Wordpress under attack

[elPimps]

Hi all
i need some help, at least what to do and how to start.
1) today i discovered that a client website start generating some spamming content with 301 redirect to spam/porn website
2) there is a bruteforce on wp-login.php and xmlrcp.php (all login failed)
3) at the end the homepage got redirected to a porn website.

Atcually i put the website under mantainance, i backuped the db and downloaded all the files.
We can rollback to 1th january 2020 but i have to understand where was the hole in the system.

 

[SmartPlay]

If it is wordpress then use wordfence plugin to scan the whole website. This plugin will also protect you from brute force attacks.

Wordfence will find any backdoor. You can also scan the files with notepad++ for keywords like exec, shell_exec, base64_decode etc etc

 

[elPimps]

I installed wordfence but it is unable to make any scan or anything else atm...

 

[thizzladen]

Akismet for spam, and theres like 10+ security plugins that can help with the bruteforce, changing wp-login.php url, etc

 

[bartosimpsonio]

I hope you had a backup before it was hacked. You'll need a clean install.

If you got a porn redirect it means they got in.

 

[Compazz]

zip the whole website and upload the zip file to virustotal. you will see everything and all the kind of threats hidden in yoursite.

 

[elPimps]

Is it possible to clean it instead of rollingback?

and... how can this happen?
A bad coded plugin?

 

[lorentzo]

use sucuri meybe?

 

[Jeepy]

Use sucuri virus check - https://sitecheck.sucuri.net/

I give 99% that some plugin was compromised and got hacked. It's happening daily so.

 

[bossofthebosses]

Try to get help from the hosting
If you have budget then can also try sitelock.com - very expensive though

 

[rafark]

Is it possible to clean it instead of rollingback?

and... how can this happen?
A bad coded plugin?

That or the use of pirated themes and plugins.

 

[elPimps]

We never used pirated things since it's an e-commerce...

 

[SmartPlay]

We never used pirated things since it's an e-commerce...

Then there is an exploit in some plugin or theme you are using. Make a list of the plugins you use and post it

 

[MisterF]

We never used pirated things since it's an e-commerce...

It's not Opencart you're using with WP?

 

[Faithustimi]

We never used pirated things since it's an e-commerce...

Use wordfence. Pm if you need it

 

[elPimps]

Eduma as theme (modded by me with a child and updated monthly)

link for plugins

https://imgur.com/Rs6lWxF

 

[SmartPlay]

Eduma as theme (modded by me with a child and updated monthly)

link for plugins

https://imgur.com/Rs6lWxF

WTFFF mannnnn with that number of plugins it would be strange NOT to get hacked. Good GOD my friend what are you doing? From here on I can't really help. You're website is ticking bomb waiting to blow up

 

[elPimps]

I know... i just do what the "man who pay my bills" ask...

 

[SmartPlay]

I know... i just do what the "man who pay my bills" ask...

I am sure half of those plugins can be replaced by one single plugin or theme... you just need to find the combination.

 

[elPimps]

not everything is active atm anyway...
and i fixed a fucking shit that setup the webmaster before me.
He used a huge theme and plugins that weren't supposed to be used for the purpose of this ecommerce...
I asked the "boss" several times to fix this shit... but "no budget"