Victom of Peristent WrodPress Hacking

[bertbaby]

Over the past month my blogs appears to be under constant assault from some persistent hackers trying get past the wp-login. I have taken the usual precautions such as a security plugin, backups and I have access to the files directly. I can track the IPs and have been blocking some of those but some of these sites are so toxic I have to use my Linux box to check them.

So far they have been unsuccessful but I don't get it. My sites are not ecommerce and are basically brochure sites so what's the goal? Even if they take control I'll simply delete the files and reinstall. I don't get in, anybody have any suggestions?

 

[Duffers5000]

I had the same problem and opened this thread http://www.blackhatworld.com/blackh...-constant-hack-attempts-need-some-advise.html

It got some great replies and its worth a read.

Despite taking onboard the info I still got hacked a week later. Had all my sites secured except one shitty one I had forgot about...they got in through that weak link and took me down.

To answer your question why ? In my case they were able to use my email accounts to spit out 200,000 payday loan offers in a weekend.

 

[bertbaby]

Thanks, I actually followed that thread early on but missed some of the later posts. The hosting company has been useless and the tech I spoke to knew less than me. Would be nice if I had more in depth reporting to spot the abusers but I'll go with my shotgun approach.

My approach has been to block suspect IPs, backup frequently and to limit logins. Obviously, somebody has a script and the ability to shift attacks to other IP addresses so this is not a kiddie attack.

 

[phpbuilt]

You could rename the wp-login.php to something else, then they can't brute force it.

If I saw they were hitting wp-login over and over that's what I'd be doing.

 

[bertbaby]

You could rename the wp-login.php to something else, then they can't brute force it.

If I saw they were hitting wp-login over and over that's what I'd be doing.

Sounds like a good way to lock yourself out of a function. If you rename the file does it impact other WordPress functions?

The other observation I have made looking at the logs is that there appears to be coordinated paired attacks from two different IP addresses in Europe for the most part. The stats are exactly the same and the IPs appear to be a hosting company.

 

[bertbaby]

One other observation when doing a lookup using Who is I have noticed that a number of the IPs are under watch with ProjectHoneypot.org. So that's a good indication they are a hacker site and safe to block.

 

[Standard Toaster]

I didn't realize that many people were trying to bruteforce into my blog before I installed a plugin called WP Better security. It works and works really well to protect your blog.

 

[Paranoid Android]

w rod press? sounds something mechanical

 

[Zak_A]

One of my - pretty useless - micro niche site is in the same situation, someone (probably a bot) have been trying to log in each and every day for almost a year.

I've set a security plugin that lockout the login page for the IP after one failed attempt and made sure my password was something really complicated.
From the logs I can tell it still trying to login every day with a different IP, but has never been successful.

Just make sure your install and password are strong and secure and let them waste their time, don't waste yours

 

[phpbuilt]

Sounds like a good way to lock yourself out of a function. If you rename the file does it impact other WordPress functions?

One of the things many of the security plugins for wordpress does is either rename wp-admin and wp-login.php, or add an additional parameter that the login needs via the .htaccess file.

http://wordpress.org/extend/plugins/wsecure/ (just one example where they rename things).

The biggest concern is you shouldn't go editing core wp files, because when you upgrade it overwrites those core files you changed, reverting back to the original state. Just use a plugin to do it, the plugin will implement the hooks, .htaccess changes, etc. so you can continue upgrading WP.

 

[bertbaby]

I got to be honest with you I hate playing around with the security plugins. I have seen some strange behaviors and more than once got locked out of my own site never mind the hackers, lol. Fortunately, I had backups and was able to restore the updated php files but this is damn scary for any newbie.

 

[Duffers5000]

I was running WPBetter security....But I had it all set up arse ways. I since found out that if I had set it up correctly then they have a one push database prefix changer. I was the same as you scratching my head wondering why I was getting constant ip lockouts from Italy, Spain and Argentina but Presuming I was safe. If they are knocking on your door and you dont have good passwords and security...bastards can just get in eventually.

 

[neteater]

webetter security is able to protect from most of the attacks... one feature that i like it simply disable your site backend for a defined time.. so i disable my site backend when not online..

 

[bertbaby]

webetter security is able to protect from most of the attacks... one feature that i like it simply disable your site backend for a defined time.. so i disable my site backend when not online..

Is the full name webetter security actually Better WP Security?

 

[CherryAffairs]

Sounds really scary. Anybody else using WP better security?

 

[SuaveSalmon]

I am using bulletproof security at the moment. Seems pretty nice.
Wordfence is nice, I dont use it, but you can lock out IP's too, and it tells you everything about the person. I dont use it since it isnt stable. But you can set certain lock out points, 3 failed logins, locks our for how many minutes/hours thing.
Make sure you dont have the main account named admin. If it is, make yourself a new account, promote it to admin, and then lower the admin named account to subscriber level.
Cloudflare may work, but your site will be down a lot if you use the free one.

Also, Yoast says this is very secure hosting, as most cloud hosting is http://websynthesis.com/ a tad pricy though. Just keep daily backups no matter what, and keep the old databases on your computer too. Always helpful

 

[dme17]

I always try to secure my sites using the least number of plugins too because less to worry about updating or adding additional potential vulnerabilities. I have tried the most popular ones sine my very first hands free money making site got hacked and ruined because of the hidden links that were added. Now I just do most things manually but still use one or two (every site is a little different) instead.

If you want a really simple solution why don't you try searching Fiverr for providers who secure Wordpress blogs and message asking them if they use plugins or do things mostly manualy like you'd prefer? Obviously only use someone with lots of positive reviews for this service. Also I'd think it best to use one who doesn't use your site as an example on the sales page. I figure there's got to be some smart alec who would find it funny to take down a "hacker proof" site. Better safe than sorry.