Core WordPress Files Were Modified

@mapo85 Sorry for the delay.

Can you show the actual core file names that are reported as modified and the contents if possible?

Also, what signs did you see that told you the website was hacked? There could be a backdoor within the database that is being used and so restoring just the files wouldn’t remove it and the attacker could again modify the core files.

@mapo85 Thanks!

For index.php and wp-settings.php, you can just copy the correct code from WordPress: https://core.svn.wordpress.org/tags/5.4.2/

The ver.php and wordfence-waf.php were not found in standard locations and may be infected as well.

If you do not use user.ini files for PHP settings – then you should be able to safely delete those two user.ini files (I suggest backing up everything before making any of these changes)

@mapo85 ver.php shouldn’t exist by default for the WordPress installation, so I would back it up and remove it.

Yes, for index.php and wp-setting.php you just need to click the checkbox and then select “Mark as Fixed” from the menu at the bottom, click the confirmation checkbox, then click the green “Submit” button.

@mapo85 The php_errorlogs are safe to delete, but I do not know the contents of licenza.html so you would need to inspect it and determine if it is safe or needed by your website.

@mapo85 That one is safe to delete too 🙂

@mapo85 That’s okay, just “Mark as Fixed” from the dropdown for licenza.html.