Question
I am wondering if my configuration was executing the hacked dot files before removal.
Setup
Ubuntu 18.04 LTS + NGINX + PHP 7.4
Issue
My WordPress site got hacked. The malware created a copy of each file and named it .{filename} (mention the dot in front).
This is what the hacked directory looks like:index.php (normal).index.php (hacked, being executed I guess)
This is what my vhost looks like:
# Deny access to hidden files
location ~ /. {
deny all;
}
location ~* /(?:uploads|files)/.*.php$ {
deny all;
}
location ~ ^/wp-includes/(^/)+.php$ {
deny all;
}
(*) I did not made any adjustments to the standard php.ini, except raising the max_execution_time and some other limits.
Do you think this was enough to prevent PHP of executing these hacked files?
WordPress fix
This command automatically removes all dot php files from the /var/www directory:find /var/www/-type f -name .*.php # -delete # UNCOMMENT to actually delete
After that, I have deleted and manually downloaded new copies in /wp-content/plugins, /wp-content/themes, /wp-includes, /wp-admin and restored a back-up of /wp-content/uploads and /wp-content/languages. So yes, I think my WordPress site is clean now.