WordPress wp-config.php Hack: Suspicious Code and Safe Cleanup Steps

A WordPress wp-config.php hack is serious because this file loads before most themes and plugins. One injected include, remote loader, or encoded block can run on every request, recreate deleted malware, or expose database credentials even while the homepage still appears normal.

If you find suspicious code, do not delete the whole file or replace it blindly. Preserve the current copy, identify the settings your site genuinely needs, compare the structure with a clean reference, and treat the discovery as evidence of a wider compromise.

RyoheiYokoyama

I’m Ryohei Yokoyama, founder of SiteFixNow. I’ve worked as an IT engineer for over 20 years and have handled many WordPress recovery, malware removal, hacked site repair, and security cleanup cases. In this guide, I’ll show you how to inspect and recover wp-config.php without destroying legitimate configuration.

WordPress wp-config.php hack response starts by preserving evidence

The safest first action is to copy the current wp-config.php, record its path, owner, permissions, size, and modification time, and preserve a complete file-and-database backup. A suspicious file is not a backup you should deploy, but it may show how persistence was established.

Store evidence outside public_html, htdocs, or any web-accessible backup directory. If you need help choosing a clean recovery point, follow the safe order in the guide to safe WordPress backup restore after a hack.

WordPress wp-config.php hack checks must separate normal settings from malware

Unfamiliar code is not automatically malicious. Managed hosts, caching systems, reverse proxies, security tools, multisite networks, and deployment platforms may add legitimate constants or includes. The correct test is whether the line is expected, documented, and traceable to a trusted component.

Warning signs include long encoded strings, error suppression around an unknown loader, remote URLs, paths into uploads or temporary folders, code that writes new PHP files, and conditionals that run only for certain visitors. A legitimate include should point to a file you recognize and can inspect.

Investigate unexpected uses of:
eval or assert with decoded input
base64_decode, gzinflate, or long escaped strings
includes under uploads, tmp, cache, or hidden folders
remote requests or code that writes executable files

Do not delete every function-name match. Compare its source, path, context, timestamp, and deployment history. The broader WordPress file infection cleanup guide explains how this file relates to plugins, themes, and uploads.

WordPress wp-config.php hack cleanup is safer when you rebuild deliberately

If the suspicious addition is small and clearly isolated, you may remove only that block from a working copy, validate the PHP syntax, and test the result in staging. If the file contains many unknown edits, rebuilding from the current WordPress wp-config-sample.php is usually easier to audit.

php -l wp-config.php.clean
chmod 600 wp-config.php.clean

# Rename in one operation only after backup and validation:
mv wp-config.php wp-config.php.infected-evidence
mv wp-config.php.clean wp-config.php

Never paste your database password, salts, or the full wp-config.php file into a public forum, malware scanner, or AI prompt.

WordPress wp-config.php hack recovery requires new secrets and a closed entry point

Assume secrets in a compromised wp-config.php may have been read. Rotate the WordPress authentication keys and salts so existing sessions are invalidated, change the database user password, update the rebuilt file, and reset credentials for hosting, SFTP, SSH, administrators, and deployment services.

If you cannot explain how the attacker changed the file, the incident is not fully resolved. Follow the wider files, database, and backdoor checks, then use the hardening steps to secure WordPress after malware removal.

WordPress wp-config.php hack cleanup must be verified before normal traffic returns

A clean-looking file is only one checkpoint. Test the front end, wp-admin, forms, scheduled jobs, email, checkout, APIs, and a private-browser visit from another device. Watch PHP errors and access logs while those requests run.

Keep the evidence archive outside public directories. Record what changed, which credentials were rotated, and why the final file is trusted so an infected copy is not restored later.

Frequently asked questions about a WordPress wp-config.php hack

Can I delete wp-config.php and let WordPress recreate it?

No. WordPress may start a setup flow, but it cannot safely reconstruct all site-specific values, host directives, salts, or custom constants. Preserve the file and rebuild deliberately from a clean sample when necessary.

Does base64_decode always mean wp-config.php is hacked?

No single function proves malware by itself. An unexpected encoded block in this file is a strong warning, but judge it by source, purpose, path, surrounding code, and comparison with a trusted configuration.

Why did suspicious code return after I removed it?

A remaining backdoor, scheduled task, prepend directive, compromised account, vulnerable component, or infected neighboring site may be rewriting the file. Repeated injection means the persistence path still needs investigation.

WordPress wp-config.php hack cleanup summary

A safe WordPress wp-config.php hack cleanup begins with evidence and a full backup, continues with a careful comparison of legitimate settings and suspicious code, and ends with a verified rebuild, secret rotation, entry-point investigation, and monitoring. Removing one strange line is not enough when the wider site may still contain a backdoor.

If You Can’t Secure or Recover Your WordPress Site Yourself

If your website shows malware warnings, redirects to strange pages, or you are not sure whether it is secure,
SiteFixNow can help clean, repair, and recover your WordPress site.

We help with WordPress malware removal, hacked site repair, security cleanup, and recovery support.