Shell script to validate Wordpress installs on a cPanel server. This is very useful for identifying compromised sites and removing unexpected files.

verify-wp-bulk.sh

#!/bin/bash

for i in `/usr/local/cpanel/bin/apitool listaccts --output json | jq -r '.data.acct[] | select(.suspended == 0) | .user'`; do 
    echo "Verifying account: ${i}"; 
    
    sketchy=$(su -s /bin/bash -c "wp core verify-checksums --path=/home/${i}/public_html/" ${i} 2>&1 | grep 'File should not exist' | awk -F' ' '{print $NF}')
    
    for sketch in $sketchy; do
        echo "++ Removing file: /home/${i}/public_html/${sketch}";
        rm -f /home/${i}/public_html/${sketch}
    done
    
    for subsite in `find /home/${i}/public_html/ -name "wp-config.php" | grep -Po "/home/${i}/public_html/\K.*(?=/wp-config.php)"`; do 
        echo "Verifying sub-site account: ${subsite}";
        sketchy=$(su -s /bin/bash -c "wp core verify-checksums --path=/home/${i}/public_html/${subsite}" ${i} 2>&1 | grep 'File should not exist' | awk -F' ' '{print $NF}')
    
        for sketch in $sketchy; do
            echo "++ Removing file: /home/${i}/public_html/${subsite}/${sketch}";
            rm -f /home/${i}/public_html/${subsite}/${sketch}
        done
    done
done