{"id":238,"date":"2026-10-17T11:03:45","date_gmt":"2026-10-17T09:03:45","guid":{"rendered":"https:\/\/helloblog.io\/cs\/rank-math-pro-3-0-123-malware-kontrola-a-obnova-webu\/"},"modified":"2026-10-17T11:03:45","modified_gmt":"2026-10-17T09:03:45","slug":"rank-math-pro-3-0-123-malware-kontrola-a-obnova-webu","status":"publish","type":"post","link":"https:\/\/helloblog.io\/cs\/rank-math-pro-3-0-123-malware-kontrola-a-obnova-webu\/","title":{"rendered":"Rank Math PRO 3.0.123 obsahoval malware: jak zkontrolovat a vy\u010distit web"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Pokud jsi mezi 15. a 16. \u0159\u00edjnem 2026 instaloval nebo aktualizoval Rank Math PRO, zkontroluj nejen verzi, ale i \u010das, kdy jsi bal\u00ed\u010dek z\u00edskal. \u010c\u00e1st ofici\u00e1ln\u00edch bal\u00ed\u010dk\u016f verze <strong>3.0.123 obsahovala malware<\/strong>, kter\u00fd se spustil p\u0159i aktivaci pluginu. \u010cist\u00e1 verze <strong>3.0.124<\/strong> u\u017e \u0161kodliv\u00fd k\u00f3d neobsahuje, ale neodstran\u00ed zadn\u00ed vr\u00e1tka, \u00fa\u010dty ani napl\u00e1novan\u00e9 \u00falohy, kter\u00e9 malware mezit\u00edm vytvo\u0159il jinde.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Co se stalo a kter\u00e9 bal\u00ed\u010dky jsou zasa\u017een\u00e9<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u00datok zas\u00e1hl dodavatelsk\u00fd \u0159et\u011bzec: malware se dostal p\u0159\u00edmo do ofici\u00e1ln\u00edho instala\u010dn\u00edho a aktualiza\u010dn\u00edho bal\u00ed\u010dku pluginu. Ne\u0161lo tedy o b\u011b\u017enou chybu v k\u00f3du, kterou by \u00fato\u010dn\u00edk n\u00e1sledn\u011b zneu\u017eil. Incident m\u00e1 ozna\u010den\u00ed <strong>CVE-2026-111862<\/strong> a sk\u00f3re z\u00e1va\u017enosti CVSS <strong>9,8 &#8211; kritick\u00e1<\/strong>; z\u00e1znam jej klasifikuje jako vlo\u017een\u00fd \u0161kodliv\u00fd k\u00f3d dostupn\u00fd bez autentizace.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Zasa\u017een\u00e9 kopie se distribuovaly od <strong>15. \u0159\u00edjna 2026 ve 20:02 UTC do 16. \u0159\u00edjna 2026 v 07:12 UTC<\/strong>, tedy p\u0159ibli\u017en\u011b 11 hodin. V \u010desk\u00e9m letn\u00edm \u010dase jde o interval <strong>15. \u0159\u00edjna ve 22:02 a\u017e 16. \u0159\u00edjna v 09:12 CEST<\/strong>. Rank Math \u0161kodliv\u00e9 bal\u00ed\u010dky odstranil a vydal \u010distou verzi 3.0.124.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Samotn\u00e9 \u010d\u00edslo verze 3.0.123 n\u00e1kazu nedokazuje.<\/strong> Rozhoduje, zda jsi z\u00edskal n\u011bkter\u00fd ze zasa\u017een\u00fdch bal\u00ed\u010dk\u016f v uveden\u00e9m intervalu. Rank Math eviduje \u00fa\u010dty, kter\u00e9 tyto kopie st\u00e1hly, a jejich majitele upozor\u0148uje; pokud ti ozn\u00e1men\u00ed p\u0159i\u0161lo, \u0159e\u0161 odpov\u00eddaj\u00edc\u00ed postup i tehdy, kdy\u017e u\u017e web pou\u017e\u00edv\u00e1 jinou verzi.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Incident se t\u00fdk\u00e1 placen\u00e9ho dopl\u0148ku <strong>Rank Math PRO<\/strong>, jeho\u017e identifik\u00e1tor je <code>seo-by-rank-math-pro<\/code>. Bezplatn\u00fd plugin Rank Math ozn\u00e1men\u00ed mezi zasa\u017een\u00fdmi produkty neuv\u00e1d\u00ed. Zp\u016fsob, jak\u00fdm \u00fato\u010dn\u00edk bal\u00ed\u010dky pozm\u011bnil, Rank Math nezve\u0159ejnil.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Nejd\u0159\u00edv rozli\u0161 t\u0159i situace<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">V administraci WordPressu otev\u0159i <strong>Pluginy<\/strong> a ov\u011b\u0159 nainstalovanou verzi Rank Math PRO. Potom zjisti, kdy jsi instala\u010dn\u00ed bal\u00ed\u010dek z\u00edskal a jestli se plugin aktivoval. Pro bal\u00ed\u010dek ze zasa\u017een\u00e9ho intervalu plat\u00ed tyto t\u0159i postupy:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>Verzi 3.0.123 jsi nainstaloval a aktivoval:<\/strong> pova\u017euj web za kompromitovan\u00fd a pokra\u010duj obnovou ze z\u00e1lohy nebo ru\u010dn\u00edm \u010di\u0161t\u011bn\u00edm.<\/li>\n\n\n<li><strong>Verzi 3.0.123 jsi nainstaloval, ale nikdy neaktivoval:<\/strong> sma\u017e soubory zasa\u017een\u00e9ho pluginu, ze sv\u00e9ho \u00fa\u010dtu Rank Math st\u00e1hni \u010distou verzi 3.0.124 a nainstaluj ji. Preventivn\u011b spus\u0165 bezpe\u010dnostn\u00ed kontrolu.<\/li>\n\n\n<li><strong>Verzi 3.0.123 jsi pouze st\u00e1hl, ale nenainstaloval ani neaktivoval:<\/strong> samotn\u00fd tento incident neukazuje na kompromitaci webu. Pokud si nejsi jist\u00fd, zda se soubory na web dostaly nebo zda se plugin aktivoval, obra\u0165 se na podporu.<\/li>\n\n<\/ol>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Aktualizace nen\u00ed tot\u00e9\u017e co vy\u010di\u0161t\u011bn\u00ed<\/h4>\n\n\n<p class=\"wp-block-paragraph\">Verze 3.0.124 nahrad\u00ed soubory Rank Math PRO. Neodstran\u00ed ale soubory mimo plugin, ciz\u00ed administr\u00e1torsk\u00e9 \u00fa\u010dty ani cronov\u00e9 \u00falohy, kter\u00e9 u\u017e malware vytvo\u0159il. U aktivovan\u00e9 zasa\u017een\u00e9 kopie proto samotnou aktualizac\u00ed nekon\u010di.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Co mohl malware na webu ud\u011blat<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u0160kodliv\u00fd k\u00f3d se spou\u0161t\u00ed p\u0159i aktivaci pluginu a m\u016f\u017ee \u00fato\u010dn\u00edkovi zajistit trval\u00fd p\u0159\u00edstup. Komunikuje s dom\u00e9nou <code>rank1cdn[.]com<\/code> a p\u0159i n\u00e1v\u0161t\u011bv\u00e1ch webu dok\u00e1\u017ee znovu vytv\u00e1\u0159et skryt\u00e1 zadn\u00ed vr\u00e1tka. Pr\u00e1v\u011b proto p\u0159i ru\u010dn\u00edm \u010di\u0161t\u011bn\u00ed z\u00e1le\u017e\u00ed na po\u0159ad\u00ed krok\u016f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Za potenci\u00e1ln\u011b odhalen\u00e9 pova\u017euj p\u0159\u00edstupov\u00e9 \u00fadaje WordPressu, datab\u00e1ze, API kl\u00ed\u010de i dal\u0161\u00ed tajn\u00e9 \u00fadaje, kter\u00e9 m\u016f\u017ee p\u0159e\u010d\u00edst proces webov\u00e9ho serveru. Obnova soubor\u016f ani n\u00e1vrat datab\u00e1ze ze z\u00e1lohy tyto \u00fadaje nezm\u011bn\u00ed. Mus\u00ed\u0161 je vym\u011bnit samostatn\u011b.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Varianta A: obnov web z \u010dist\u00e9 z\u00e1lohy<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Nejvhodn\u011bj\u0161\u00ed cesta vede p\u0159es z\u00e1lohu soubor\u016f i datab\u00e1ze z doby p\u0159ed za\u010d\u00e1tkem incidentu. Hledej z\u00e1lohu star\u0161\u00ed ne\u017e <strong>15. \u0159\u00edjna 2026 ve 22:02 CEST<\/strong>, tedy 20:02 UTC. Stejn\u00fd okam\u017eik odpov\u00edd\u00e1 15. \u0159\u00edjnu v 16:02 EDT a 16. \u0159\u00edjnu v 01:32 IST.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>Obnov soubory webu i datab\u00e1zi<\/strong> ze z\u00e1lohy, kter\u00e1 vznikla p\u0159ed uveden\u00fdm \u010dasem.<\/li>\n\n\n<li><strong>Spus\u0165 bezpe\u010dnostn\u00ed kontrolu<\/strong> d\u016fv\u011bryhodn\u00fdm n\u00e1strojem, nap\u0159\u00edklad <a href=\"https:\/\/wordpress.org\/plugins\/wordfence\/\">Wordfence<\/a> nebo <a href=\"https:\/\/wordpress.org\/plugins\/sucuri-scanner\/\">Sucuri<\/a>.<\/li>\n\n\n<li><strong>Vym\u011b\u0148 v\u0161echna hesla a dal\u0161\u00ed p\u0159\u00edstupov\u00e9 \u00fadaje.<\/strong> Po\u010d\u00edtej s t\u00edm, \u017ee tajn\u00e9 \u00fadaje dostupn\u00e9 napaden\u00e9mu webu mohly uniknout. Konkr\u00e9tn\u00ed seznam najde\u0161 n\u00ed\u017ee.<\/li>\n\n\n<li><strong>Nainstaluj \u010dist\u00fd Rank Math PRO 3.0.124<\/strong>, kter\u00fd st\u00e1hne\u0161 ze sv\u00e9ho \u00fa\u010dtu Rank Math.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Pokud si s obnovou z\u00e1lohy nejsi jist\u00fd, po\u017e\u00e1dej o pomoc hosting. Ani po n\u00e1vratu k \u010dist\u00e9 z\u00e1loze nevynech\u00e1vej v\u00fdm\u011bnu p\u0159\u00edstupov\u00fdch \u00fadaj\u016f a n\u00e1sledn\u00e9 kontroly webu.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Varianta B: vy\u010disti web ru\u010dn\u011b v p\u0159esn\u00e9m po\u0159ad\u00ed<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Bez pou\u017eiteln\u00e9 \u010dist\u00e9 z\u00e1lohy mus\u00ed\u0161 odstranit malware a dohledat dal\u0161\u00ed zm\u011bny, kter\u00e9 \u00fato\u010dn\u00edk provedl. Nejd\u0159\u00edv zastav mechanismus, kter\u00fd zadn\u00ed vr\u00e1tka obnovuje, a teprve potom ma\u017e jeho dal\u0161\u00ed soubory. Jinak je m\u016f\u017ee p\u0159\u00ed\u0161t\u00ed n\u00e1v\u0161t\u011bva webu vytvo\u0159it znovu.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Kdy p\u0159izvat pomoc<\/h4>\n\n\n<p class=\"wp-block-paragraph\">Pokud b\u011b\u017en\u011b nepracuje\u0161 se soubory webu, datab\u00e1z\u00ed a nastaven\u00edm serveru, sv\u011b\u0159 ru\u010dn\u00ed \u010di\u0161t\u011bn\u00ed hostingu nebo bezpe\u010dnostn\u00edmu specialistovi. \u00dato\u010dn\u00edkovy zm\u011bny nemus\u00ed kon\u010dit v adres\u00e1\u0159i WordPressu.<\/p>\n\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">1. Zastav obnovov\u00e1n\u00ed \u0161kodliv\u00e9ho k\u00f3du<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ne\u017e za\u010dne\u0161 hledat dal\u0161\u00ed zadn\u00ed vr\u00e1tka, dokon\u010di v\u0161echny n\u00e1sleduj\u00edc\u00ed kroky. Pouh\u00e1 deaktivace Rank Math PRO nesta\u010d\u00ed.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>Sma\u017e celou slo\u017eku pluginu <code>rank-math-pro<\/code>.<\/strong> Pou\u017eij spr\u00e1vce soubor\u016f hostingu nebo FTP.<\/li>\n\n\n<li><strong>Odstra\u0148 \u0161kodliv\u00e9 z\u00e1znamy z datab\u00e1ze.<\/strong> Nap\u0159\u00edklad v phpMyAdmin otev\u0159i tabulku <code>wp_options<\/code> a sma\u017e nalezen\u00e9 \u0159\u00e1dky, jejich\u017e <code>option_name<\/code> odpov\u00edd\u00e1 hodnot\u00e1m <code>_uf6qdn2hmm<\/code>, <code>t8krdk990phb<\/code> nebo <code>_np5pvf754c<\/code>. Pokud instalace pou\u017e\u00edv\u00e1 jin\u00fd prefix tabulek, pracuj s jej\u00ed odpov\u00eddaj\u00edc\u00ed tabulkou options.<\/li>\n\n\n<li><strong>Pokud to hosting nebo firewall umo\u017e\u0148uje, zablokuj odchoz\u00ed spojen\u00ed na <code>rank1cdn.com<\/code>.<\/strong><\/li>\n\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">2. Najdi dal\u0161\u00ed soubory, \u00fa\u010dty a zm\u011bny na serveru<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u00dato\u010dn\u00edk mohl zanechat v\u00edce nez\u00e1visl\u00fdch cest zp\u011bt. Projdi proto v\u0161echny n\u00e1sleduj\u00edc\u00ed oblasti, i kdy\u017e u\u017e jsi jeden \u0161kodliv\u00fd soubor na\u0161el a odstranil.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Skryt\u00e1 zadn\u00ed vr\u00e1tka v PHP<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Podez\u0159el\u00e9 PHP soubory hledej zejm\u00e9na na n\u00e1sleduj\u00edc\u00edch m\u00edstech. S prohled\u00e1n\u00edm a odstran\u011bn\u00edm \u0161kodliv\u00fdch soubor\u016f ti m\u016f\u017ee pomoci bezpe\u010dnostn\u00ed plugin nebo hosting.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><code>wp-content\/mu-plugins\/<\/code><\/li>\n\n\n<li>Adres\u00e1\u0159e ostatn\u00edch plugin\u016f.<\/li>\n\n\n<li>Adres\u00e1\u0159e <code>inc\/<\/code>, <code>includes\/<\/code> a <code>lib\/<\/code> u \u0161ablon, kter\u00e9 nepat\u0159\u00ed mezi v\u00fdchoz\u00ed \u0161ablony WordPressu.<\/li>\n\n\n<li>Adres\u00e1\u0159 <code>includes\/<\/code> pluginu Rank Math.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">V k\u00f3du hledej <code>base64_decode<\/code> v kombinaci se smy\u010dkami XOR, kl\u00ed\u010d <code>xmmqhn<\/code>, vol\u00e1n\u00ed <code>proc_open<\/code> a k\u00f3d pracuj\u00edc\u00ed se sockety PHP-FPM. Jde o stopy, kter\u00e9 je pot\u0159eba posoudit v kontextu konkr\u00e9tn\u00edho souboru, ne o d\u016fvod bez kontroly smazat ka\u017ed\u00fd v\u00fdskyt t\u011bchto funkc\u00ed.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Nezn\u00e1m\u00ed administr\u00e1to\u0159i<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Prohl\u00e9dni v\u0161echny \u00fa\u010dty s rol\u00ed administr\u00e1tora. Zam\u011b\u0159 se na nezn\u00e1m\u00e1 jm\u00e9na za\u010d\u00ednaj\u00edc\u00ed <code>wpsupport_<\/code> s n\u00e1hodn\u00fdmi znaky za podtr\u017e\u00edtkem a na adresy kon\u010d\u00edc\u00ed <code>@wp-mail[.]net<\/code>. \u00da\u010dty, u kter\u00fdch potvrd\u00ed\u0161 \u0161kodliv\u00fd nebo neopr\u00e1vn\u011bn\u00fd p\u016fvod, odstra\u0148.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>wp user list --role=administrator --fields=ID,user_login,user_email,user_registered\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> user<\/span><span style=\"color:#9ECBFF\"> list<\/span><span style=\"color:#79B8FF\"> --role=administrator<\/span><span style=\"color:#79B8FF\"> --fields=ID,user_login,user_email,user_registered<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h4 class=\"wp-block-heading\">Podvr\u017een\u00fd soubor WordPress core<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Soubor <code>wp-includes\/class-wp-cache-util.php<\/code> <strong>nen\u00ed legitimn\u00ed sou\u010d\u00e1st WordPress core<\/strong>. Pokud existuje, odstra\u0148 ho a ov\u011b\u0159 kontroln\u00ed sou\u010dty core. Potom p\u0159einstaluj soubory WordPress core z ofici\u00e1ln\u00edho zdroje, aby na webu nez\u016fstaly jin\u00e9 pozm\u011bn\u011bn\u00e9 soubory.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>wp core verify-checksums\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> core<\/span><span style=\"color:#9ECBFF\"> verify-checksums<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h4 class=\"wp-block-heading\">Pravidla .htaccess a soubory .cache<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Zkontroluj <code>.htaccess<\/code> v ko\u0159enov\u00e9m adres\u00e1\u0159i webu i v podadres\u00e1\u0159\u00edch. Hledej pravidla, kter\u00e1 dovoluj\u00ed spou\u0161t\u011bt soubory <code>.cache<\/code> jako PHP. Na serveru z\u00e1rove\u0148 vyhledej soubory <code>.cache<\/code> s PHP k\u00f3dem a podez\u0159el\u00e9 n\u00e1lezy prozkoumej.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Syst\u00e9mov\u00fd cron a ud\u00e1losti WordPressu<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">V syst\u00e9mov\u00e9m crontabu u\u017eivatele, pod kter\u00fdm b\u011b\u017e\u00ed webov\u00fd server, hledej \u00falohy ozna\u010den\u00e9 <code>#ms6v46<\/code>. Samostatn\u011b projdi ud\u00e1losti napl\u00e1novan\u00e9 ve WordPressu. \u0160kodliv\u00e9 \u00falohy po ov\u011b\u0159en\u00ed odstra\u0148.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>wp cron event list\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> cron<\/span><span style=\"color:#9ECBFF\"> event<\/span><span style=\"color:#9ECBFF\"> list<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h4 class=\"wp-block-heading\">Ostatn\u00ed pluginy, \u0161ablony a nahran\u00e9 soubory<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>P\u0159einstaluj pluginy a \u0161ablony z jejich ofici\u00e1ln\u00edch zdroj\u016f. Kde to jde, porovnej st\u00e1vaj\u00edc\u00ed soubory s \u010dist\u00fdmi kopiemi.<\/li>\n\n\n<li>V adres\u00e1\u0159i <code>uploads\/<\/code> hledej PHP soubory, kter\u00e9 tam zpravidla nemaj\u00ed co d\u011blat.<\/li>\n\n\n<li>Ne\u010dekan\u00e9 nebo pozm\u011bn\u011bn\u00e9 soubory nejd\u0159\u00edv prozkoumej a a\u017e potom rozhodni o jejich odstran\u011bn\u00ed.<\/li>\n\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Prost\u0159ed\u00ed mimo adres\u00e1\u0159 webu<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Kontrola samotn\u00e9ho WordPressu nemus\u00ed odhalit v\u0161echny zm\u011bny. Prov\u011b\u0159 i n\u00e1sleduj\u00edc\u00ed \u010d\u00e1sti serveru; na sd\u00edlen\u00e9m hostingu po\u017e\u00e1dej poskytovatele, aby zkontroloval oblasti, ke kter\u00fdm nem\u00e1\u0161 p\u0159\u00edstup.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Soubory SSH <code>authorized_keys<\/code>.<\/li>\n\n\n<li>Crontaby ostatn\u00edch syst\u00e9mov\u00fdch u\u017eivatel\u016f.<\/li>\n\n\n<li>B\u011b\u017e\u00edc\u00ed procesy.<\/li>\n\n\n<li>M\u00edsta mimo adres\u00e1\u0159 webu, do kter\u00fdch m\u016f\u017ee zapisovat u\u017eivatel webov\u00e9ho serveru.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">P\u0159ehled indik\u00e1tor\u016f a rychl\u00e1 kontrola p\u0159es WP-CLI<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Indik\u00e1tory kompromitace jsou konkr\u00e9tn\u00ed stopy, podle kter\u00fdch m\u016f\u017ee\u0161 dohledat aktivitu malwaru. N\u00e1sleduj\u00edc\u00ed p\u0159ehled se hod\u00ed p\u0159i kontrole v\u00edce web\u016f, nenahrazuje ale cel\u00fd postup obnovy a \u010di\u0161t\u011bn\u00ed.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Komunikace:<\/strong> dom\u00e9na <code>rank1cdn[.]com<\/code>.<\/li>\n\n\n<li><strong>Datab\u00e1ze:<\/strong> hodnoty <code>option_name<\/code> <code>_uf6qdn2hmm<\/code>, <code>t8krdk990phb<\/code> a <code>_np5pvf754c<\/code>.<\/li>\n\n\n<li><strong>PHP k\u00f3d:<\/strong> kl\u00ed\u010d <code>xmmqhn<\/code>, <code>base64_decode<\/code> spole\u010dn\u011b se smy\u010dkami XOR, <code>proc_open<\/code> a k\u00f3d pro sockety PHP-FPM.<\/li>\n\n\n<li><strong>\u00da\u010dty:<\/strong> p\u0159ihla\u0161ovac\u00ed jm\u00e9na <code>wpsupport_\u2026<\/code> a e-maily na dom\u00e9n\u011b <code>wp-mail[.]net<\/code>.<\/li>\n\n\n<li><strong>Podvr\u017een\u00fd soubor:<\/strong> <code>wp-includes\/class-wp-cache-util.php<\/code>.<\/li>\n\n\n<li><strong>Cron:<\/strong> zna\u010dka <code>#ms6v46<\/code> v syst\u00e9mov\u00e9m crontabu.<\/li>\n\n\n<li><strong>Pravidla a soubory:<\/strong> <code>.htaccess<\/code> dovoluj\u00edc\u00ed spou\u0161t\u011bt <code>.cache<\/code> jako PHP a soubory <code>.cache<\/code> obsahuj\u00edc\u00ed PHP.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Pro rychlou orientaci m\u016f\u017ee\u0161 pou\u017e\u00edt WP-CLI, tedy n\u00e1stroj pro spr\u00e1vu WordPressu z p\u0159\u00edkazov\u00e9 \u0159\u00e1dky, a n\u011bkolik shellov\u00fdch p\u0159\u00edkaz\u016f. Uk\u00e1zka nic nema\u017ee a netvo\u0159\u00ed automatick\u00fd \u010distic\u00ed skript. U syst\u00e9mov\u00e9ho cronu nahra\u010f <code>www-data<\/code>, pokud webov\u00fd server b\u011b\u017e\u00ed pod jin\u00fdm u\u017eivatelem; kontrola ciz\u00edho crontabu m\u016f\u017ee vy\u017eadovat vy\u0161\u0161\u00ed opr\u00e1vn\u011bn\u00ed.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly># Nainstalovan\u00e1 verze PRO dopl\u0148ku.\nwp plugin get seo-by-rank-math-pro --field=version\n\n# Zn\u00e1m\u00e9 \u0161kodliv\u00e9 polo\u017eky v options.\nwp option get _uf6qdn2hmm\nwp option get t8krdk990phb\nwp option get _np5pvf754c\n\n# Administr\u00e1to\u0159i a napl\u00e1novan\u00e9 ud\u00e1losti WordPressu.\nwp user list --role=administrator --fields=ID,user_login,user_email,user_registered\nwp cron event list\n\n# Kontrola core a zn\u00e1m\u00e9ho podvr\u017een\u00e9ho souboru.\nwp core verify-checksums\nls -la wp-includes\/class-wp-cache-util.php\n\n# Syst\u00e9mov\u00fd cron: uprav u\u017eivatele podle sv\u00e9ho serveru.\ncrontab -l -u www-data | grep 'ms6v46'\n\n# V\u00fdskyty zn\u00e1m\u00e9ho kl\u00ed\u010de v obsahu webu.\ngrep -RIn -- 'xmmqhn' wp-content\/\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\"># Nainstalovan\u00e1 verze PRO dopl\u0148ku.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> plugin<\/span><span style=\"color:#9ECBFF\"> get<\/span><span style=\"color:#9ECBFF\"> seo-by-rank-math-pro<\/span><span style=\"color:#79B8FF\"> --field=version<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Zn\u00e1m\u00e9 \u0161kodliv\u00e9 polo\u017eky v options.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> option<\/span><span style=\"color:#9ECBFF\"> get<\/span><span style=\"color:#9ECBFF\"> _uf6qdn2hmm<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> option<\/span><span style=\"color:#9ECBFF\"> get<\/span><span style=\"color:#9ECBFF\"> t8krdk990phb<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> option<\/span><span style=\"color:#9ECBFF\"> get<\/span><span style=\"color:#9ECBFF\"> _np5pvf754c<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Administr\u00e1to\u0159i a napl\u00e1novan\u00e9 ud\u00e1losti WordPressu.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> user<\/span><span style=\"color:#9ECBFF\"> list<\/span><span style=\"color:#79B8FF\"> --role=administrator<\/span><span style=\"color:#79B8FF\"> --fields=ID,user_login,user_email,user_registered<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> cron<\/span><span style=\"color:#9ECBFF\"> event<\/span><span style=\"color:#9ECBFF\"> list<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Kontrola core a zn\u00e1m\u00e9ho podvr\u017een\u00e9ho souboru.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> core<\/span><span style=\"color:#9ECBFF\"> verify-checksums<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">ls<\/span><span style=\"color:#79B8FF\"> -la<\/span><span style=\"color:#9ECBFF\"> wp-includes\/class-wp-cache-util.php<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># Syst\u00e9mov\u00fd cron: uprav u\u017eivatele podle sv\u00e9ho serveru.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">crontab<\/span><span style=\"color:#79B8FF\"> -l<\/span><span style=\"color:#79B8FF\"> -u<\/span><span style=\"color:#9ECBFF\"> www-data<\/span><span style=\"color:#F97583\"> |<\/span><span style=\"color:#B392F0\"> grep<\/span><span style=\"color:#9ECBFF\"> 'ms6v46'<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\"># V\u00fdskyty zn\u00e1m\u00e9ho kl\u00ed\u010de v obsahu webu.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">grep<\/span><span style=\"color:#79B8FF\"> -RIn<\/span><span style=\"color:#79B8FF\"> --<\/span><span style=\"color:#9ECBFF\"> 'xmmqhn'<\/span><span style=\"color:#9ECBFF\"> wp-content\/<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<div class=\"wp-block-group callout callout-info is-style-info is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">\u010cist\u00fd v\u00fdsledek jednoho testu nesta\u010d\u00ed<\/h4>\n\n\n<p class=\"wp-block-paragraph\">Chyb\u011bj\u00edc\u00ed polo\u017eka v options nebo nenalezen\u00fd \u0159et\u011bzec neov\u011b\u0159\u00ed cel\u00fd web. Stejn\u011b tak \u00fasp\u011b\u0161n\u00e1 kontrola WordPress core neprov\u011b\u0159\u00ed datab\u00e1zi, administr\u00e1torsk\u00e9 \u00fa\u010dty, v\u0161echny pluginy ani syst\u00e9mov\u00fd cron.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">3. Vym\u011b\u0148 hesla, kl\u00ed\u010de a dal\u0161\u00ed p\u0159\u00edstupov\u00e9 \u00fadaje<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Po odstran\u011bn\u00ed \u0161kodliv\u00e9ho k\u00f3du nahra\u010f tajn\u00e9 \u00fadaje nov\u00fdmi bezpe\u010dn\u00fdmi hodnotami. Tento krok je nezbytn\u00fd <strong>i p\u0159i obnov\u011b z \u010dist\u00e9 z\u00e1lohy<\/strong>. Vych\u00e1zej z p\u0159edpokladu, \u017ee \u00fato\u010dn\u00edk mohl p\u0159e\u010d\u00edst v\u0161e, co bylo dostupn\u00e9 kompromitovan\u00e9mu webu.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>V\u0161echna relevantn\u00ed hesla:<\/strong> zm\u011b\u0148 hesla \u00fa\u010dt\u016f WordPressu a dal\u0161\u00ed p\u0159\u00edstupov\u00e9 \u00fadaje, ke kter\u00fdm m\u011bl napaden\u00fd web p\u0159\u00edstup.<\/li>\n\n\n<li><strong>Datab\u00e1ze:<\/strong> zm\u011b\u0148 datab\u00e1zov\u00e9 u\u017eivatelsk\u00e9 jm\u00e9no i heslo a uprav odpov\u00eddaj\u00edc\u00ed hodnoty v <code>wp-config.php<\/code>.<\/li>\n\n\n<li><strong>Bezpe\u010dnostn\u00ed kl\u00ed\u010de a soli WordPressu:<\/strong> vygeneruj nov\u00e9 hodnoty kl\u00ed\u010d\u016f a sol\u00ed v <code>wp-config.php<\/code>.<\/li>\n\n\n<li><strong>API a p\u0159ipojen\u00e9 slu\u017eby:<\/strong> nahra\u010f kl\u00ed\u010de platebn\u00edch bran, p\u0159\u00edstupov\u00e9 \u00fadaje SMTP, API kl\u00ed\u010de a dal\u0161\u00ed tajn\u00e9 \u00fadaje ulo\u017een\u00e9 v nastaven\u00ed webu nebo konfigura\u010dn\u00edch souborech.<\/li>\n\n\n<li><strong>Hosting a server:<\/strong> zm\u011b\u0148 p\u0159\u00edstupy do ovl\u00e1dac\u00edho panelu hostingu, FTP\/SFTP a SSH. Prov\u011b\u0159 tak\u00e9 tajn\u00e9 \u00fadaje v prom\u011bnn\u00fdch prost\u0159ed\u00ed.<\/li>\n\n\n<li><strong>Dvoufaktorov\u00e9 ov\u011b\u0159ov\u00e1n\u00ed:<\/strong> zkontroluj nastaven\u00ed administr\u00e1torsk\u00fdch \u00fa\u010dt\u016f a tam, kde je to pot\u0159eba, ho resetuj.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Nov\u00e9 \u00fadaje dopl\u0148 v\u0161ude, kde je web a p\u0159ipojen\u00e9 slu\u017eby pot\u0159ebuj\u00ed. Pokud nedok\u00e1\u017ee\u0161 ur\u010dit cel\u00fd rozsah dostupn\u00fdch tajn\u00fdch \u00fadaj\u016f, projdi ho s hostingem nebo bezpe\u010dnostn\u00edm specialistou.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Ov\u011b\u0159 v\u00fdsledek a sleduj, jestli se n\u00e1kaza nevrac\u00ed<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Po dokon\u010den\u00ed \u010di\u0161t\u011bn\u00ed prov\u011b\u0159 web v\u00edce nez\u00e1visl\u00fdmi kontrolami. D\u016fle\u017eit\u00fd je tak\u00e9 jeho stav b\u011bhem dal\u0161\u00edch dn\u016f, proto\u017ee n\u00e1vrat smazan\u00fdch soubor\u016f m\u016f\u017ee odhalit p\u0159ehl\u00e9dnut\u00fd mechanismus obnovy malwaru.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Spus\u0165 bezpe\u010dnostn\u00ed kontrolu d\u016fv\u011bryhodn\u00fdm n\u00e1strojem, nap\u0159\u00edklad Wordfence nebo Sucuri.<\/li>\n\n\n<li>Ov\u011b\u0159 kontroln\u00ed sou\u010dty soubor\u016f WordPress core p\u0159\u00edkazem <code>wp core verify-checksums<\/code>.<\/li>\n\n\n<li>Ov\u011b\u0159 soubory plugin\u016f p\u0159\u00edkazem <code>wp plugin verify-checksums --all<\/code>. Kontroln\u00ed sou\u010dty nejsou dostupn\u00e9 pro ka\u017ed\u00fd plugin, zejm\u00e9na u placen\u00fdch plugin\u016f. V takov\u00e9m p\u0159\u00edpad\u011b soubory porovnej s \u010distou kopi\u00ed z ofici\u00e1ln\u00edho zdroje.<\/li>\n\n\n<li>V n\u00e1sleduj\u00edc\u00edch dnech sleduj odchoz\u00ed spojen\u00ed a dal\u0161\u00ed podez\u0159elou aktivitu.<\/li>\n\n\n<li>Kontroluj, zda se soubory, kter\u00e9 jsi odstranil, znovu neobjevuj\u00ed.<\/li>\n\n<\/ol>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>wp core verify-checksums\nwp plugin verify-checksums --all\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> core<\/span><span style=\"color:#9ECBFF\"> verify-checksums<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">wp<\/span><span style=\"color:#9ECBFF\"> plugin<\/span><span style=\"color:#9ECBFF\"> verify-checksums<\/span><span style=\"color:#79B8FF\"> --all<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Pokud se podez\u0159el\u00e9 soubory vr\u00e1t\u00ed nebo zaznamen\u00e1\u0161 neobvyklou aktivitu, \u010di\u0161t\u011bn\u00ed nemuselo odstranit v\u0161echny \u00fato\u010dn\u00edkovy zm\u011bny. Vra\u0165 se ke kroku 2 ru\u010dn\u00edho postupu a po\u017e\u00e1dej hosting nebo bezpe\u010dnostn\u00edho specialistu o dal\u0161\u00ed prov\u011b\u0159en\u00ed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u010cist\u00fd plugin st\u00e1hni p\u0159\u00edmo ze sv\u00e9ho \u00fa\u010dtu<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Po p\u0159\u00edslu\u0161n\u00fdch kroc\u00edch obnovy nainstaluj <strong>Rank Math PRO 3.0.124<\/strong>. Do prohl\u00ed\u017ee\u010de zadej p\u0159\u00edmo <code>rankmath.com<\/code>, p\u0159ihlas se ke sv\u00e9mu \u00fa\u010dtu a v sekci se soubory ke sta\u017een\u00ed st\u00e1hni \u010dist\u00fd bal\u00ed\u010dek. N\u011bkte\u0159\u00ed u\u017eivatel\u00e9 mohou p\u0159ed p\u0159ihl\u00e1\u0161en\u00edm pot\u0159ebovat reset hesla k \u00fa\u010dtu.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Pozor na e-maily zneu\u017e\u00edvaj\u00edc\u00ed incident<\/h4>\n\n\n<p class=\"wp-block-paragraph\">Rank Math nepos\u00edl\u00e1 e-mailem odkazy pro p\u0159ihl\u00e1\u0161en\u00ed ani sta\u017een\u00ed pluginu. Nevy\u017e\u00e1dan\u00e9 zpr\u00e1vy, kter\u00e9 t\u011b vyb\u00edzej\u00ed ke kliknut\u00ed na odkaz pro reset hesla nebo sta\u017een\u00ed, pova\u017euj za podez\u0159el\u00e9. Na web v\u00fdrobce p\u0159ejdi p\u0159\u00edmo.<\/p>\n\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Pokud pot\u0159ebuje\u0161 ur\u010dit spr\u00e1vn\u00fd postup nebo prov\u011b\u0159it nejist\u00fd stav webu, otev\u0159i <a href=\"https:\/\/rankmath.com\/support\/\">po\u017eadavek na podporu Rank Math<\/a> nebo napi\u0161 na <code>support@rankmath.com<\/code>. Uve\u010f verzi Rank Math PRO a kroky obnovy, kter\u00e9 u\u017e m\u00e1\u0161 hotov\u00e9.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Co upravit v provozu web\u016f<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">D\u016fv\u011bryhodn\u00fd komer\u010dn\u00ed dodavatel nen\u00ed z\u00e1rukou, \u017ee se \u0161kodliv\u00fd k\u00f3d nikdy nedostane do distribuovan\u00e9ho bal\u00ed\u010dku. U automatick\u00fdch aktualizac\u00ed placen\u00fdch plugin\u016f proto po\u010d\u00edtej s ob\u011bma stranami: rychle doru\u010d\u00ed opravy, ale mohou stejn\u011b rychle nasadit i kompromitovan\u00fd bal\u00ed\u010dek.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Udr\u017euj z\u00e1lohy mimo server webu a dostate\u010dn\u011b dlouhou historii.<\/strong> Pot\u0159ebuje\u0161 se um\u011bt vr\u00e1tit p\u0159ed za\u010d\u00e1tek incidentu, ne jen k posledn\u00ed kopii.<\/li>\n\n\n<li><strong>Sleduj a podle mo\u017enost\u00ed omez odchoz\u00ed spojen\u00ed webov\u00e9ho serveru.<\/strong> Kontrola komunikace dopl\u0148uje kontrolu soubor\u016f.<\/li>\n\n\n<li><strong>Ov\u011b\u0159uj kontroln\u00ed sou\u010dty.<\/strong> U plugin\u016f bez dostupn\u00fdch sou\u010dt\u016f porovn\u00e1vej soubory s \u010dist\u00fdmi bal\u00ed\u010dky od v\u00fdrobce.<\/li>\n\n\n<li><strong>Prov\u011b\u0159 nastaven\u00ed automatick\u00fdch aktualizac\u00ed placen\u00fdch plugin\u016f<\/strong> s ohledem na z\u00e1lohy a mo\u017enosti n\u00e1sledn\u00e9 kontroly webu.<\/li>\n\n\n<li><strong>Nestahuj n\u00e1hradu z neofici\u00e1ln\u00edch web\u016f ani z web\u016f p\u0159eprod\u00e1vaj\u00edc\u00edch GPL bal\u00ed\u010dky.<\/strong> Mohou d\u00e1l nab\u00edzet kopie verze 3.0.123; \u010dist\u00fd plugin z\u00edskej ze sv\u00e9ho \u00fa\u010dtu u v\u00fdrobce.<\/li>\n\n\n<li><strong>P\u0159i \u0159e\u0161en\u00ed incidentu neklikej automaticky na odkazy v e-mailech.<\/strong> P\u0159ihl\u00e1\u0161en\u00ed a sta\u017een\u00ed \u0159e\u0161 p\u0159\u00edmou n\u00e1v\u0161t\u011bvou webu v\u00fdrobce.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Te\u010f ov\u011b\u0159 \u010das, kdy jsi bal\u00ed\u010dek z\u00edskal, a zda se na webu aktivoval. Pokud ano, zvol \u010distou z\u00e1lohu nebo dodr\u017e po\u0159ad\u00ed ru\u010dn\u00edho \u010di\u0161t\u011bn\u00ed, vym\u011b\u0148 p\u0159\u00edstupov\u00e9 \u00fadaje a n\u011bkolik dal\u0161\u00edch dn\u016f kontroluj, jestli se \u0161kodliv\u00e9 soubory nebo komunikace nevracej\u00ed.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>Reference \/ Zdroje<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/rankmath.com\/kb\/pro-3-0-123-security-incident\/\" target=\"_blank\" rel=\"noopener noreferrer\">Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/10\/rank-math-seo-pro-3-0-123-malware\/\" target=\"_blank\" rel=\"noopener noreferrer\">Rank Math SEO PRO 3.0.123 supply chain attack: malware in official update packages<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/81cd7a2c-ad0c-4dbc-b5dc-07ec866d5c1f\" target=\"_blank\" rel=\"noopener noreferrer\">Rank Math SEO PRO 3.0.123 &#8211; Unauthenticated Embedded Malicious Code<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>\u010c\u00e1st ofici\u00e1ln\u00edch bal\u00ed\u010dk\u016f Rank Math PRO 3.0.123 obsahovala malware. Samotn\u00e1 aktualizace nesta\u010d\u00ed: rozhoduje, kdy jsi bal\u00ed\u010dek z\u00edskal a jestli se plugin na webu aktivoval.<\/p>\n","protected":false},"author":34,"featured_media":237,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[57,145,126,10,8],"class_list":["post-238","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bezpecnost","tag-malware","tag-rank-math","tag-supply-chain","tag-wordpress","tag-wp-cli"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/posts\/238","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/users\/34"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/comments?post=238"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/posts\/238\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/media\/237"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/media?parent=238"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/categories?post=238"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/tags?post=238"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}