=== Site Recovery Kit ===
Contributors: catcodestudio
Tags: security, malware, hacked, recovery, audit
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Looks for signs of a hacked WordPress site and walks you through the cleanup, in the right order. It reads files and never runs them.

== Description ==

Hidden administrators, changed core files, PHP in uploads, surprises among must-use plugins and drop-ins: this plugin looks in the places a hacked site keeps them, shows you each finding in plain words, and gives you a recovery plan with the steps in the right order.

**No scanner can prove a site is clean, and this one does not claim to.** It has no malware signature database. It runs inside the site it checks, so code that already controls that site can lie to it. A plain result is a good sign, not a guarantee. It looks for traces and misplaced things; it is not a firewall and it does not block attacks. Keep your firewall and login protection.

= What it checks =

* **Administrators**, read straight from the database and compared with what the Users screen shows, so an account hidden from that screen shows up. Also new administrators, names from published attacks, and ordinary accounts with administrator powers.
* **Application passwords** of every user. They keep working after passwords and secret keys are changed.
* **WordPress core** against the official checksums from wordpress.org: changed, missing and extra files.
* **Plugins from wordpress.org** against their official checksums, including PHP files the official copy does not have. Folders in plugins that are not plugins at all.
* **PHP in uploads**, including PHP hidden inside image files and server rules that make images run as code.
* **Must-use plugins and drop-ins**, which never appear on the normal Plugins screen.
* **Extra and hidden PHP files** directly in wp-content, and code patterns common in malware in themes and other plugins.
* **WordPress scheduled tasks**: tasks that store code, carry encoded data or run code from an unusual place.
* **Code loaded on the site**: callbacks defined in uploads, or built in memory, and must-use code that changes the Users or Plugins screens.
* **Database**: settings and content with foreign scripts, long encoded blobs, names from published attacks, triggers and scheduled events.
* **Settings**: PHP told to load an extra file on every page, weak secret keys, administrator as the default role, versions with known takeover flaws.

Every result tells you what it found, why it matters and what to do. Confirm what is yours: a confirmed file comes back as a finding if its content changes.

= The recovery plan =

Eleven steps in the order that works, from keeping a copy and calling your host to changing every access and watching for the infection to return. You tick them off as you go.

= Honest limits =

The plugin cannot see server crontabs or hosting panel tasks, running processes, code held only in memory, other sites on the account, web server logs, FTP accounts, SSH keys, or folders in the site root other than wp-admin, wp-includes and wp-content. The scan screen lists these every time. Paid plugins and themes have no official list to compare with, so they are only read for suspicious patterns. If wordpress.org cannot be reached, the checks that need it are shown as not done, never as passed.

A pattern match is a reason to look, not proof: legitimate code can match, and malware can avoid matching.

= How it stays safe =

* Found files are read as text. Nothing is included, required or requested.
* Database values are decoded without creating objects.
* The scan runs in short slices from your browser. If the server kills one, the scan moves on and marks that check as unfinished.
* Nothing runs on the public side of your site.
<!-- @pro-begin -->

= Pro =

Pro does the cleanup with you, and everything it does can be undone:

* **Quarantine** files and whole folders. A file is copied, the copy is verified, and only then is the original removed. Copies get a name PHP will not run, in a closed folder with a random name.
* **A health check after each file change.** The plugin asks your site for its home and login pages, and puts things back if a page that worked stops answering. If your server cannot call itself, it tells you to check by hand.
* **Replace changed files with official copies** from wordpress.org, checked against the official checksum first. Core and wordpress.org plugins only.
* **Remove administrator rights**, revoke application passwords and remove scheduled tasks. The account stays, so its posts are safe. It will not touch your own account or the last administrator.
* **Reset passwords and secret keys**, after you type a confirmation word. Old values are kept for undo for 30 days, then forgotten.
* **A warning when a moved file comes back**, which means the cause is still alive.
* **Audit report** in HTML and JSON with findings, coverage and every change. It has no passwords, keys or found code.
* **Daily scan** with an email when something new and serious appears.
* Plugin updates from catcode.com.ua.

Quarantine stays on your server until you delete it, even if the plugin is removed. Removing a file can still break a site in ways a health check does not catch, such as one page or one checkout step. Keep a copy off the server first.
<!-- @pro-end -->

== Frequently Asked Questions ==

= Does a clean result mean my site is clean? =

No. It means these checks found nothing. Hidden code can look like normal code, and some places are out of a plugin's reach.

= Will it slow down my site? =

It adds nothing to the public side of the site. A scan runs only while you start it from the admin screen, and it reads files in short slices.

= Do I need WooCommerce? =

No. It works on any WordPress site.

= Can it remove malware for me? =

The free plugin does not change your site at all: it finds and explains, and you act.

= My files keep coming back. Why? =

A file that returns has a cause: a running process, another backdoor, a scheduled task, a neighbouring site on the same account or a login you did not change. Step 3 of the plan starts there. Server processes and server crontabs are out of reach of any plugin, so ask your host.

= Does this replace a security plugin? =

No. It has no firewall, no login protection and no signature database. It is for finding traces and recovering. Use it alongside what you already have.

= My host closed outgoing connections. What then? =

The checks that compare with wordpress.org are shown as not checked, and the rest still run.

== External services ==

The plugin connects to wordpress.org during a scan, to compare your files with the official ones. No personal data and no site data is sent beyond the normal details of a web request.

* api.wordpress.org: official checksums of WordPress core. The request contains your WordPress version and locale. [Terms](https://wordpress.org/about/privacy/)
* downloads.wordpress.org: official checksums of plugins. The request contains the plugin slug and version. [Terms](https://wordpress.org/about/privacy/)
<!-- @pro-begin -->
* core.svn.wordpress.org and plugins.svn.wordpress.org: official copies of files, only when you choose to replace a file.
* catcode.com.ua: licence and update checks. The request contains your licence key and site address. [Privacy policy](https://catcode.com.ua/privacy/)
<!-- @pro-end -->

== Screenshots ==

1. The scan, with what was covered and what was out of reach.
2. Findings in plain words.
3. The recovery plan.

== Changelog ==

= 1.0.0 =
* First release.
