wordpress-malware-removal

This project is a toolkit for auditing, cleaning, and locking down a hacked or at-risk WordPress website, designed to be driven by an AI coding agent such as Claude Code, Cursor, or Codex, rather than used as a traditional standalone app. It is aimed at site owners and developers who suspect their WordPress site has been compromised or want to check how exposed it currently is.

It works in three modes. Audit is a read-only check that scores the site's security posture from A to F by comparing installed plugins and themes against known vulnerabilities, testing for exposed data and settings, reviewing risky code, and checking how much hardening is already in place, then produces a ranked list of fixes. Remove is meant for a site that is already hacked: it runs a multi-layer scan to find hidden problems that ordinary scanners often miss, such as spam content shown only to search engines, hidden backdoor files, and database level injections, then backs up the site, quarantines suspicious files instead of deleting them outright, automatically rolls back a change if it breaks the site, and tries to explain how the attacker got in. Harden applies safe, reversible security improvements automatically, such as fixing file permissions and disabling unnecessary features, while asking for confirmation before making riskier changes that could break a plugin.

The project ships as skills that install into an AI agent's skills folder, plus standalone Python scripts that need no AI and no third-party dependencies to run basic scans directly from the terminal. It connects to a WordPress site either over SSH with WP-CLI or through a WordPress-focused MCP connector. The README includes a comparison table against manual cleanup and commercial security plugins, focused on differences in approach rather than claiming this tool is better.

It is free and open source under the AGPL-3.0 license, and installation is a single shell script that copies the skills into place.