How to use Claude to find WordPress persistence
Claude Code helped trace persistent WordPress malware and revise fleet integrity checks. Human review expanded file audits to database and frontend injection.
anchor.host
Original prompt
Shared by the source author. See source notes for context.
Run the security audit on this site. Something is off with the core checksums.
Reach people exploring AI agents
See placements →Evidence at a glance
Sourced account- Source author
- Austin Ginder
- Original account
- Read the source ↗
- Published
- Source link checked
- Reported result
- The operator reports concrete backdoor findings and broader database/frontend detection after file-only cleanup missed persistence. Content hashes improved code identity across the fleet.
- Human involvement
- Ginder investigated client incidents, checked logs and actual file content, removed persistence and broadened review to database-stored and frontend code.
A linked account supports attribution. It does not mean we independently reproduced its result.
Report an issue with this case
Open correction emailOpens your email app with the case link included. Nothing is sent automatically.
How the agent did it
- Claude traced suspicious core checksums to hidden backdoor code and compared timestamps with logs.
- Ginder broadened detection to database and frontend injection after file-only cleanup missed persistence.
- The fleet audit system moved from version labels to actual file-content hashes.
Austin Ginder used Claude Code during WordPress incident cleanup after ordinary file audits failed to catch persistent malware. One agent-assisted session traced modified core files to hidden PHP backdoors and an encrypted callback component, while file birth times and access logs helped challenge spoofed modification dates.
The broader incident history exposed a coverage gap: a payment skimmer stored in plugin database settings survived file cleanup. Ginder added checks for database-stored executable content and frontend injection instead of treating clean core checksums as a complete result.
Fleet review also needed a better identity model. His first Security Finder tool matched plugin slug and version, but installations with identical labels could contain different code. Claude explained the mismatch and helped shape a hash-first lookup. Ginder rebuilt the system around SHA-256 hashes of actual component files, with version matching as a fallback when hashes were absent.
The reported result combined concrete malware findings with a wider detection and integrity workflow. Hash equality did not prove that a component was safe; it showed that the reviewed code and another installation matched. The account explicitly includes missed persistence and repeated verification, making human incident review part of the evidence rather than portraying a one-pass agent scan as complete cleanup.
Prompt
Original prompt
Source: Anchor Hosting blog · Austin Ginder
Frequently asked questions
Why were clean files insufficient?
A skimmer stored in database settings survived file-based cleanup.
Why replace version-only matching?
The same plugin version could have different file contents across installations.
Does a matching hash prove safety?
No. It proves code identity, so an existing review can be applied to matching content.
More details
About this account
Claude traced suspicious core checksums to hidden backdoor code and compared timestamps with logs. Ginder broadened detection to database and frontend injection after file-only cleanup missed persistence.
Original hosting-operator account opened. Transcript findings and cleanup claims are self-reported. Earlier audits missed database-stored skimmer code; content hashes identify code equality, not security by themselves. Original prompt excerpt.
Credit: Austin Ginder — Anchor Hosting blog
Source published
Added to Agents In Use
Source checked
Tools and topics
Claude Code · WordPress · WP-CLI · SHA-256 · Access logs
Malware cleanup · Code identity
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.