It's Crazy How much WP Websites get Attacked...

[Deleted member 1393709]

Why many WP Hacked? Easy

A thousand of plugins installed and not updated with vulnerabilities. Like security plugins have a lot of vulnerabilities.

Themes that require plugins to personalize etc.
Nulled themes and plugins.

Weak passwords and username obviously.
Permissions chmod 777..

That's the truth.

 

[itz_styx]

I use wordfence.. or wordforce.. something like that.

But even if a hacker gained admin access, what the hell they gonna do? Not like i keep my crypto private keys in my wordpress website files.

Whatever hacker, move along sir, nothing to see here

what someone could do is get shell access and from there root on your server not just wp.
if you dont have anything interesting, well he could use your server to attack other systems which might get you into trouble.

 

[JavascriptPufferfish]

What if you add content every day and your backups are taken maybe once a week?
What if you make $500/day from your site, it would massively suck if you had to loose that $ for a couple of days , or even worse, get your website's search engine rankings fcked up...

there are plugins for automated daily backup. the real problem is, as you say, the rankings getting fucked up. also, if they use your page as platform for scams/spreading more malware, that could royaly fuck up your business. i think a good answer is activating 2AF for your site.

 

[BbHhWwVM]

hack this

9fus8vzy78ef3iz8gfu9a4

FS`23,0943it42T`O**gtkj98/.g423-$@I$R#@KFS7^f3F$(GZ(Fkk

 

[bartosimpsonio]

Clean WP installs rarely get hacked.

It's mostly unpatched themes, plugins and stuff like that. Especially nulled/pirate ones.

 

[syslay288]

If I couldn't hack a target WP Site I used to check every website hosted under same IP and then proceed to check if there's one vulnerable. Then I'll upload a shell and root the web server. Then I'll move to the main target and whoala.. Those good old days.

 

[alexono1]

I use wordfence.. or wordforce.. something like that.

But even if a hacker gained admin access, what the hell they gonna do? Not like i keep my crypto private keys in my wordpress website files.

Whatever hacker, move along sir, nothing to see here

Well, there are lots of things, hackers can do...
- Spread other malware to the websites visitors
- Inserting hacklinks
- Inserting auto generated pages ... if you do lots of casino queries in google, you will find this hack for sure!

 

[Chicken Tikka]

It's normal just check GitHub you will find a bunch of scripts that auto search wp sites and brute force it with the usernameassword you have entered.
In other forums, I've seen people selling hacking WordPress admin panels for 1$ each lol. I suggest changing the admin panel location because mostly automatic scripts only performs bruteforce attack on wp-admin and won't bother finding the location of the admin panel if you have changed to something else

 

[Steptoe]

Just add htpasswd in wp-admin folder and you good to go

I dunno, a lot of themes use admin-ajax.php in the wp-admin folder for frontend things. The user would end up getting a load of login boxes every time some frontend ajax is attempted.

 

[Jeff Vh]

I find it crazy WP is still being used.

 

[Blue Panda]

I dunno, a lot of themes use admin-ajax.php in the wp-admin folder for frontend things. The user would end up getting a load of login boxes every time some frontend ajax is attempted.

Works for me. Even with ajax!

But anyways: WP is just pretty easy to hack. You just look for versions with vulnerabilitys like SQL-Injection, then you may not even need a password.

Thats why the wp-admin folder need to be protected.

Some ppl have a bot to search for dorks like: wordpress 3.x.x

Now also there are a lot of public vulnerabilitys for wp. Just check what is easy to hack and search on google for the version.

 

[Scorpion Ghost]

what someone could do is get shell access and from there root on your server not just wp.
if you dont have anything interesting, well he could use your server to attack other systems which might get you into trouble.

Well, there are lots of things, hackers can do...
- Spread other malware to the websites visitors
- Inserting hacklinks
- Inserting auto generated pages ... if you do lots of casino queries in google, you will find this hack for sure!

Yeah you're right guys. I just do things in unorthodox ways, and it works for me somehow someway

 

[Diplomat]

Wordpress is a weird one for sure. These days we can see from our logs that our waf is blocking around 1.2mil+ Wordpress hacking attempts a day and steadily growing.That’s excluding brute force attacks to wp-login.

If you are using Wordpress, you really need to take care of your websites and keep everything updated and secure. There are huge botnets out there who will find a vulnerability on your site if they want to and you let them.

 

[mishaq]

The same happens in other large cms, Joomla, Drupal, etc.

 

[bendutchman]

The problem is with cPanel. Most providers do not enforce 2FA.
Furthermore, the server software and cPanel is not always updated as often as it should be.

Also, it's all too easy to find the website's host and your admin email.
From there it's pretty simple to gain access.

 

[AmberJones]

jeeez and what are they gonna do when they hacked your site? Did you put gold bars there? haha

 

[Bots-Scrapers]

I do run few medium-sized websites, and I could not believe how many brute force attempts my /wp-admin page gets after installing the plugin that limits brute force attempts and logs login attempts.
Most of my websites get around 400-700 DIFFERENT login tries per day all from different IP's, with each sending multiple password tries, so essentially even with brute force limiting I get around 2000-2500 password tries per day sent

God only knows how many it was before the brute force limiter...Blows my Mind that there are so many people trying to ''hack'' websites.

When installing new wordpress installation, change your username from admin to something else , but not your website name as they try for it quite frequently..
also..Install a plugin that changes the location of your login page to something else..

IT is the themes and plugins.
WordPress is a mature product and mostly the self hosted versions gets hacked. I barely heard the cloud version getting hacked.
IF you do not use extra plugins from unknown source, permission correctly then wp is not going to disappoint you.

 

[crnack]

I find it crazy WP is still being used.

I looked at the database system in wp yesterday. It's so little. Outside of woocommerce it's crap. A client will install tons of plugins thinking he will get something for free.

 

[mishaq]

jeeez and what are they gonna do when they hacked your site? Did you put gold bars there? haha

Good traffic = gold bars

 

[kimomalcolmx]

apart from changing the login URL remember to disable xmlrpc.php because if you dont you still get the brute force login attempts