Skip to content

Wp-Toolkit

WP Toolkit CLI

  • list all domains
wp-toolkit --list
  • clone a domain to new domain 
wp-toolkit --clone -source-instance-id 3 -target-domain-name test.new.vladmin-dev.top

Using Wp toolkit and wp-CLI

  • Get User home aka wp option get home 

    wp-toolkit --wp-cli -instance-id 3 -- option get home

  • Clear screenshot instance cache 

wp-toolkit --clear-cache -screenshot -instance-id 2

  • Clear wp-toollkit cache 

    wp-toolkit --clear-wpt-cache

  • List bronek installations

wp-toolkit --list | grep Broken
- Restore wp-toolkit repositories 
/usr/local/cpanel/3rdparty/wp-toolkit/bin/wp-toolkit-installer.sh --generate-configs

Wordpress malware removal

File & Malware Hunting

  • grep -R --line-number "e119ee06537ad77de2d3abf6a73ac31d" public_html
    Search recursively for the malware marker in all files.

  • grep -R --line-number -E "auto_prepend_file|base64_decode|eval|assert|shell_exec" public_html
    Find common malicious PHP functions or persistence hooks.

  • find wp-content/uploads -type f -name "*.php"
    Locate PHP files in uploads (should not exist).

Cron Management

  • wp cron event list | grep e119ee06537ad77de2d3abf6a73ac31d
    Check if the malicious cron job exists.

  • wp cron event delete e119ee06537ad77de2d3abf6a73ac31d
    Delete the malicious cron job.

Database Cleanup

  • SELECT option_name FROM wp_options WHERE option_name LIKE '%wpcode%' OR option_name LIKE '%ihaf%';
    Find WPCode/IHAF plugin options storing malicious snippets.

  • DELETE FROM wp_options WHERE option_name LIKE '%wpcode%' OR option_name LIKE '%ihaf%';
    Remove those options to kill persistence.

  • wp option get e119ee06537ad77de2d3abf6a73ac31d
    Check if the malware option still exists.

Core & Plugin Reinstall

  • wp core download --force
    Reinstall WordPress core files cleanly.

  • wp plugin delete insert-headers-and-footers
    Remove the compromised WPCode plugin.

  • wp plugin install <plugin-name> --activate
    Reinstall trusted plugins from official sources.

Hardening

  • cat > wp-content/uploads/.htaccess <<'EOF' ... EOF
    Block PHP execution in uploads directory.

  • find public_html -type d -exec chmod 755 {} +; find public_html -type f -exec chmod 644 {} +
    Reset secure file and folder permissions.

  • wp config shuffle-salts
    Regenerate WordPress salts to invalidate all sessions.

Verification

  • grep -R --line-number "e119ee06537ad77de2d3abf6a73ac31d" public_html || echo "✔ marker not found"
    Confirm the malware marker is gone.

  • wp cron event list | grep e119ee06537ad77de2d3abf6a73ac31d || echo "✔ cron gone"
    Verify the malicious cron is removed.

Do you want me to combine these into a single step-by-step cleanup checklist in Markdown (with short explanations for each)? - Smart updates

wp-toolkit --smart-update -instance-id 192 -operation status
  • Enable 
     wp-toolkit --smart-update -instance-id 192 -operation enable