A PHP script that recursively scans all subdirectories of a WordPress installation and removes malicious .htaccess files injected by malware — without touching legitimate ones created by plugins, themes, or server configuration.
Most cleanup scripts delete every .htaccess they find, which risks breaking:
- Backup plugin rules (e.g. UpdraftPlus, BackupBuddy)
- WooCommerce upload folder protection
- Cache plugin configurations