Malware Infection via Another Site on WordPress: Checklist for Detecting “Cross-Site Contamination” via Other Sites in a Shared Hosting Environment

Malware Infection via Another Site on WordPress. Here, we’ll explain the checklist items to help you detect “cross-site contamination” via other sites in a shared hosting environment.

What Is “Cross-Site Contamination”?

Much of today’s malware spreads infection across multiple sites that share folders within the same server hosting account.

This type of malware infiltrates a server through a single vulnerable WordPress site, creates malicious files, and then traces its path upward through the directory structure—creating copies of itself in every folder, from the one containing specific WordPress files to any folder several levels down.

As a result, malicious files are planted or files are tampered with even on multiple sites on the server that are not vulnerable.

Checklist for Determining Whether “Cross-Site Contamination” Has Occurred

If you encounter any of the following situations, it is highly likely that “cross-site contamination” has occurred and multiple sites on the server have been compromised.

・Multiple sites on the server exhibit similar symptoms of malware infection (e.g., users are redirected to other sites, notifications of spam email distribution are received, or users cannot log in to the admin panel due to a 403 error)

・PHP files or .htaccess files are present outside the web display folder on the server

・When connecting via FTP or similar and examining the file structure, copies of malicious files with the same names—which do not normally exist in WordPress—are found spread throughout various folders on the server (including folders for other domains)

Examples of the names of these malicious files
・moon.php
・htaccess (A large number of .htaccess files containing malicious configurations are created in unnecessary locations, causing issues such as being unable to log in to the admin panel)
・PHP files with random character strings
・index.php (Included in the legitimate files but placed in unnecessary locations)
・wp-＊＊＊＊＊.php (a filename disguised as a legitimate file)
・wp-blog-header.php (included among legitimate files but placed in unwanted locations)
etc.

・The server hosting provider notifies you that malware is present on multiple sites. Furthermore, when the hosting provider takes measures to suppress the malware’s activity—such as setting file permissions to 000—multiple sites become completely inaccessible

How to Address “Cross-Site Contamination”

To resolve “cross-site contamination,” you must, in principle, remove the malware from all sites on the server, identify and remove users with unauthorized administrative privileges, and patch the WordPress vulnerabilities that caused the malware infection.

It is also recommended to perform these tasks locally and then apply the changes to the server all at once (if you clean up sites one by one, they may become reinfected while you are working on others).

First, we recommend running a malware scan on all sites on the server using a plugin or similar tool.
[Free] WordPress: Malware Scan & Security Plugins [Malware and Virus Detection and Removal]

If you are experiencing serious issues—such as the site failing to load properly or being unable to log in to the admin panel—we recommend consulting an expert as soon as possible.