Rescue tool: user guide

The rescue tool checks a WordPress site without loading WordPress. Use it when the site is broken (blank page, admin unreachable), when an intruder deleted the IntegriFix plugin, or to confirm from the outside a result obtained in WordPress.

It comes in two editions, each a single readable PHP file:

• integrifix-rescue.php (free): command-line scan (SSH, or a downloaded copy of the site). It never writes to the site.
• integrifix-rescue-pro.php (Pro): adds command-line repair and a browser mode (file uploaded by FTP, then opened in the browser). It writes to the site only when you ask for a repair, with a copy of every file.

Getting the tool

Both editions are downloaded from the Download page: the free edition directly, the Pro edition with your licence key, e-mailed after the purchase. The SHA-256 fingerprint of each file is shown next to it, so you can check you have the published file.

Using the tool in the browser (Pro)

No technical knowledge is needed beyond FTP access (or your host's file manager).

1. Connect to the site by FTP (FileZilla, Cyberduck…) or with your host's file manager. Open the folder that holds wp-config.php and the wp-admin and wp-includes folders.
2. Upload integrifix-rescue-pro.php into that folder.
3. Open https://your-site.com/integrifix-rescue-pro.php in your browser. The page asks for an access code.
4. In the same FTP folder, a file integrifix-rescue-access.php has appeared. Download it and open it with a text editor: it holds the code, in 8 groups of 4 characters. Paste it into the page, then “Open the tool”.
5. “Start a scan”. The page shows the progress; if it closes, the scan resumes the next time.
6. Read the verdict and the points found: each card says what is happening, why it matters and what to do. Repair a point, or tick several and “Repair the selected points”. The “Before changing your files” screen shows exactly what will be done.
7. After the repair, start a new scan to confirm. Every repair can be undone from the “Repairs” screen for 30 days, as long as the tool stays on the server.
8. When you are done, remove the tool: “Remove the tool” button, then the access code to confirm. Repairs can no longer be undone afterwards.

The access code works for 24 hours, and a session closes after 2 hours without activity.

What the tool does

• It compares every file of WordPress core and of the plugins and themes published on WordPress.org with the exact version installed, and inspects the sensitive places: media, wp-config.php, .htaccess, .user.ini, must-use plugins, folders next to WordPress.
• Pro edition: on request, it repairs a modified or missing file of core or of a WordPress.org plugin or theme (the official version is checked against its published fingerprint before it is written), and quarantines an intruding code file.
• Before every write, a copy of the current state is saved and read back; when in doubt, the previous state is put back.

What the tool never does

• It does not load WordPress and does not touch the database.
• It never changes wp-config.php, .htaccess, .user.ini, php.ini or web.config: these points are explained, a person decides.
• It does not repair premium or custom plugins: there is no public official copy to rely on.
• It only contacts WordPress.org. Nothing is sent anywhere else.

Limits

A hacked server can lie: code loaded before the tool can distort the result. In that case, prefer the command line over SSH, scan a downloaded copy of the site on a clean computer (free edition), or ask your host for help.

From the command line

• php integrifix-rescue.php scan /path/to/wordpress: scan (both editions).
• php integrifix-rescue-pro.php repair /path/to/wordpress: repair plan, nothing is changed.
• php integrifix-rescue-pro.php repair /path/to/wordpress --apply: repairs.
• php integrifix-rescue-pro.php history /path/to/wordpress: repairs made.
• php integrifix-rescue-pro.php rollback /path/to/wordpress <id>: undoes a repair.

A question? Write to support@integrifix.fr.