What if the server management company has changed the permissions to 000 due to a malware infection and the WordPress site can no longer be displayed?

This section explains how to deal with a situation where a server management company has changed the permissions to 000 due to a malware infection and the WordPress site can no longer be displayed.

If your WordPress site can no longer be displayed and the server management company informs you that the malware has changed the permissions to 000.

Each server management company monitors their servers for malware malicious activity. If there is a blatant malware infection and it is confirmed that a large number of unauthorized emails are being sent or the server is overloaded, the server management company may set the permissions to 000 for the malware-infected files.

Example of server management company notification

In the above server account of the customer,
Using mail sending software for servers (Sendmail)
We have confirmed that a large number of emails are being sent to email addresses outside of Japan.

In response to this, our support team has conducted a security investigation,
We have confirmed that a security-critical bug (vulnerability) exists in the program used by the customer, and that it has been exploited by a third party,
The possibility of a third party exploiting this vulnerability is very high.

Therefore, we are sorry to inform you of the situation after the fact,
As an emergency measure, the following restrictions have been implemented.

Restrictions implemented by support
————————————————————

Regarding the malware file that was installed,
　Change the permission to “000” and disable the function.

[List of malware files]
*Since there are many files, we will present them in the attached file [ ****.txt ].

————————————————————

If you are a victim of unauthorized access such as the one described here,
In addition to the malicious files detected, other malicious files and backdoors (mechanisms that facilitate unauthorized access) may also be present.
backdoor (a mechanism that facilitates unauthorized access) may have been installed.
backdoors (a mechanism that facilitates unauthorized access) may have been installed.

In order to prevent damage from unauthorized access, please check the following information and take the necessary action,
Please check the following information and take the necessary measures to prevent damage from unauthorized access.

Reasons why WordPress sites fail to display with permission 000

Permissions are the settings that allow files to be written to and read from. Permission 000 is a setting that prevents files from being accessed or executed, so if important WordPress files (e.g. index.php and wp-config.php) are set to permission 000, the site will not be viewable and you will not be able to log in to the admin panel.

WordPress malware infections can be inspected and removed with plug-ins, but this is not possible if you are unable to log in to the admin panel.

What to do if you have been set to permission 000

In this case, it may be possible to restore the display of the site by changing the file permissions back to readable (755, 555, etc.) using FTP software, but we strongly recommend that you do not change the permissions back before removing the malware, as this will also restore the execution of the malware.

It is important to download the files notified by the server administrator one by one using FTP software, remove the malware code, and then restore the permissions.

Malware code is often obfuscated, and the malware code can often be determined to some extent by visual inspection.
Reference
What is the obfuscation process used in more than 90% of WordPress malware?

However, the malware detection capability of server management companies is often not that high, and there is a high possibility that malware exists in files other than those notified by the server management company.
Therefore, for a drastic solution, we recommend that you consult a specialist for malware removal and security measures.