{"id":39989,"date":"2026-08-01T01:21:19","date_gmt":"2026-07-31T18:21:19","guid":{"rendered":"https:\/\/dps.media\/xu-ly-wordpress-bi-hack-quy-trinh-10-buoc\/"},"modified":"2026-08-01T01:21:19","modified_gmt":"2026-07-31T18:21:19","slug":"xu-li-wordpress-bi-hack-quy-trinh-10-buoc","status":"publish","type":"post","link":"https:\/\/dps.media\/zh\/xu-li-wordpress-bi-hack-quy-trinh-10-buoc\/","title":{"rendered":"\u5904\u7406 WordPress \u88ab\u9ed1\uff1a10 \u6b65\u5f7b\u5e95\u6e05\u9664\u6076\u610f\u4ee3\u7801\u5e76\u4fee\u8865\u5b89\u5168\u6f0f\u6d1e\u7684\u6d41\u7a0b"},"content":{"rendered":"<?xml encoding=\"utf-8\" ?><p>M\u1ed9t ng\u00e0y \u0111\u1eb9p tr\u1eddi, website c\u1ee7a b\u1ea1n xu\u1ea5t hi\u1ec7n c\u00e1c d\u1ea5u hi\u1ec7u b\u1ea5t th\u01b0\u1eddng: l\u01b0\u1ee3ng truy c\u1eadp t\u1ef1 nhi\u00ean s\u1ee5t gi\u1ea3m \u0111\u1ed9t ng\u1ed9t, kh\u00e1ch h\u00e0ng ph\u1ea3n h\u1ed3i h\u1ecd b\u1ecb chuy\u1ec3n h\u01b0\u1edbng sang c\u00e1c trang web c\u00e1 c\u01b0\u1ee3c l\u1ea1, ho\u1eb7c xu\u1ea5t hi\u1ec7n m\u1ed9t v\u00e0i t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb l\u1ea1 ho\u1eafc trong trang c\u1ea5u h\u00ecnh admin. N\u1ebfu b\u1ea1n \u0111ang \u0111\u1ed1i m\u1eb7t v\u1edbi nh\u1eefng v\u1ea5n \u0111\u1ec1 n\u00e0y, r\u00f5 r\u00e0ng website c\u1ee7a b\u1ea1n \u0111\u00e3 d\u00ednh m\u00e3 \u0111\u1ed9c. Vi\u1ec7c nhanh ch\u00f3ng t\u00ecm ra c\u00e1ch <strong><a href=\"https:\/\/dps.media\/zh\/xu-li-wordpress-bi-hack-quy-trinh-10-buoc\/\">\u5904\u7406 wordpress \u88ab\u9ed1\u5ba2\u653b\u51fb<\/a><\/strong> l\u00e0 \u0111i\u1ec1u t\u1ed1i quan tr\u1ecdng \u0111\u1ec3 b\u1ea3o v\u1ec7 d\u1eef li\u1ec7u kh\u00e1ch h\u00e0ng, gi\u1eef v\u1eefng uy t\u00edn th\u01b0\u01a1ng hi\u1ec7u v\u00e0 tr\u00e1nh b\u1ecb Google \u0111\u01b0a v\u00e0o danh s\u00e1ch \u0111en.<\/p><p>V\u1eeba qua, \u0111\u1ed9i ng\u0169 k\u1ef9 thu\u1eadt t\u1ea1i DPS.MEDIA \u0111\u00e3 h\u1ed7 tr\u1ee3 kh\u00f4i ph\u1ee5c th\u00e0nh c\u00f4ng m\u1ed9t h\u1ec7 th\u1ed1ng website doanh nghi\u1ec7p b\u1ecb nhi\u1ec5m m\u00e3 \u0111\u1ed9c n\u1eb7ng (\u0111\u01b0\u1eddng d\u1eabn l\u01b0u tr\u1eef tr\u00ean server t\u1ea1i `\/home\/yourdomain.com\/public_html\/`). Ph\u00e2n t\u00edch k\u1ef9 thu\u1eadt t\u1eeb file log Wordfence CLI cho th\u1ea5y website n\u00e0y ch\u1ee9a 16,854 file, t\u1ed5ng dung l\u01b0\u1ee3ng qu\u00e9t l\u00e0 281.2 MiB. Wordfence qu\u00e9t m\u1ea5t 851 gi\u00e2y (kho\u1ea3ng 14 ph\u00fat) v\u00e0 ph\u00e1t hi\u1ec7n ra \u0111\u00fang 3 file suspicious (file nghi v\u1ea5n ch\u1ee9a m\u00e3 \u0111\u1ed9c). B\u00e0i vi\u1ebft n\u00e0y s\u1ebd chia s\u1ebb chi ti\u1ebft case study th\u1ef1c t\u1ebf n\u00e0y, \u0111\u01b0a ra t\u00ean c\u1ee5 th\u1ec3 c\u1ee7a c\u00e1c plugin \u0111\u1ed9c h\u1ea1i, t\u00e0i kho\u1ea3n admin gi\u1ea3 m\u1ea1o c\u1ee7a hacker v\u00e0 quy tr\u00ecnh d\u1ecdn s\u1ea1ch t\u1eeb A-Z \u0111\u1ec3 b\u1ea1n c\u00f3 th\u1ec3 t\u1ef1 ki\u1ec3m tra h\u1ec7 th\u1ed1ng c\u1ee7a m\u00ecnh.<\/p><h2>B\u01b0\u1edbc 1: Qu\u00e9t ph\u00e1t hi\u1ec7n m\u00e3 \u0111\u1ed9c b\u1eb1ng Wordfence CLI<\/h2><p>Wordfence CLI l\u00e0 c\u00f4ng c\u1ee5 qu\u00e9t m\u00e3 \u0111\u1ed9c ch\u1ea1y tr\u00ean d\u00f2ng l\u1ec7nh c\u1ee7a m\u00e1y ch\u1ee7 (VPS\/Server) v\u00f4 c\u00f9ng m\u1ea1nh m\u1ebd, x\u1eed l\u00fd nhanh h\u01a1n nhi\u1ec1u so v\u1edbi plugin th\u00f4ng th\u01b0\u1eddng. Tr\u01b0\u1edbc ti\u00ean, b\u1ea1n c\u1ea7n k\u1ebft n\u1ed1i license key mi\u1ec5n ph\u00ed c\u1ee7a Wordfence b\u1eb1ng l\u1ec7nh:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">wordfence configure<\/code><\/pre><p>Sau \u0111\u00f3, ti\u1ebfn h\u00e0nh qu\u00e9t th\u01b0 m\u1ee5c ch\u1ee9a m\u00e3 ngu\u1ed3n c\u1ee7a website v\u00e0 xu\u1ea5t k\u1ebft qu\u1ea3 ra m\u1ed9t file log c\u1ed1 \u0111\u1ecbnh \u0111\u1ec3 ti\u1ec7n ph\u00e2n t\u00edch:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">wordfence malware-scan --output-path=\/home\/yourdomain.com\/public_html\/wordfence-scan-log.log \/home\/yourdomain.com\/public_html\/<\/code><\/pre><h3>L\u01b0u \u00fd c\u1ef1c k\u1ef3 quan tr\u1ecdng v\u1ec1 s\u1ed1 file b\u1ecb b\u1ecf qua (Skipped Files)<\/h3><p>Trong qu\u00e1 tr\u00ecnh qu\u00e9t, h\u1ec7 th\u1ed1ng b\u00e1o c\u00e1o c\u00f3 t\u1edbi <strong>7,903 files b\u1ecb b\u1ecf qua<\/strong>. L\u00fd do l\u00e0 Wordfence CLI theo m\u1eb7c \u0111\u1ecbnh ch\u1ec9 qu\u00e9t c\u00e1c file m\u00e3 ngu\u1ed3n (nh\u01b0 PHP). Tuy nhi\u00ean, hacker ng\u00e0y nay r\u1ea5t tinh vi, ch\u00fang th\u01b0\u1eddng gi\u1ea5u webshell ho\u1eb7c ch\u00e8n m\u00e3 PHP v\u00e0o trong c\u00e1c file t\u0129nh (nh\u01b0 \u0111u\u00f4i `.jpg`, `.png`, `.css`, ho\u1eb7c `.js`).<\/p><p>Do \u0111\u00f3, \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o l\u00e0m s\u1ea1ch tri\u1ec7t \u0111\u1ec3, b\u1ea1n b\u1eaft bu\u1ed9c ph\u1ea3i th\u1ef1c hi\u1ec7n qu\u00e9t s\u00e2u to\u00e0n b\u1ed9 b\u1eb1ng c\u00e1ch th\u00eam c\u1edd <code data-no-translation=\"\">--include-all-files<\/code>:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">wordfence malware-scan --include-all-files --output-path=\/home\/yourdomain.com\/public_html\/wordfence-scan-full-\\\\$(date +%Y%m%d-%H%M%S).log \/home\/yourdomain.com\/public_html\/<\/code><\/pre><p>Ngo\u00e0i ra, n\u1ebfu trong log b\u00e1o c\u00f3 <strong>timeout<\/strong> (h\u1ec7 th\u1ed1ng b\u1ecb 1 timeout), h\u00e3y ki\u1ec3m tra ngay file b\u1ecb timeout \u0111\u00f3. Nh\u1eefng file c\u00f3 dung l\u01b0\u1ee3ng l\u1edbn b\u1ea5t th\u01b0\u1eddng ho\u1eb7c x\u1eed l\u00fd qu\u00e1 l\u00e2u th\u01b0\u1eddng l\u00e0 c\u00e1c file ch\u1ee9a h\u00e0ng tri\u1ec7u d\u00f2ng code m\u00e3 h\u00f3a (obfuscated code) c\u1ee7a hacker.<\/p><p><img decoding=\"async\" src=\"https:\/\/dps.media\/wp-content\/uploads\/2026\/08\/xu_ly_wordpress_bi_hack_quy_trinh_10_buo_img3-1.png\" alt=\"\u5904\u7406 wordpress \u88ab\u9ed1\u5ba2\u653b\u51fb\" style=\"display:block;margin:20px auto;max-width:100%;height:auto\" title=\"\"><\/p><h2>B\u01b0\u1edbc 2: \u0110\u1ecdc file log v\u00e0 \u0111\u1ecbnh v\u1ecb ch\u00ednh x\u00e1c t\u00ean m\u00e3 \u0111\u1ed9c<\/h2><p>V\u00ec Wordfence ch\u1ec9 b\u00e1o s\u1ed1 l\u01b0\u1ee3ng file nghi ng\u1edd \u1edf ph\u1ea7n t\u1ed5ng k\u1ebft cu\u1ed1i c\u00f9ng, b\u1ea1n c\u1ea7n l\u1ecdc chi ti\u1ebft \u0111\u01b0\u1eddng d\u1eabn c\u1ee7a 3 file n\u00e0y b\u1eb1ng l\u1ec7nh l\u1ecdc <code data-no-translation=\"\">grep<\/code>:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">grep -i \"suspicious\\|malicious\\|match\" \/home\/yourdomain.com\/public_html\/wordfence-scan-log.log<\/code><\/pre><p>Ho\u1eb7c b\u1ea1n c\u00f3 th\u1ec3 xu\u1ea5t th\u1eb3ng k\u1ebft qu\u1ea3 qu\u00e9t ra \u0111\u1ecbnh d\u1ea1ng CSV \u0111\u1ec3 d\u1ec5 ph\u00e2n t\u00edch tr\u1ef1c quan:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">wordfence malware-scan --output-format=csv --output-path=\/home\/yourdomain.com\/public_html\/wordfence-scan-results.csv \/home\/yourdomain.com\/public_html\/<\/code><\/pre><p>D\u1ef1a tr\u00ean log th\u1ef1c t\u1ebf, ch\u00fang t\u00f4i ph\u00e1t hi\u1ec7n 3 file \u0111\u1ed9c h\u1ea1i c\u1ee5 th\u1ec3 g\u1ed3m:<\/p><ul>\n<li><strong>wp-content-filter\/wp-content-filter.php:<\/strong> Fake plugin ch\u1ee9a \u0111o\u1ea1n m\u00e3 \u0111\u1ed9c t\u1ea1o t\u00e0i kho\u1ea3n admin v\u00e0 in ra d\u00f2ng x\u00e1c nh\u1eadn \u201cOK\u201d. \u0110\u00e2y l\u00e0 ki\u1ec3u backdoor t\u1ea1o admin kinh \u0111i\u1ec3n, th\u01b0\u1eddng \u0111\u01b0\u1ee3c hacker k\u00edch ho\u1ea1t t\u1eeb xa th\u00f4ng qua m\u1ed9t tham s\u1ed1 HTTP \u1ea9n.<\/li>\n<li><strong>wordpress-cache-optimizer\/wordpress-cache-optimizer.php:<\/strong> Fake plugin ng\u1ee5y trang d\u01b0\u1edbi d\u1ea1ng c\u00f4ng c\u1ee5 t\u1ed1i \u01b0u b\u1ed9 nh\u1edb \u0111\u1ec7m (caching tool). File n\u00e0y ch\u1ee9a code t\u1ef1 \u0111\u1ed9ng ch\u00e8n m\u1ed9t t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb \u1ea9n v\u1edbi th\u00f4ng tin \u0111\u0103ng nh\u1eadp \u0111\u01b0\u1ee3c hardcode s\u1eb5n.<\/li>\n<li><strong>wp-fixplugin.php:<\/strong> \u4f4d\u4e8e\u6587\u4ef6\u5939\u4e2d <code data-no-translation=\"\">wp-content\/mu-plugins\/<\/code> (Must-Use Plugins, t\u1ef1 \u0111\u1ed9ng t\u1ea3i m\u00e0 kh\u00f4ng hi\u1ec3n th\u1ecb trong danh s\u00e1ch plugin th\u00f4ng th\u01b0\u1eddng). File n\u00e0y t\u1ef1 \u0111\u1ed9ng ch\u00e8n m\u1ed9t th\u1ebb script \u0111\u1ed9c h\u1ea1i d\u1ea1ng <code data-no-translation=\"\">&lt;script src=\"...\"&gt;<\/code> v\u00e0o th\u1ebb <code data-no-translation=\"\">&lt;head&gt;<\/code> c\u1ee7a trang web nh\u1eb1m redirect ng\u01b0\u1eddi d\u00f9ng sang c\u00e1c trang c\u00e1 \u0111\u1ed9. Tinh vi \u1edf ch\u1ed7, file n\u00e0y s\u1eed d\u1ee5ng h\u00e0m <code data-no-translation=\"\">is_user_logged_in()<\/code> \u0111\u1ec3 <strong>\u1ea9n script \u0111\u1ed9c h\u1ea1i n\u00e0y \u0111\u1ed1i v\u1edbi admin \u0111\u00e3 \u0111\u0103ng nh\u1eadp<\/strong> nh\u1eb1m tr\u00e1nh b\u1ecb ng\u01b0\u1eddi qu\u1ea3n tr\u1ecb ph\u00e1t hi\u1ec7n khi duy\u1ec7t web c\u1ee7a m\u00ecnh.<\/li>\n<\/ul><p>Sau khi \u0111\u00e3 bi\u1ebft ch\u00ednh x\u00e1c, h\u00e3y d\u00f9ng l\u1ec7nh x\u00f3a s\u1ea1ch c\u00e1c th\u01b0 m\u1ee5c v\u00e0 file \u0111\u1ed9c h\u1ea1i n\u00e0y:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">rm -rf \/home\/yourdomain.com\/public_html\/wp-content\/plugins\/wp-content-filter\nrm -rf \/home\/yourdomain.com\/public_html\/wp-content\/plugins\/wordpress-cache-optimizer\nrm \/home\/yourdomain.com\/public_html\/wp-content\/mu-plugins\/wp-fixplugin.php<\/code><\/pre><h2>B\u01b0\u1edbc 3: R\u00e0 so\u00e1t v\u00e0 x\u00f3a t\u00e0i kho\u1ea3n Admin gi\u1ea3 m\u1ea1o<\/h2><p>Li\u1ec7t k\u00ea t\u1ea5t c\u1ea3 c\u00e1c t\u00e0i kho\u1ea3n c\u00f3 quy\u1ec1n cao nh\u1ea5t tr\u00ean website b\u1eb1ng WP-CLI:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">wp user list --role=administrator --allow-root --path=\/home\/yourdomain.com\/public_html<\/code><\/pre><p>\u0110\u1ed1i chi\u1ebfu v\u1edbi m\u00e3 ngu\u1ed3n v\u00e0 th\u1eddi gian t\u1ea1o t\u00e0i kho\u1ea3n, ch\u00fang t\u00f4i ph\u00e1t hi\u1ec7n 2 t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb gi\u1ea3 m\u1ea1o do hacker t\u1ea1o ra:<\/p><ul>\n<li><strong>wphiddenbot (ID 4):<\/strong> T\u1ea1o l\u00fac 2026-07-21 03:54:55, t\u00ean hi\u1ec3n th\u1ecb \u201cCache Worker\u201d, email <code data-no-translation=\"\">wphiddenbot@gmail.com<\/code>. \u0110\u00e2y l\u00e0 t\u00e0i kho\u1ea3n \u0111\u01b0\u1ee3c t\u1ea1o ra b\u1edfi fake plugin <code data-no-translation=\"\">wordpress-cache-optimizer.php<\/code>.<\/li>\n<li><strong>wpenginebot (ID 3):<\/strong> T\u1ea1o l\u00fac 2026-07-20 21:41:33 (tr\u01b0\u1edbc wphiddenbot kho\u1ea3ng 6 ti\u1ebfng). \u0110\u00e2y ch\u00ednh l\u00e0 t\u00e0i kho\u1ea3n do backdoor <code data-no-translation=\"\">wp-content-filter.php<\/code> t\u1ea1o ra. Kho\u1ea3ng th\u1eddi gian t\u1ea1o tr\u00f9ng kh\u1edbp v\u1edbi th\u1eddi \u0111i\u1ec3m m\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c th\u1ea3 v\u00e0o server.<\/li>\n<\/ul><p>Ti\u1ebfn h\u00e0nh x\u00f3a b\u1ecf 2 t\u00e0i kho\u1ea3n gi\u1ea3 m\u1ea1o n\u00e0y v\u00e0 g\u00e1n l\u1ea1i b\u00e0i vi\u1ebft sang cho t\u00e0i kho\u1ea3n admin th\u1eadt (ID 1):<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">wp user delete 3 --reassign=1 --allow-root --path=\/home\/yourdomain.com\/public_html\nwp user delete 4 --reassign=1 --allow-root --path=\/home\/yourdomain.com\/public_html<\/code><\/pre><h2>B\u01b0\u1edbc 4: D\u1ecdn d\u1eb9p c\u1ea5u h\u00ecnh \u0111\u1ed9c h\u1ea1i \u1ea9n s\u00e2u trong Database<\/h2><p>M\u00e3 \u0111\u1ed9c kh\u00f4ng ch\u1ec9 n\u1eb1m \u1edf file m\u00e0 c\u00f2n l\u01b0u c\u00e1c c\u1ea5u h\u00ecnh \u0111\u1ed9c h\u1ea1i trong database (b\u1ea3ng <code data-no-translation=\"\">wp_options<\/code>). R\u1ea5t nhi\u1ec1u tr\u01b0\u1eddng h\u1ee3p ng\u01b0\u1eddi qu\u1ea3n tr\u1ecb x\u00f3a file PHP nh\u01b0ng kh\u00f4ng d\u1ecdn d\u1eb9p DB n\u00ean website v\u1eabn ti\u1ebfp t\u1ee5c b\u1ecb hack l\u1ea1i.<\/p><p>\u0110\u1ec3 t\u00ecm ki\u1ebfm c\u00e1c option \u0111\u1ed9c h\u1ea1i n\u00e0y trong database, b\u1ea1n s\u1eed d\u1ee5ng WP-CLI ch\u1ea1y c\u00e1c l\u1ec7nh ki\u1ec3m tra sau (l\u01b0u \u00fd thay \u0111\u1ed5i \u0111\u01b0\u1eddng d\u1eabn domain th\u1ef1c t\u1ebf th\u00e0nh <code data-no-translation=\"\">yourdomain.com<\/code>):<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">wp option list --search=\"*fixplugin*\" --allow-root --path=\/home\/yourdomain.com\/public_html\nwp option list --search=\"*cache_optimizer*\" --allow-root --path=\/home\/yourdomain.com\/public_html\nwp option list --search=\"*content_filter*\" --allow-root --path=\/home\/yourdomain.com\/public_html<\/code><\/pre><p>K\u1ebft qu\u1ea3 hi\u1ec3n th\u1ecb tr\u00ean terminal s\u1ebd gi\u00fap b\u1ea1n nh\u1eadn di\u1ec7n ngay c\u00e1c c\u1ea5u h\u00ecnh b\u1ea5t th\u01b0\u1eddng:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">+-------------------------+--------------------------------------------------+\n| option_name             | option_value                                     |\n+-------------------------+--------------------------------------------------+\n| wp_fixplugin_script_url | https:\/\/mamglaqwek.com\/googletagmanager.js?v=2.0 |\n| wp_fixplugin_script_ver | 1785515873                                       |\n+-------------------------+--------------------------------------------------+\n+-------------+--------------+\n| option_name | option_value |\n+-------------+--------------+\n+-------------+--------------+\n| option_name | option_value |\n+-------------+--------------+\n+-------------+--------------+\n| option_name | option_value |\n+-------------+--------------+<\/code><\/pre><p>C\u1ee5 th\u1ec3, mu-plugin <code data-no-translation=\"\">wp-fixplugin.php<\/code> g\u1ecdi h\u00e0m <code data-no-translation=\"\">get_option()<\/code> t\u1eeb c\u00e1c h\u1eb1ng s\u1ed1 c\u1ea5u h\u00ecnh. Khi ki\u1ec3m tra th\u1ef1c t\u1ebf, ch\u00fang t\u00f4i t\u00ecm th\u1ea5y hai option \u0111\u1ed9c h\u1ea1i \u0111\u01b0\u1ee3c th\u00eam v\u00e0o b\u1ea3ng <code data-no-translation=\"\">wp_options<\/code>:<\/p><ul>\n<li><strong>wp_fixplugin_script_url:<\/strong> L\u01b0u gi\u00e1 tr\u1ecb link script \u0111\u1ed9c h\u1ea1i <code data-no-translation=\"\">https:\/\/mamglaqwek.com\/googletagmanager.js?v=2.0<\/code>. Link n\u00e0y gi\u1ea3 danh Google Tag Manager \u0111\u1ec3 l\u1eabn l\u1ed9n v\u1edbi m\u00e3 tracking th\u1eadt c\u1ee7a b\u1ea1n (v\u00ed d\u1ee5 <code data-no-translation=\"\">GTM-WPTSRZZJ<\/code>).<\/li>\n<li><strong>wp_fixplugin_script_ver:<\/strong> L\u01b0u timestamp <code data-no-translation=\"\">1785511188<\/code> (ho\u1eb7c c\u00e1c bi\u1ebfn th\u1ec3 timestamp kh\u00e1c nh\u01b0 <code data-no-translation=\"\">1785515873<\/code>).<\/li>\n<\/ul><p>Hai option n\u00e0y c\u00f3 <code data-no-translation=\"\">option_id<\/code> r\u1ea5t l\u1edbn (l\u00ean t\u1edbi 100,136), ch\u1ee9ng t\u1ecf ch\u00fang m\u1edbi \u0111\u01b0\u1ee3c ti\u00eam v\u00e0o g\u1ea7n \u0111\u00e2y trong chu\u1ed7i t\u1ea5n c\u00f4ng ng\u00e0y 20-21\/07. Ti\u1ebfn h\u00e0nh x\u00f3a s\u1ea1ch c\u00e1c option n\u00e0y b\u1eb1ng WP-CLI:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">wp option delete wp_fixplugin_script_url --allow-root --path=\/home\/yourdomain.com\/public_html\nwp option delete wp_fixplugin_script_ver --allow-root --path=\/home\/yourdomain.com\/public_html<\/code><\/pre><h3>Truy v\u1ebft v\u00e0 t\u00ecm ki\u1ebfm s\u00e2u h\u01a1n:<\/h3><p>Hacker th\u01b0\u1eddng c\u00f3 c\u01a1 ch\u1ebf d\u1ef1 ph\u00f2ng, ch\u00e8n link \u0111\u1ed9c h\u1ea1i <code data-no-translation=\"\">mamglaqwek.com<\/code> \u1edf nhi\u1ec1u n\u01a1i kh\u00e1c nh\u01b0 n\u1ed9i dung b\u00e0i vi\u1ebft, widget ho\u1eb7c theme. B\u00e1c c\u1ea7n qu\u00e9t to\u00e0n b\u1ed9 h\u1ec7 th\u1ed1ng \u0111\u1ec3 t\u00ecm ki\u1ebfm d\u1ea5u v\u1ebft c\u1ee7a domain n\u00e0y:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\"># Qu\u00e9t t\u00ecm trong to\u00e0n b\u1ed9 file c\u1ee7a wp-content\ngrep -rl \"mamglaqwek.com\" \/home\/yourdomain.com\/public_html\/ 2>\/dev\/null\n\n# Qu\u00e9t t\u00ecm trong to\u00e0n b\u1ed9 c\u00e1c b\u1ea3ng d\u1eef li\u1ec7u database\nwp db search \"mamglaqwek.com\" --allow-root --path=\/home\/yourdomain.com\/public_html<\/code><\/pre><h2>B\u01b0\u1edbc 5: Ki\u1ec3m tra c\u00e1c file c\u1ea5u h\u00ecnh v\u00e0 v\u00e1 l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng<\/h2><p>\u4ed4\u7ec6\u9605\u8bfb\u6587\u4ef6 <code data-no-translation=\"\">.htaccess<\/code> v\u00e0 <code data-no-translation=\"\">wp-config.php<\/code>:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">cat \/home\/yourdomain.com\/public_html\/.htaccess\ncat \/home\/yourdomain.com\/public_html\/wp-config.php | grep -v \"^\\s*\/\/\" | grep -v \"^\\s*\\$\"<\/code><\/pre><p>Ki\u1ec3m tra k\u1ef9 xem c\u00f3 quy t\u1eafc chuy\u1ec3n h\u01b0\u1edbng l\u1ea1 n\u00e0o trong `.htaccess` kh\u00f4ng. \u0110\u1ed3ng th\u1eddi, qua r\u00e0 so\u00e1t file `wp-config.php`, ch\u00fang t\u00f4i ph\u00e1t hi\u1ec7n 2 l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt nghi\u00eam tr\u1ecdng c\u1ea7n x\u1eed l\u00fd ngay:<\/p><h3>1. C\u00e1c kh\u00f3a b\u1ea3o m\u1eadt (Salts key) ch\u01b0a \u0111\u01b0\u1ee3c thi\u1ebft l\u1eadp<\/h3><p>C\u00e1c kh\u00f3a d\u00f9ng \u0111\u1ec3 m\u00e3 h\u00f3a cookie \u0111\u0103ng nh\u1eadp v\u1eabn \u0111ang \u0111\u1ec3 gi\u00e1 tr\u1ecb m\u1eb7c \u0111\u1ecbnh c\u1ee7a WordPress:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">define( 'AUTH_KEY',         'put your unique phrase here' );\ndefine( 'SECURE_AUTH_KEY',  'put your unique phrase here' );\n...<\/code><\/pre><p>H\u00e3y l\u1ea5y b\u1ed9 kh\u00f3a ng\u1eabu nhi\u00ean m\u1edbi t\u1eeb WordPress.org b\u1eb1ng c\u00e1ch ch\u1ea1y l\u1ec7nh:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">curl -s https:\/\/api.wordpress.org\/secret-key\/1.1\/salt\/<\/code><\/pre><p>Ho\u1eb7c \u0111\u1ea3o Salts key t\u1ef1 \u0111\u1ed9ng b\u1eb1ng WP-CLI (vi\u1ec7c n\u00e0y s\u1ebd \u00e9p t\u1ea5t c\u1ea3 t\u00e0i kho\u1ea3n \u0111ang \u0111\u0103ng nh\u1eadp, k\u1ec3 c\u1ea3 hacker, ph\u1ea3i tho\u00e1t ra l\u1eadp t\u1ee9c):<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">wp config shuffle-salts --allow-root --path=\/home\/yourdomain.com\/public_html<\/code><\/pre><h3>2. M\u1eadt kh\u1ea9u Database b\u1ecb r\u00f2 r\u1ec9 ho\u1eb7c qu\u00e1 y\u1ebfu<\/h3><p>N\u1ebfu m\u1eadt kh\u1ea9u k\u1ebft n\u1ed1i database c\u1ee7a b\u1ea1n b\u1ecb l\u1ed9 trong log ho\u1eb7c qu\u00e1 \u0111\u01a1n gi\u1ea3n, h\u00e3y ti\u1ebfn h\u00e0nh \u0111\u1ed5i ngay tr\u00ean MySQL console:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\"># Truy c\u1eadp MySQL Console\nmysql -u root -p\n\n# Thay \u0111\u1ed5i m\u1eadt kh\u1ea9u cho user k\u1ebft n\u1ed1i database\nALTER USER 'yourdomain_wp_user'@'localhost' IDENTIFIED BY 'mat_khau_moi_sieu_manh';\nFLUSH PRIVILEGES;\nEXIT;<\/code><\/pre><p>Sau \u0111\u00f3, c\u1eadp nh\u1eadt l\u1ea1i m\u1eadt kh\u1ea9u m\u1edbi n\u00e0y v\u00e0o d\u00f2ng <code data-no-translation=\"\">DB_PASSWORD<\/code> trong file <code data-no-translation=\"\">wp-config.php<\/code>.<\/p><h2>B\u01b0\u1edbc 6: Thay th\u1ebf to\u00e0n b\u1ed9 m\u00e3 ngu\u1ed3n Core b\u1eb1ng b\u1ea3n s\u1ea1ch<\/h2><p>\u0110\u1ec3 \u0111\u1ea3m b\u1ea3o kh\u00f4ng c\u00f2n file h\u1ec7 th\u1ed1ng n\u00e0o b\u1ecb hacker \u00e2m th\u1ea7m ch\u1ec9nh s\u1eeda, b\u1ea1n h\u00e3y ghi \u0111\u00e8 core s\u1ea1ch t\u1eeb ngu\u1ed3n ch\u00ednh th\u1ee9c c\u1ee7a WordPress (b\u1ecf qua th\u01b0 m\u1ee5c wp-content):<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">cd \/tmp\nwget https:\/\/downloads.wordpress.org\/release\/wordpress-7.0.2-no-content.zip\nunzip wordpress-7.0.2-no-content.zip\n\n# Sao l\u01b0u wp-admin v\u00e0 wp-includes c\u0169 \u0111\u1ec3 d\u1ef1 ph\u00f2ng\ncp -r \/home\/yourdomain.com\/public_html\/wp-admin \/home\/yourdomain.com\/wp-admin-backup-\\\\$(date +%Y%m%d)\ncp -r \/home\/yourdomain.com\/public_html\/wp-includes \/home\/yourdomain.com\/wp-includes-backup-\\\\$(date +%Y%m%d)\n\n# S\u1eed d\u1ee5ng rsync ghi \u0111\u00e8 core s\u1ea1ch\nrsync -av --exclude='wp-content' \/tmp\/wordpress\/ \/home\/yourdomain.com\/public_html\/<\/code><\/pre><h2>B\u01b0\u1edbc 7: Reset m\u1eadt kh\u1ea9u t\u00e0i kho\u1ea3n Admin th\u1eadt<\/h2><p>\u0110\u1ed5i m\u1eadt kh\u1ea9u cho to\u00e0n b\u1ed9 t\u00e0i kho\u1ea3n admin th\u1ef1c t\u1ebf c\u1ee7a h\u1ec7 th\u1ed1ng (nh\u01b0 t\u00e0i kho\u1ea3n <code data-no-translation=\"\">admindps<\/code> v\u00e0 c\u00e1c admin kh\u00e1c) qua WP-CLI:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">wp user update admindps --user_pass=\"MatKhauMoiSieuCapBaoMat@2026\" --allow-root --path=\/home\/yourdomain.com\/public_html<\/code><\/pre><h2>B\u01b0\u1edbc 8: Ch\u1eb7n th\u1ef1c thi file PHP trong th\u01b0 m\u1ee5c Uploads<\/h2><p>\u0110\u00e2y l\u00e0 h\u00e0nh \u0111\u1ed9ng gia c\u1ed1 b\u1ea3o m\u1eadt bu\u1ed9c ph\u1ea3i l\u00e0m. Hacker r\u1ea5t hay l\u1ee3i d\u1ee5ng l\u1ed7 h\u1ed5ng upload \u0111\u1ec3 t\u1ea3i webshell \u1ea9n d\u01b0\u1edbi d\u1ea1ng \u0111u\u00f4i `.png.php` ho\u1eb7c t\u01b0\u01a1ng t\u1ef1 v\u00e0o th\u01b0 m\u1ee5c uploads. H\u00e3y t\u1ea1o file <code data-no-translation=\"\">.htaccess<\/code> n\u1eb1m trong th\u01b0 m\u1ee5c <code data-no-translation=\"\">wp-content\/uploads\/<\/code> \u5305\u542b\u963b\u6b62\u6267\u884c PHP \u7684\u5185\u5bb9\uff1a<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">&lt;Files *.php&gt;\n    deny from all\n&lt;\/Files&gt;<\/code><\/pre><h2>B\u01b0\u1edbc 9: Qu\u00e9t l\u1ea1i h\u1ec7 th\u1ed1ng l\u1ea7n cu\u1ed1i \u0111\u1ec3 x\u00e1c nh\u1eadn s\u1ea1ch<\/h2><p>Ch\u1ea1y l\u1ea1i l\u1ec7nh qu\u00e9t to\u00e0n di\u1ec7n \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o kh\u00f4ng c\u00f2n b\u1ea5t k\u1ef3 m\u1ed1i \u0111e d\u1ecda n\u00e0o s\u00f3t l\u1ea1i:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">wordfence malware-scan --include-all-files --output-path=\/home\/yourdomain.com\/public_html\/wordfence-scan-final.log \/home\/yourdomain.com\/public_html\/<\/code><\/pre><p>Khi k\u1ebft qu\u1ea3 tr\u1ea3 v\u1ec1 ho\u00e0n to\u00e0n s\u1ea1ch s\u1ebd, h\u00e3y t\u1eaft ch\u1ebf \u0111\u1ed9 b\u1ea3o tr\u00ec:<\/p><pre data-no-translation=\"\"><code data-no-translation=\"\">wp maintenance-mode deactivate --allow-root --path=\/home\/yourdomain.com\/public_html<\/code><\/pre><h2>B\u01b0\u1edbc 10: Ph\u00e2n quy\u1ec1n file v\u00e0 theo d\u00f5i li\u00ean t\u1ee5c<\/h2><p>\u5c06\u76ee\u5f55\u6743\u9650\u8bbe\u7f6e\u4e3a <code data-no-translation=\"\">755<\/code>, \u6587\u4ef6\u662f <code data-no-translation=\"\">644<\/code>, \u548c\u6587\u4ef6 <code data-no-translation=\"\">wp-config.php<\/code> \u662f <code data-no-translation=\"\">400<\/code> ho\u1eb7c <code data-no-translation=\"\">600<\/code> \u0111\u1ec3 ng\u0103n ch\u1eb7n vi\u1ec7c ch\u1ec9nh s\u1eeda file c\u1ea5u h\u00ecnh.<\/p><h2>T\u1ed1i \u01b0u b\u1ea3o m\u1eadt website c\u00f9ng d\u1ecbch v\u1ee5 chuy\u00ean nghi\u1ec7p DPS.MEDIA<\/h2><p>D\u1ecdn s\u1ea1ch m\u00e3 \u0111\u1ed9c ch\u1ec9 gi\u1ea3i quy\u1ebft ph\u1ea7n ng\u1ecdn. \u0110i\u1ec1u c\u1ed1t l\u00f5i l\u00e0 b\u1ea1n ph\u1ea3i t\u00ecm ra l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt ban \u0111\u1ea7u b\u1eb1ng c\u00e1ch ph\u00e2n t\u00edch Access Log c\u1ee7a Web Server t\u1ea1i th\u1eddi \u0111i\u1ec3m file backdoor \u0111\u01b0\u1ee3c t\u1ea1o \u0111\u1ec3 b\u1ecbt k\u1ebd h\u1edf \u0111\u00f3 l\u1ea1i, ng\u0103n ch\u1eb7n hacker quay l\u1ea1i v\u00e0o l\u1ea7n sau.<\/p><p>B\u1ea1n n\u00ean t\u00ecm hi\u1ec3u c\u00e1c ti\u00eau chu\u1ea9n b\u1ea3o m\u1eadt ch\u00ednh th\u1ee9c qua <a href=\"https:\/\/wordpress.org\/support\/article\/hardening-wordpress\/\" rel=\"nofollow noopener\" target=\"_blank\">\u5b98\u65b9 WordPress \u52a0\u56fa\u6587\u6863<\/a> \u0111\u1ec3 n\u00e2ng cao t\u00ednh an to\u00e0n cho h\u1ec7 th\u1ed1ng.<\/p><p>N\u1ebfu b\u1ea1n \u0111ang g\u1eb7p kh\u00f3 kh\u0103n trong vi\u1ec7c d\u1ecdn d\u1eb9p m\u00e3 \u0111\u1ed9c ho\u1eb7c mu\u1ed1n gia c\u1ed1 h\u1ec7 th\u1ed1ng b\u1ea3o m\u1eadt to\u00e0n di\u1ec7n cho website c\u1ee7a m\u00ecnh, h\u00e3y li\u00ean h\u1ec7 ngay v\u1edbi DPS.MEDIA qua Hotline\/Zalo: <strong>0961545445<\/strong> ho\u1eb7c gh\u00e9 th\u0103m v\u0103n ph\u00f2ng t\u1ea1i s\u1ed1 <strong>56 Nguy\u1ec5n \u0110\u00ecnh Chi\u1ec3u\uff0cT\u00e2n \u0110\u1ecbnh\u574a\uff0c\u7b2c1\u90e1\uff0c\u80e1\u5fd7\u660e\u5e02<\/strong>. Ch\u00fang t\u00f4i mang \u0111\u1ebfn <a href=\"https:\/\/dps.media\/zh\/\">\u4e13\u4e1a\u7684 WordPress \u7f51\u7ad9\u8bbe\u8ba1\u670d\u52a1<\/a> chu\u1ea9n SEO, t\u00edch h\u1ee3p b\u1ea3o m\u1eadt t\u1ef1 \u0111\u1ed9ng nhi\u1ec1u l\u1edbp v\u00e0 ch\u1ebf \u0111\u1ed9 sao l\u01b0u an to\u00e0n h\u00e0ng ng\u00e0y, gi\u00fap b\u1ea1n an t\u00e2m v\u1eadn h\u00e0nh doanh nghi\u1ec7p ph\u00e1t tri\u1ec3n b\u1ec1n v\u1eefng.<\/p>","protected":false},"excerpt":{"rendered":"<p>WordPress \u7f51\u7ad9\u88ab\u9ed1\u540e\u7684\u8be6\u7ec6\u5904\u7406\u6d41\u7a0b\u6307\u5357\uff0c\u6e05\u7406 fake plugin wordpress-cache-optimizer.php\u3001wp-content-filter.php\u3001mu-plugin wp-fixplugin.php\uff0c\u5e76\u4fee\u590d Salts key \u6f0f\u6d1e\u3002.<\/p>","protected":false},"author":0,"featured_media":39996,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2037,2288,1204],"tags":[],"class_list":["post-39989","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bao-mat-website","category-thu-thuat-wordpress","category-wordpress-marketing"],"acf":[],"rankmath_keywords":{"primary":"x\u1eed l\u00fd wordpress b\u1ecb hack, wordpress b\u1ecb hack, c\u00e1ch x\u1eed l\u00fd wordpress b\u1ecb hack","secondary":["wordpress b\u1ecb hack","c\u00e1ch x\u1eed l\u00fd wordpress b\u1ecb hack"]},"yoast_keywords":{"primary":"","secondary":[]},"yoast_focuskw":"","rankmath_focuskw":"x\u1eed l\u00fd wordpress b\u1ecb hack, wordpress b\u1ecb hack, c\u00e1ch x\u1eed l\u00fd wordpress b\u1ecb hack","seo_keywords":{"primary":"x\u1eed l\u00fd wordpress b\u1ecb hack, wordpress b\u1ecb hack, c\u00e1ch x\u1eed l\u00fd wordpress b\u1ecb hack","secondary":["wordpress b\u1ecb hack","c\u00e1ch x\u1eed l\u00fd wordpress b\u1ecb hack"]},"_links":{"self":[{"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/posts\/39989","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/comments?post=39989"}],"version-history":[{"count":0,"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/posts\/39989\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/media\/39996"}],"wp:attachment":[{"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/media?parent=39989"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/categories?post=39989"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dps.media\/zh\/wp-json\/wp\/v2\/tags?post=39989"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}