• Resolved johncannon

    (@johncannon)


    Hey guys.

    I have just installed WP on a domain and finished it. Another folder from the host was infected and I have delete it it completely. But now I notice the following code in the new wp-config.php:

    MALWARE DELETED

    This is infected too?
    Thanks.

Viewing 3 replies - 1 through 3 (of 3 total)
  • Moderator bcworkz

    (@bcworkz)

    No, those are fine, they are “salt” values used in various hashing functions. For security, every installation should have a different set of random salt strings.

    Be aware that any time malicious code appears on your server, every single file on your server is suspect and could possibly contain a ‘backdoor’ a hacker could use to re-access the server even though you’ve removed the obvious infection.

    Everything might be fine, but since you just started, to be on the absolute safe side, consider wiping out everything and re-installing. It goes a lot faster once you’ve gone through the process once. More information can be found on FAQ My site was hacked.

    If you do keep that installation I would suggest that you change those salt keys as they are now public. Here is a generator: https://api.ww.wp.xz.cn/secret-key/1.1/salt/

    Thread Starter johncannon

    (@johncannon)

    Thanks guys. Got it now. Have a great day ahead.

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Suspect code’ is closed to new replies.