Tip: Manually Verify wp-config.php After Any WordPress Plugin Update — Automated Cleanup Misses It

TechCrunch·medium signal

The Essential Plugin supply chain attack injected malicious code directly into wp-config.php, one of the most sensitive WordPress core files. Standard plugin updates and security scanners don't clean wp-config.php because it's treated as user-configured. Even after removing the compromised plugins, sites that were infected during the April 5-6 activation window may still be serving hidden spam exclusively to Googlebot. Run 'diff wp-config.php wp-config-sample.php' and manually audit any unfamiliar code blocks, especially anything that fetches remote URLs or conditionally executes based on user agent.