you think the hack started; if you do not know, keep the default (30 days ago) or go further back.<\/p><\/dd>\n This plugin has no malware signatures. It compares files to WordPress.org's checksums and lists what you have to recognise: administrator accounts, must-use plugins, drop-ins, recent content, scheduled tasks, rewrite rules and settings. It does not replace a scanner or your host's help; it gives you a list to go through after your cleanup.<\/p><\/dd>\nahcl_<\/code>).<\/p>\n\nThe ten checks<\/h4>\n\n
\n
wp-admin\/<\/code> and wp-includes\/<\/code> compared to the official checksums of your WordPress version and package language; unknown files in wp-admin\/<\/code> and wp-includes\/<\/code>; extra PHP files in the root; suspicious code in wp-config.php<\/code>.<\/li>\nwp-content\/uploads\/<\/code> (including names like photo.php.jpg<\/code>), files that start with PHP code whatever their extension, .htaccess<\/code> and .user.ini<\/code> files.<\/li>\nmu-plugins\/<\/code> and every drop-in, with its header, size and date; other PHP files at the top of wp-content\/<\/code>.<\/li>\nauto_prepend_file<\/code> and auto_append_file<\/code>, external error pages.<\/li>\nWhat it does not look at<\/h4>\n\n
\n
wp-admin<\/code>, wp-includes<\/code> and the plugin folders: not compared to the checksums (counted, the first 50 listed).<\/li>\nwp-content<\/code> that no check covers (languages<\/code>, cache<\/code>, upgrade<\/code>, backup folders...): each one that holds PHP files is listed with its number of PHP files.<\/li>\n.well-known<\/code> or cgi-bin<\/code> is reported as suspicious.<\/li>\n<\/ul>\n\nChecksums from WordPress.org: off until you tick the box<\/h4>\n\n
Privacy<\/h4>\n\n
\n
manage_options<\/code>; on multisite, network administrators) can open the page.<\/li>\n<\/ul>\n\nPro add-on<\/h4>\n\n
Fran\u00e7ais<\/h4>\n\n
wp-config.php<\/code> ; extensions de WordPress.org compar\u00e9es \u00e0 leurs sommes ; fichiers PHP dans uploads<\/code> ; mu-plugins et drop-ins ; administrateurs et comptes cr\u00e9\u00e9s depuis la date choisie ; r\u00e8gles .htaccess<\/code> et r\u00e9glages PHP ; contenus cr\u00e9\u00e9s ou modifi\u00e9s depuis cette date, scripts dans les contenus ; t\u00e2ches planifi\u00e9es ; adresses du site, inscription, extensions actives, scripts dans les options ; et la liste de ce qui n'a pas \u00e9t\u00e9 regard\u00e9.<\/p>\n\nwp-admin<\/code>, wp-includes<\/code> et les extensions (non compar\u00e9s aux sommes, list\u00e9s). Les dossiers de wp-content<\/code> qu'aucun contr\u00f4le ne couvre (languages<\/code>, cache<\/code>, upgrade<\/code>, sauvegardes...) sont list\u00e9s avec leur nombre de fichiers PHP quand ils en contiennent. Les fichiers PHP d'un dossier de la racine qui n'appartient pas \u00e0 WordPress ne sont compar\u00e9s \u00e0 rien : le dossier est list\u00e9 \u00ab \u00e0 identifier \u00bb avec leur nombre, et un fichier PHP dans .well-known<\/code> ou cgi-bin<\/code> est signal\u00e9 suspect.<\/p>\n\nahcl_*<\/code>). Les sommes de contr\u00f4le ne sont t\u00e9l\u00e9charg\u00e9es depuis api.wordpress.org et downloads.wordpress.org que si vous cochez la case pr\u00e9vue, d\u00e9coch\u00e9e au premier passage. L'interface est en fran\u00e7ais quand le site est en fran\u00e7ais.<\/p>\n\n\n\n
aftersweep<\/code> folder to \/wp-content\/plugins\/<\/code> and activate it in Plugins.<\/li>\n\n
Does it change anything on my site?<\/h3><\/dt>\n
ahcl_*<\/code>). To act on a finding, you do it yourself, by FTP, in the WordPress admin, or with your host.<\/p><\/dd>\nWill it tell me the hack is gone?<\/h3><\/dt>\n
Does it contact external servers?<\/h3><\/dt>\n
\n
Why are my themes not checked?<\/h3><\/dt>\n
.htaccess<\/code>, content and settings checks still apply to the whole site.<\/p><\/dd>\nA plugin is listed as \"not looked at\". Is it modified?<\/h3><\/dt>\n
What is the reference date for?<\/h3><\/dt>\n
I already ran a malware scanner. What does this add?<\/h3><\/dt>\n