Wordpress hacked...

Soldato
Joined
26 Feb 2004
Posts
4,731
Location
Hampshire, England.
Hey guys,

A user of our site informed me today that our WordPress home page had been hacked... by "ghost-dz Algeria Attack" if you want to point fingers :mad:

I've renamed the index.php file and I now get the site structure displayed. Is that okay or am I better off leaving the hacked index file alone?

Apart from remaining calm what do I do :-/

Thanks in advance!
 
Were you running the latest version of WordPress and its plugins? If not, that's probably why you were hacked. Change your WordPress password and change all your FTP passwords too.

Showing site structure isn't that bad but personally I'd just password protect the whole site via CPanel until it's sorted (it's safer should the hack have left any files in your server).

If you can't restore from a backup then you should look for any files created when the site was hacked as they may have left a backdoor into your site.
 
Ive just experienced a similar thing, causing google to prompt my website as spam/phishing and erroring a 403. ive emailed my host and within minutes got this response.

It looks like a vulnerability in your site has been exploited, or else somebody has access to your details. Were you running some open source software (such as Wordpress or Joomla)?

Hacks like this are generally caused for one of two reasons.

1. The most common (in 90% of cases) is that your software has a vulnerability. This could be with the software itself (for instance Wordpress) or with a plugin or template. For instance, lots of Wordpress themes use Timthumb, and an older version of this was vulnerable.

Because open source software code is by its nature available to anyone, vulnerabilities are very quickly disseminated throughout the web. If you run an unpatched version, then it can be exploited, and scriptkiddies search for vulnerable targets.

2. The other cause could be that somebody knows your password. This will either be because it was weak and has been brute forced, or else you have a virus on your computer.

I would suggest the following steps:

First, if you can let me know when your site was last working, I can restore from a backup. This will roll your site back to how it was. That shouldn't take longer than a few minutes, but Google / your browser may show a warning for a short while until it updates.

Second, you should then upgrade all your site software. This includes any plugins and themes - and I'd suggest removing anything you do not need.

Third, as a precaution, you should change your control panel password. While it's unlikely the hackers got this, it's best to be safe.

Finally, I'd suggest running Malwarebytes on your computer. This is a good piece of software that scans your own computer for viruses. You can download it at http://www.malwarebytes.org/ as there is a free version available.

If you can let me know when to roll the site back to, I'll do that for you.

Kind Regards,
 
Last edited:
Ive just experienced a similar thing, causing google to prompt my website as spam/phishing and erroring a 403. ive emailed my host and within minutes got this response.

It looks like a vulnerability in your site has been exploited, or else somebody has access to your details. Were you running some open source software (such as Wordpress or Joomla)?

Hacks like this are generally caused for one of two reasons.

1. The most common (in 90% of cases) is that your software has a vulnerability. This could be with the software itself (for instance Wordpress) or with a plugin or template. For instance, lots of Wordpress themes use Timthumb, and an older version of this was vulnerable.

Because open source software code is by its nature available to anyone, vulnerabilities are very quickly disseminated throughout the web. If you run an unpatched version, then it can be exploited, and scriptkiddies search for vulnerable targets.

2. The other cause could be that somebody knows your password. This will either be because it was weak and has been brute forced, or else you have a virus on your computer.

I would suggest the following steps:

First, if you can let me know when your site was last working, I can restore from a backup. This will roll your site back to how it was. That shouldn't take longer than a few minutes, but Google / your browser may show a warning for a short while until it updates.

Second, you should then upgrade all your site software. This includes any plugins and themes - and I'd suggest removing anything you do not need.

Third, as a precaution, you should change your control panel password. While it's unlikely the hackers got this, it's best to be safe.

Finally, I'd suggest running Malwarebytes on your computer. This is a good piece of software that scans your own computer for viruses. You can download it at http://www.malwarebytes.org/ as there is a free version available.

If you can let me know when to roll the site back to, I'll do that for you.

Kind Regards,
Great advice! Exactly what we did :D

We obviously both use the same hosting provider because those instructions are worded exactly the same!

Right, now that we're back to normal, how can I prevent this from happening again? Does Wordpress have any specific security plugins that I could use?

Thanks.
 
Great advice! Exactly what we did :D

We obviously both use the same hosting provider because those instructions are worded exactly the same!

Right, now that we're back to normal, how can I prevent this from happening again? Does Wordpress have any specific security plugins that I could use?

Thanks.

You just got told to stop using unessential plugins and your solution is to use more plugins?

do massively long passwords for cpanel, wordpress admin and sftp, with numbers, letters and symbols.

Install virtualbox, install ubuntu and only access your website from within ubuntu. That's what I do.
 
Back
Top Bottom