WordPress 7.1 Hijack Cleanup: WPScan 4.1 and WP-CLI

Finally, read through wp-config.php for any constant beyond the database four, especially an auto_prepend_file line or an include pointing into the uploads directory. That pattern is the most persistent kind of reinfection.

💣 Four real errors and how I fixed them

Error 1: This does not seem to be a WordPress installation

Error: This does not seem to be a WordPress installation.
The used path is: /root
Pass --path=`path/to/wordpress` or run `wp core download`.

**Cause**: WP-CLI cannot find wp-load.php in the current directory. Running commands as root from /root during an incident is the classic way to hit this, and moving wp-config.php one level up causes it too.

Fix: pass the path explicitly and confirm the install is recognized:

wp --path=/var/www/html core is-installed && echo OK

Error 2: No WPScan API Token given

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

**Cause**: three possibilities. The token was never passed, the export happened in a different shell session, or a sudo prefix dropped the environment variable. sudo wpscan does not inherit the WPSCAN_API_TOKEN from your shell.

Fix: passing it explicitly is the most reliable, since it is immune to shell state:

wpscan --url https://example.com --api-token "your-token" -e vp
# or keep the environment with sudo -E
sudo -E wpscan --url https://example.com -e vp

Error 3: Scan Aborted, the url supplied does not seem to be running WordPress

[!] Scan Aborted: The url supplied 'https://example.com/' does not seem to be running WordPress.

Cause: one of two extremes. Either a CDN or WAF intercepted the scanner and returned a challenge page, or the cloak logic treated the WPScan user agent as a crawler and served it the redirect page, so WPScan concluded this was not WordPress at all. The second case is what happened here, and it is genuinely confusing.

Fix: establish which version of the site is the real one, then work around the disguise:

curl -sI https://example.com/ | head -3          # is a WAF challenge being returned?
wpscan --url https://example.com -e vp \
  --random-user-agent --disable-tls-checks --follow-redirect

If a WAF is genuinely in the way, whitelisting the scanner IP is much safer than disabling the WAF. Reserve --disable-tls-checks for test environments with self-signed certificates.

Error 4: Could not update the wp-config.php file

Error: Could not update the wp-config.php file.

**Cause**: wp config shuffle-salts needs to write wp-config.php, and in production that file is usually root:www-data at 640 or 600. Running WP-CLI as an ordinary user cannot write it, and a DISALLOW_FILE_MODS constant in the file will refuse the change outright.

Fix: run as the file owner, or elevate briefly and lock the permissions back down immediately:

sudo -u www-data wp config shuffle-salts --path=/var/www/html
# manual route: back up, change, then lock it again
cp wp-config.php /root/incident/wp-config.php.bak-of-incident
chmod 640 wp-config.php && sudo -u www-data wp config shuffle-salts
chmod 600 wp-config.php

Be aware that shuffle-salts logs every user out. Run it off-peak and tell your colleagues first.

Step 5: Harden so it does not happen the same way twice

Cleaning stops the bleeding; hardening stops the recurrence. Ordered by return on effort, these are the changes that close the specific hole this attack came through.

1) Enforce 2FA by role. WordPress core still ships no built-in two-factor authentication, so this needs a plugin. The free options that matter in 2026 are WP 2FA by Melapress (setup wizard, per-role enforcement, grace periods), Two-Factor (maintained by WordPress core contributors, deliberately minimal, TOTP plus email and U2F), Wordfence Login Security (login protection only), and Solid Security (formerly iThemes Security, part of a broader hardening suite). Install exactly one. Stacking two 2FA plugins causes login filter conflicts, which is the most common self-inflicted lockout in this scenario. Administrators should get no grace period.

**2) Remove the admin file editor.** Add this to wp-config.php:

define('DISALLOW_FILE_EDIT', true);
// stricter: also block plugin and theme installs/updates, run them through WP-CLI instead
// define('DISALLOW_FILE_MODS', true);

**3) Tighten file permissions** (directories 755, files 644, wp-config.php 600):

find /var/www/html -type d -exec chmod 755 {} \;
find /var/www/html -type f -exec chmod 644 {} \;
chmod 600 /var/www/html/wp-config.php

4) Trim entry points you do not use. If XML-RPC is not in use, deny it at the web server layer. Keep application passwords only where they are needed and revoke them when the job is done. Moving the login URL only stops automated credential stuffing, so never treat it as the main defense.

**5) Update strategy.** Back up, update a small batch, then verify. wp plugin update --all is convenient, but on a compromised site always clean before you update. Reverse that order and you may overwrite files an attacker had already modified, burying the evidence under a clean-looking version number.

Getting Google to lift the warning

Once the site is clean, do not immediately hit "Request Review". Google limits how many times a site can be re-reviewed, and a failed first attempt pushes the next window further out. Do these three things first:

1. Confirm the flag has cleared in the Search Console Security Issues panel.

2. Re-run the multi-user-agent curl check on the server and confirm the cloak is gone.

3. Write a short remediation note: what changed, when, and which files were removed. You will want it during review.

Only then submit for review. On this site, the warning cleared three days after submission. That number depends heavily on site history and the type of flag, so I would not treat it as your expected timeline.

Gear for the incident desk (affiliate links)

Incident windows tend to land at 2am, and how pleasant it is to read logs, compare user agents, and study diffs depends a lot on the desk itself. These two are what I actually used during this incident, and both are Amazon affiliate links:

Dell UltraSharp U2723QE 4K USB-C monitor — IPS Black panel, 90W USB-C single-cable setup, built-in USB 3.2 hub and RJ45, so one cable covers display, network, and power. Wide enough for four terminals on the left and a side-by-side diff on the right. Pricing moves with promotions; roughly $500 to $650 as of writing, so check the product page. Real caveats: it ships bright by default, white uniformity varies unit to unit, and spinning up a mechanical drive through the hub can brown out without enough power.

👉 Check the Dell U2723QE on Amazon >>

BenQ ScreenBar Halo 2 monitor light bar — three-zone backlight, stepless color temperature, and auto-off when you leave, which keeps ambient light low during late-night log reading without using desk space. Official pricing is around $179, with frequent promotions. Real caveats: the auto-dimming mode locks color temperature near 4000K with no override, and older monitors whose USB port only supplies 5V/1A will make it flicker, so it needs its own 5V/3A supply.

👉 Check the BenQ ScreenBar Halo 2 on Amazon >>

All prices above are the public list figures as of writing. Amazon changes prices constantly, so please confirm before ordering.

FAQ

Q: Does WordPress 7.1 include 2FA?

A: No. Core still has no built-in two-factor authentication, so it requires a plugin. WP 2FA, Two-Factor, Wordfence Login Security, and Solid Security are the common free choices. Install one to avoid login filter conflicts.

Q: Is the free WPScan tier enough?

A: Yes for incident work. The free tier allows 25 requests per day and a single scan with plugin enumeration consumes several. When quota is tight, -e vp is the cheapest meaningful scan. Paid tiers only matter once you manage a large fleet of sites.

Q: Do I have to rotate the salts after cleanup?

A: You should. An attacker may already have the authentication keys from wp-config.php and could forge login cookies with them. wp config shuffle-salts invalidates every session, which is the most direct way to take those keys back. The tradeoff is that everyone has to log in again.

Q: How long does it take to recover from a Google malware flag?

A: It depends on the flag type and site history, with no fixed number. This one cleared three days after submission. The important part is cleaning thoroughly before you submit, because repeated requests extend the review interval.

Q: If core checksums pass, is the site clean?

A: No. wp core verify-checksums only proves the official core files were untouched. It cannot see PHP in the uploads directory, custom plugins, injected database content, or a newly created administrator account. Read it alongside the WPScan scan, the user audit, and the mu-plugins check.

Wrap-up

The real lesson from this incident was not "keep your plugins updated". It was about order. The first thing I did after the alert was not delete files, it was preserve three pieces of evidence: the user-agent comparison, the file modification times, and the database export. Those three anomalous lines in recent-php.txt identified the abandoned plugin within 30 minutes. Had I run wp core download --force first, the trail would have been gone.

If you are working through a similar cleanup, two follow-ups are worth your time. Rebuilding internal links and SEO metadata across 600 posts with WP-CLI covers the routine automation side, and WordPress 7.1 with Redis object caching covers the performance layer, which is usually where session invalidation after hardening starts causing surprises. For teams automating ops further, letting AI agents safely run a content site with the MCP Adapter is the natural next read: the more automation you add, the earlier you have to manage the exposure it creates.

👉 Join MiniMax Token Plan: AI coding acceleration for businesses

👉 Join Xiaomi MiMo Platform: Leading AI model platform with cost-effective inference

👉 Join Aliyun AI: Top AI products with exclusive coupons for business innovation

📌 This article was AI-assisted generated and human-reviewed | TechPassive — An AI-driven content testing site focused on real tool reviews