My website is hacked, if i bring it offline on my local xampp server, will the malware spread on to my computer?

Question

what I am trying to do here, is bring it down to my computer and then clean it, locally, then I will delete all the online one and do a piece by piece fresh installation of my site.. but I am not sure if the malware can spread on my computer and gain access to my pc. because what I have seen it does is, it is putting index.php file all over the hosting, on each folder there. any help or guidance will be really appreciated. Thanks

More info: my site was infected with Japanese keyword hack and stuff, I tried cleaning the website with wordfence but I failed to fully clean it all, i delete all the suspected files but it is coming back from somewhere, a backdoor I guess, I am not technical so I dont know where to look or clean. the only option that I am left with is to replicate a fresh site.

Answer 1

It sounds like you don't have the knowledge to fully ensure the site won't infect your computer (although its ability to do so is limited, especially if you don't allow external access.) IF your computer does get infected its overwhelmingly probable that this will be limited to the user that runs the web server, and database.

It is right for you not to try unhack the site, and to instead focus on rebuilding it.

Why not set up a virtual machine and run the site in that. When you are done, just zero out the disk. In that way, the worst realistic case is the VM gets compromised - and you just delete it.