After-Hack Checklist

After the cleanup of a hacked WordPress, the list of what is left to look at

After-Hack Checklist goes through ten places where a hack leaves traces (files, accounts, contents, settings) and says what it found, what it compared it with and what it did not look at, without changing anything on the site. The plugin is free and available in French.

Free plugin on WordPress.org See the Pro

The problem

You run a small company's website on your own, on shared hosting. The site was hacked. You ran a scanner, deleted the files it reported, updated WordPress. The guides then say to check the administrator accounts, the PHP files in uploads, the .htaccess, the scheduled tasks, the changed contents. It is long, it is technical, and you never know whether you saw everything.

After-Hack Checklist makes that list for you, read-only, and leaves the decision to you. It never says "everything is fine": it gives precise findings, and the list of what it could not check.

What you see

Under Tools > After-Hack Checklist: a reference date (30 days ago by default), a box to allow the checksums to be downloaded from WordPress.org, unticked at the start, and the "Run the check" button. The check moves forward in small steps, with a progress bar, and resumes where it stopped if the page is closed.

Tools > After-Hack Checklist screen in the WordPress administration, before the first check: introduction sentence, reference date, checksums box with the sentence about what is sent, "Run the check" button.
The screen before the first check: the reference date, the checksums box and the button.

Text illustration of a report. The exact labels on screen may differ.

2 anomalies, 1 suspect, 4 to identify, 6 points not looked at

Uploads folder
  anomaly       wp-content/uploads/wp-load-8009.php
                PHP file in the uploads folder

WordPress core
  anomaly       wp-includes/wp-theme-core.php
                not listed in the official checksums of WordPress 7.1.3 (fr_FR)

Administrators
  suspect       account "support-wp", created after 2026-09-23

Contents
  to identify   3 pages changed since 2026-09-23

Not looked at
  themes: WordPress.org publishes no checksums for them
  plugin "exemple-premium": no published checksums
  ...
After-Hack Checklist report on a test site: dates of the check and of the reference, summary in figures, then the checks of the WordPress files, of the plugins and of the uploads folder, with anomalies, suspects and a line to identify.
The report on a test site where traces were planted: the first three checks.

Three levels of finding:

  • anomaly: a proven difference from a reference (a checksum that differs from the WordPress.org one, a PHP file in uploads);
  • suspect: a pattern common in hacks, which also has normal uses (a script in a widget, an administrator created after the date);
  • to identify: an item that only you can recognise (a must-use plugin, a drop-in, a page changed since the date).

For each finding, the report says what you can check by hand, or show to your host.

The ten checks

  1. Core files compared with the official checksums of your version and your locale; unknown files in wp-admin and wp-includes; unusual code in wp-config.php.
  2. Plugins from WordPress.org compared with the checksums published for their version.
  3. PHP files in uploads, including disguised ones (photo.php.jpg), .htaccess and .user.ini files.
  4. Must-use plugins and drop-ins, with their header, their size and their date.
  5. Administrator accounts, accounts created since the date, capabilities granted outside a role.
  6. .htaccess rules: redirects to another site, different pages for search engines, non-PHP files run as PHP.
  7. Contents created or changed since the date, external scripts and iframes in the contents.
  8. Scheduled tasks whose code lives in uploads or outside WordPress.
  9. Site addresses, open registration with a high-capability role, active plugins that cannot be found, scripts in the options and the widgets.
  10. The list of what was not looked at.

What it does not look at

This list is at the end of every report.

  • Themes: WordPress.org publishes no checksums for them.
  • Plugins without published checksums (premium plugins, plugins that are not on WordPress.org, some versions), named one by one.
  • The core and the plugins if the checksums could not be downloaded (box unticked, network error), with the reason.
  • The database tables that do not belong to WordPress, and the comments.
  • The files outside the WordPress folder, the server configuration, the host's control panel.
  • The other sites on the same hosting, and the other sites of a multisite network.
  • The date of a role change: WordPress does not keep it.
  • Unreadable files (counted, the first 50 listed) and files larger than 5 MB.
"10. Not looked at" section of a report: the fixed lines, the plugins that are not on WordPress.org and the wp-content folders with no rule, with their number of PHP files.
The "Not looked at" section of the same report.

Free and Pro

FeatureFreePro
The ten checks, on demand, report on screen, without limitYesYes
Reference snapshot and "Changed since the snapshot" sectionNoYes
New scheduled check, every day or every week, e-mail only for a new anomaly or suspect findingNoYes
Export of the report as printable HTMLNoYes
External callsWordPress.org checksums, if you tick the boxIn addition: license and updates (Freemius)
PriceFree€39 excl. VAT, paid once, for 1 site

The Pro is a separate plugin, installed next to the free one. Nothing in the free plugin is time-limited or locked. Full refund within 14 days, with no conditions.

The Pro in the report: "Reference snapshot" with its counts, then "Changed since the snapshot" with a PHP file added in uploads and an account added.
The Pro: the reference snapshot and what changed since.
Free on WordPress.org

Pro available soon.

Questions

Does it change my site?

No. It reads the files, the accounts, the contents, the settings and the scheduled tasks, and writes only its own options. To act on a finding, you are the one who does it, over FTP, in the administration or with your host.

Will it tell me the hack is over?

No. It says what it found where it looked, with a level for each finding, and where it did not look. Zero anomalies only means that these ten checks found no proven difference.

I already ran a scanner. What does this add?

The plugin has no signature list. It compares the files with the official WordPress.org checksums and lists what you have to recognise: administrator accounts, must-use plugins, drop-ins, recent contents, scheduled tasks, .htaccess rules, settings. It replaces neither a scanner nor the help of your host.

Does it contact outside servers?

Only if you tick the box, unticked at the start. It then asks api.wordpress.org for the core checksums (with your version and your locale), and downloads.wordpress.org for those of each installed plugin (folder name and version). Nothing is sent to the publisher. Details: privacy.

My hosting is shared (IONOS, OVH…). Will the check stop halfway?

Each step works for about fifteen seconds, then the page starts the next one. If the page closes, open it again and choose "Resume".

What do I need?

WordPress 6.8 or later, PHP 7.4 or later, an administrator account.

Security and privacy

Have you found a vulnerability in the plugin? Write to security@timaub.fr. The same contact is published in /.well-known/security.txt (RFC 9116). First reply within 5 working days; confirmed vulnerabilities are fixed in a new version, and the people who found them are credited if they wish. Please give us the time to publish the fix before you speak about it publicly.

This page loads no script, no font and no external tracker. Details of the data: privacy.