WordPress（AWS环境）：aws-autoloader.php被替换为.suspected致500错误求助

Got it, let's walk through fixing this issue step by step—you're dealing with a leftover hack backdoor plus a potential Wordfence false positive, which is why that file keeps getting renamed. Here's what to do:

• Rename aws-autoloader.php.suspected back to aws-autoloader.php at the path /var/www/html/wp-content/plugins/amazon-web-services/vendor/aws/aws-autoloader.php. This should immediately fix the 500 error since the AWS plugin depends on this file to load properly.

You need to confirm if the file was actually tampered with by the hacker, or if it's a false positive:

• Download a fresh, unmodified copy of the Amazon Web Services plugin from the official WordPress plugin repository.
• Extract the vendor/aws/aws-autoloader.php file from the fresh download and compare it to the one on your server (use a command-line diff tool like diff, or a text editor with built-in file comparison features).
  • If you spot extra code (like base64-encoded strings, strange function calls, or code that doesn't match AWS's official autoloader), the file was compromised—this explains why Wordfence is flagging it.
  • If the files are identical, it's a Wordfence false positive, and we can resolve that later.

The file keeps getting renamed because the hacker left a backdoor on your server that's either re-uploading a compromised version or triggering Wordfence's detection repeatedly. Here's how to clean it up:

• Run a deep, high-sensitivity scan with Wordfence: Go to Wordfence > Scan > Start New Scan, and ensure "High Sensitivity Scan" is enabled. This will catch hidden webshells, modified core files, and malicious scripts.
• Manually audit high-risk directories:
  • wp-content/uploads/: Look for unexpected PHP files (especially those with random names like xyz123.php) or images that contain hidden PHP code.
  • wp-includes/ and wp-admin/: Verify core files haven't been modified (Wordfence's scan will flag this, but double-check if you're unsure).
  • Root directory: Check .htaccess for odd redirect rules, and look for hidden files (starting with .) that shouldn't exist.
• Audit your database:
  • In phpMyAdmin, check the wp_options table for suspicious entries in active_plugins (unknown plugins) or siteurl/home (unexpected URL changes).
  • Scan the wp_posts table for hidden or unpublished posts that contain malicious code.
• Reset file permissions: Set files to 644 and directories to 755 (use commands like chmod -R 644 /var/www/html/wp-content/* and chmod -R 755 /var/www/html/wp-content/—adjust paths as needed). This removes excessive write permissions that hackers exploit.

If the autoloader file is clean and matches the official version:

• Go to Wordfence > Tools > File Scan. Find the aws-autoloader.php entry marked as suspected.
• Click "Add to Allowlist" so Wordfence stops flagging it.
• Update Wordfence to the latest version and refresh its rule set—this often resolves outdated false positive detections.

• Keep WordPress core, all plugins, and your theme fully updated. Enable auto-updates for critical components if possible.
• Turn on Wordfence's Real-Time Protection and enable two-factor authentication for all admin accounts.
• If you're on AWS, consider setting up AWS WAF to block malicious IPs and common attack patterns at the server level.

内容的提问来源于stack exchange，提问作者Zammuuz