Rescue tool: user guide

The rescue tool checks a WordPress site without loading WordPress. Use it when the site is broken (blank page, admin unreachable), when an intruder deleted the Unhack plugin, or to confirm from the outside a result obtained in WordPress.

It comes in two editions, each a single readable PHP file:

• unhack-rescue.php (free): command-line scan (SSH, or a downloaded copy of the site). It never writes to the site.
• unhack-rescue-pro.php (Pro): adds command-line repair and a browser mode (file uploaded by FTP, then opened in the browser). It writes to the site only when you ask for a repair, with a copy of every file.

Getting the tool

The free edition will be offered for download on this page, with its SHA-256 fingerprint, as soon as the plugin is published on WordPress.org. The Pro edition is downloaded with your licence key on the Download Unhack Pro page, with its SHA-256 fingerprint to check the file.

Using the tool in the browser (Pro)

No technical knowledge is needed beyond FTP access (or your host's file manager).

1. Connect to the site by FTP (FileZilla, Cyberduck…) or with your host's file manager. Open the folder that holds wp-config.php and the wp-admin and wp-includes folders.
2. Upload unhack-rescue-pro.php into that folder.
3. Open https://your-site.com/unhack-rescue-pro.php in your browser. The page asks for an access code.
4. In the same FTP folder, a file unhack-rescue-access.php has appeared. Download it and open it with a text editor: it holds the code, in 8 groups of 4 characters. Paste it into the page, then “Open the tool”.
5. “Start a scan”. The page shows the progress; if it closes, the scan resumes the next time.
6. Read the verdict and the points found: each card says what is happening, why it matters and what to do. Repair a point, or tick several and “Repair the selected points”. The “Before changing your files” screen shows exactly what will be done.
7. After the repair, start a new scan to confirm. Every repair can be undone from the “Repairs” screen for 30 days, as long as the tool stays on the server.
8. When you are done, remove the tool: “Remove the tool” button, then the access code to confirm. Repairs can no longer be undone afterwards.

The access code works for 24 hours, and a session closes after 2 hours without activity.

What the tool does

• It compares every file of WordPress core and of the plugins and themes published on WordPress.org with the exact version installed, and inspects the sensitive places: media, wp-config.php, .htaccess, .user.ini, must-use plugins, folders next to WordPress.
• On request, it repairs a modified or missing file of core or of a WordPress.org plugin or theme (the official version is checked against its published fingerprint before it is written), and quarantines an intruding code file.
• Before every write, a copy of the current state is saved and read back; when in doubt, the previous state is put back.

What the tool never does

• It does not load WordPress and does not touch the database.
• It never changes wp-config.php, .htaccess, .user.ini, php.ini or web.config: these points are explained, a person decides.
• It does not repair premium or custom plugins: there is no public official copy to rely on.
• It only contacts WordPress.org. Nothing is sent anywhere else.

Limits

A hacked server can lie: code loaded before the tool can distort the result. In that case, prefer the command line over SSH, scan a downloaded copy of the site on a clean computer (free edition), or ask your host for help.

From the command line

• php unhack-rescue.php scan /path/to/wordpress: scan (both editions).
• php unhack-rescue-pro.php repair /path/to/wordpress: repair plan, nothing is changed.
• php unhack-rescue-pro.php repair /path/to/wordpress --apply: repairs.
• php unhack-rescue-pro.php history /path/to/wordpress: repairs made.
• php unhack-rescue-pro.php rollback /path/to/wordpress <id>: undoes a repair.

A question? Write to support@unhack.fr.