How to Fix the EssentialPlugin WordPress Backdoor

1. Remove all EssentialPlugin products: Log into your site (or use SFTP) and completely delete any plugin authored by EssentialPlugin. Simply deactivating them is not enough, as the malicious code remains on your server.
2. Delete wp-comments-posts.php: Check your WordPress web root directory (where wp-config.php lives). If you see a file named wp-comments-posts.php (with an “s” at the end of “posts”), delete it immediately.
3. Clean your wp-config.php file: Open your wp-config.php file and look for large blocks of obfuscated code or unexpected PHP near the require_once ABSPATH . 'wp-settings.php' line. Remove the malicious injections, or replace the file entirely with a clean backup, ensuring your database credentials remain intact.
4. Run a malware scan: Run a reputable WordPress security scanner to check for any secondary backdoors, rogue admin users, or hidden spam pages that the attacker may have left behind.

<?php
/**
 * Plugin Name: Block EssentialPlugin Analytics Endpoint
 * Description: Blocks outbound HTTP requests from WordPress to analytics.essentialplugin.com.
 * Author: Arden Web Ops
 * Version: 1.0.0
 */

add_filter( 'pre_http_request', function( $pre, $args, $url ) {
    $host = parse_url( $url, PHP_URL_HOST );

    if ( ! $host ) {
        return $pre;
    }

    $host = strtolower( $host );

    // Block exact domain and any future subdomains
    if ( $host === 'analytics.essentialplugin.com' || str_ends_with( $host, '.analytics.essentialplugin.com' ) ) {
        return new WP_Error(
            'blocked_essentialplugin_analytics',
            'HTTP request to analytics.essentialplugin.com blocked by mu-plugin.'
        );
    }

    return $pre;
}, 10, 3 );