Wordpress Keeps Getting Hacked!

  • Thread starter Thread starter Deleted member 36594
  • Start date Start date
D

Deleted member 36594

Guest
Hey guys, any suggestion?

I'm hosting one of my blog in some cheap webhost. I notice it was hacked several days ago. Like if you were to visit the link, it redirects to some tutor registration site (www.myeasytutoring.com)
So I wiped out the whole directory (deleted all the files) and just left the images. I did a fresh wordpress installation (the latest wordpress version) and manually post my contents again (just 15 posts, so no biggie). This time, I used the default wordpress theme.

Then just now I noticed it was hacked again. I thought it was my webhost having some vulnerability. So I changed to a new webhost, redirected the name servers, did a fresh wordpress installation.
I re-uploaded the images BUT it is just .jpg files, nothing else. And yes, default wordpress theme again. Plugins are from the wordpress plugins site. All authentic and verified.

It has the limit wordpress plugin installed and such. Less than 30 minutes after setting up, it is hacked once more.

Any ideas or solutions?
 
Advertise on BHW
Also, the password I used is alphanumeric with special characters. How the hell is that possible?
 
Nope. Also, if it was a trojan, my few other blogs should have been hacked too. lol
 
Have you scanned your computer lately? This would be possible if someone had installed a keylogger.
 
Nope, it is not my browser. Very strange...

Yeah, I've had Eset Smart Security installed... it is scheduled to scan everyday. Nothing. So I'm pretty confused now.
I checked the raw visitor log and only found this suspicious entry:

198.46.141.114 /wp-cron.php?doing_wp_cron=*removed*

There were a LOT of other IPs trying to access my wp-login page.
 
Okay, now it's back to normal. WTF?!?

I hope my drink wasn't spiked or something. Very-very weird.
 
Thanks W130SN.

I've banned some of the suspicious IPs. Gonna do a fresh installation with all new details and such. Hope it doesn't happen again.
Strange thing is... I kept receiving the "Brute Force Detected" message and have to wait 30 mins before logging back in now.
And yeap, more strange IPs are going to the wp-login page.

I just don't get it though.. it's just a PR2 old blog with just some stupid content. Nothing of value.

And yeah, doing a full computer scan using online virus scanners just in case. Damn...

Oh well, hope to get it done before the WC match starts. lol

Thanks everyone!


P.S:
Just found an interesting article to increase your wordpress safety.
http://www.inmotionhosting.com/supp...lock-down-wordpress-admin-login-with-htaccess

Assuming your home's or office's IP is static.
 
Last edited by a moderator:
BlackSeng said:
Thanks W130SN.

I've banned some of the suspicious IPs. Gonna do a fresh installation with all new details and such. Hope it doesn't happen again.
Strange thing is... I kept receiving the "Brute Force Detected" message and have to wait 30 mins before logging back in now.
And yeap, more strange IPs are going to the wp-login page.

I just don't get it though.. it's just a PR2 old blog with just some stupid content. Nothing of value.

And yeah, doing a full computer scan using online virus scanners just in case. Damn...

Oh well, hope to get it done before the WC match starts. lol

Thanks everyone!


P.S:
Just found an interesting article to increase your wordpress safety.
http://www.inmotionhosting.com/supp...lock-down-wordpress-admin-login-with-htaccess

Assuming your home's or office's IP is static.
Click to expand...


One of my sites was getting attacked numerous times every day by bots trying to login but when I added the plugins above it stopped almost immediately.
Good Luck and if you have any problems then let me know and I will try to help.
 
Last edited by a moderator:
Buddy if you are in shared host you have to play with htaccess file.because there is method called symlinking.once hacker attack server he can read all config files.even you added strong pws you can't be safe.Most of hackers doing once they hacked servers backdoor the server.so they can get access whenever they need.
 
Which protocol do you use if using FTP?

In cPanel, you can set up a special password for the WP login page (and other sensetive WP files). Also, can transfer files from within cPanel.
 
Last edited:
Even i had the hacking problem. I was seeing casino links in my money site in google cache. I decided to install iThemes security. Another way is to simply put a user pass from cPanel.
 
why not buy a premium plan from wordpress.com it costs $18 per year with 3gb storage to use your own domain and their servers are highly secured
 
Install this plugin
Wordfence Security - Set it to email you when someone logs into your site
Also rename your wp-login.php to wp-login.xxx, so if someone tries to log into your site they won't be able to. When you want to login just rename the file using filezilla. It's what I do, so I told you but it doesn't necessarily mean that it's the best way. :)
There are a lot of other ways to secure your WP installation, but since your site is being modified using the login page, this is the best way to avoid it. :)
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top