5 sites hacked this week

  • Resolved asaracena

    (@asaracena)


    10 years, 2 months ago

    Let me first say that I love your plugin and have found it so useful that I use it on all my sites. I’m considering updating to the paid version on my commercial sites because it would be a disaster if they were hacked.

    However in the last three days 5 of our sites have been hacked – core WordPress files were changed and extraneous files with malicious eval code were added.

    Wordfence notified me about these attacks but apparently wasn’t able to stop them on our sites. I’ve been diligent about updating WordPress and your Wordfence plugin. This is the latest hack on verdigrisfurniture.com (happened about 18 hours ago:
    * WordPress core file modified: wp-comments-post.php
    * This file may contain malicious executable code: /home/content/u/r/a/uransoftware/html/verdigrisfurniture.com/wp-comments-post.php
    * This file may contain malicious executable code: /home/content/u/r/a/uransoftware/html/verdigrisfurniture.com/wp-content/blog.php
    * This file may contain malicious executable code: /home/content/u/r/a/uransoftware/html/verdigrisfurniture.com/wp-content/defines.php
    * This file may contain malicious executable code: /home/content/u/r/a/uransoftware/html/verdigrisfurniture.com/wp-content/themes/help.php
    * This file may contain malicious executable code: /home/content/u/r/a/uransoftware/html/verdigrisfurniture.com/wp-content/themes/template.php
    * This file may contain malicious executable code: /home/content/u/r/a/uransoftware/html/verdigrisfurniture.com/wp-content/uploads/gallery.php

    All the sites have been cleaned by re-installing WordPress 4.0 either through the admin panel or very carefully file by file in FTP replacing WP core files with originals. I deleted files that don’t exist in 4.0.

    I always only set up an FTP user for a single site and delete it after I’ve finished. I also updated the WordFence plugin to the most recent version 5.2.5. I’m wondering if there is anything else I should be doing to avoid this in the future to avoid these annoying attacks.

    Thanks!
    alison

    https://www.ads-software.com/plugins/wordfence/

Viewing 4 replies - 1 through 4 (of 4 total)

  • Some excellent advice can be found here: https://codex.www.ads-software.com/Hardening_WordPress and here: https://moz.com/blog/the-definitive-guide-to-wordpress-security
    Also, try running this antivirus/malware plugin: https://www.ads-software.com/plugins/gotmls/

    Good luck!

    Thanks Barnez. Excellent advice.

    @alison It sounds like you are being really diligent in your efforts. That’s a really good thing. The best thing to do when you find files that are changed, etc is to use the option to repair the file which does, in essence, what you said you were doing in your original post.

    Ultimately, to paraphrase a billion and half memes, hackers are gonna hack and most will go for the easiest and most popular targets. Protecting yourself makes it easier for them to just move on.

    Hope this helps.

    tim

    Thread Starter asaracena

    (@asaracena)

    Thanks to both of you. Barnez, I did take a look at the hardening link before I posted this. I’ll look at the other links also.

    Tim – I actually do use the option to repair or delete the file within WordFence but two of the sites were hacked so badly I couldn’t get into the WordPress admin panel so I had to use more drastic measures to repair/delete the changed files.

    All of our sites but one is hosted on godaddy and I wondered if there that’s where the vulnerability was. Just seemed strange to have 5 sites hacked within two days. We had issues before (a guy we work with in India who is not so diligent about keeping his computer clean and updated) but since that time we are really careful about securing our sites.

    At least with WordFence we find out about these breaches and are able to fix them. So thanks for a good product!

    alison

    Thanks for using it ?? We appreciate you.

    tim

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘5 sites hacked this week’ is closed to new replies.