A brief becomes a real page.
A hacked site rarely stays clean after the first cleanup. The back door hides in a folder that looks like it belongs there, a scheduled task or a background process puts the files back, and the request that started it all sits somewhere in a log you never open.
EMCP Tools 3.21.0 gives your AI agent the tools to deal with that. They were contributed by @Mrshahidali420, who built them while cleaning up a site that kept getting reinfected (#160). The release also adds binary file writes, a switch that keeps new tools on after updates, OAuth on subdirectory multisites, and fixes from user reports.
Version 3.21.0 is now available. Download the free release, or update Pro through Freemius.
Tools for a hacked site
Five pieces cover the usual steps: find the signs, take the suspicious files out, close the doors, find how the hack came back, and stop whatever keeps rewriting files.
Spot an active compromise. scan-security has a fifth area, compromise. It looks for folders named like their parent that hold their own .htaccess (where the back door in #160 was hiding), PHP files written recently but dated much older, a homepage that shows Googlebot a different page than visitors, backup archives anyone can download, must-use plugins named like regular plugins, and scheduled tasks with re-infection names and no callback. Three malware rules were added too. If the scan runs out of time, it says which checks it only partly covered instead of reporting them clean. Run it alone with checks: ["compromise"].
Quarantine instead of delete. quarantine-file moves a suspicious file or folder out of the site and records its path, size, hash and dates. Stored files are renamed so no web server can run them, and the quarantine folder is closed to the web. list-quarantine shows the entries, and restore-quarantined-file or Undo in History puts one back. Core files, wp-admin, wp-includes and EMCP itself are refused.
Close the usual doors. harden-site switches off XML-RPC, hides the WordPress version from page source and asset links, blocks user enumeration through the REST API and ?author=N (author archives keep working), and hides PHP errors from visitors. Each change can be undone from History, and get-hardening-status checks each one the way a visitor sees the site. Turning XML-RPC off stops Jetpack and the mobile apps, and the tool tells you so.
Find the request behind a hack. search-access-log searches the web server access logs the site can read, plain or .gz, by text, IP, method, status, path and time. It reads only from a fixed list of log folders, removes query strings from results by default, and stops at its time, size and result limits.
Stop a process that keeps rewriting files. On Linux, list-processes shows the processes running as the site’s own user and flags watcher scripts and other suspicious ones, and kill-process stops one after you confirm. Web server, PHP worker and database processes are never stopped, because on shared hosting they also serve the account’s other sites.
The compromise scan, list-quarantine and get-hardening-status are on by default. The tools that change the site, read server logs or list processes ship switched off: turn them on under EMCP Tools → Tools when you need them. See the security tools and filesystem tools docs.
New tools can stay on after updates
Updates add some new tools switched off, such as file, database, plugin and user writes. A new switch on the Tools screen, off by default, lets them arrive switched on instead, so a site you manage gets them without a visit. Tools you turned off stay off, a new install still starts with the safe defaults, and the setting travels with Cloud settings sync. A customer managing many client sites asked for it.
Binary files with write-file
write-file now takes encoding: "base64", so your agent can write images, fonts or ZIP files byte for byte. The content is checked strictly, and anything invalid is refused with nothing written. The 5 MB limit applies to the decoded size; larger files are not supported yet. Contributed by @amiriqbalmcs.
Fixes from your reports
Elementor
- Atomic headings, paragraphs and buttons rendered empty on Elementor 4.3. The tools now write the text format the installed Elementor expects, and any write to a page converts text stored in the wrong format.
- A
styleswrite with onlycolordeleted the variant’s other props. Styles now merge prop by prop, and a prop set tonullis removed. - A write to a page open in your own editor could be thrown away by the editor’s Force Save. Writes are now refused while the page has unsaved changes in the editor, by any user, yours included. If the editor was closed without saving, retry with
ignore_open_editor: true.
Database, files and History
insert-rowreturned the id of its History entry instead of the new row’s. It now returns the row’s id, and an update or delete that matches no rows says so and adds nothing to History.upload-svg-iconis now recorded in History, and undo removes the attachment and its file.
Connections
- OAuth sign-in now works on every subsite of a subdirectory multisite, as long as EMCP is active on the main site. Contributed by @amiriqbalmcs.
- The Connection wizard’s ChatGPT steps follow the app’s new MCP settings, and the Codex terminal command now uses
codex mcp add <name> --url <endpoint>.
Backups and Safe Updates
- Full backups no longer include the root
wp-config.php. Restore never wrote it, so it only put your database password and keys into every backup. - Cloud Safe Updates now checks the database and free disk space the way a restore will need them, saves database snapshots in small checked pieces instead of stopping at 20 MB or 50,000 rows per table, and restores BIT, FLOAT, ENUM and SET columns exactly. WP Rocket and 10Web Booster page caches are cleared before and after an update.
Images
- WebP copies are now encoded from the original upload at their own quality setting, so they come out smaller than the compressed JPEG instead of larger.
- With Serve WebP on the site on, every visitor now gets WebP where a copy exists, instead of the first visitor deciding for everyone through Elementor’s cache.
The official MCP Adapter plugin
The MCP Adapter that connects AI clients to WordPress is now a standalone plugin on WordPress.org. When it is active, EMCP Tools uses it. When it is not, EMCP’s own copy, now updated to 0.7.1, does the job, and it stays in the plugin as a permanent fallback kept up to date with each adapter release. Nothing changes for your site unless you want it to.
The Connection screen offers the official plugin as an option, with one button that installs and activates it. A notice appears only when something needs fixing: no adapter loads, the official plugin is too old, or another plugin’s copy is in use. AI tools can no longer deactivate or delete the MCP Adapter plugin, since that would cut their own connection.
EMCP Lite is on WordPress.org
There is now a second free edition. EMCP Lite is in the WordPress.org plugin directory with 167 tools and updates through WordPress. It leaves out the tools the directory does not accept: code execution, files, SQL, WP-CLI, plugin and theme installs, and user and settings writes. The free edition on GitHub keeps every free tool, all 233 of them. The download page compares the two.
Read the full changelog for every change in 3.21.0.