12 of my WP sites down grrr

dbuck

Registered Member

Dec 14, 2011

55

23

• Apr 12, 2013

• #1

12 of my wordpress sites have been hacked causing my host to suspend my account. Lucky for me only one was a money site, But my other sites that they couldnt hack are down because of the suspension. Sucks......Anyone else having problems?

Heres what my host has said....

"Explaining Recent WordPress Service Activity 4/11/2013 5:15pm EST Update:
At this time we are still working to fight against the brute-force attacks on WordPress sites. We want to clarify that this is not an issue exclusive to our hosting platform or even vDeck. The hackers have targeted WordPress sites hosted across a multitude of brands, and we are working alongside other partners in the industry to determine how we can resolve the issues we?re all facing. As we continue to focus all of our energy on the attack, we apologize for any additional delays with our support response-times. We can assure you that our staff is working overtime to eliminate the threat while keeping up with as many support tickets as possible. We take pride in delivering reliable and solid support, so again, we apologize to any and all of our customers who may be affected by this delay. We appreciate your patience and understanding."

 

pokerjk

Senior Member

Dec 26, 2010

1,175

391

• Apr 12, 2013

• #2

Surely they can restore them from a previous date for you?

 

dbuck

Registered Member

Dec 14, 2011

55

23

• Apr 12, 2013
• Thread Starter Thread Starter

• #3

If I had went thru cpanel they could, but I install them myself. I do backup so I'm not to worried. its just the pain and downtime that I hate....Why did these guys want to do a brute force attack on WP sites anyways....

 

Gogol

Administrator

Staff member

Moderator

Executive VIP

Jr. VIP

Sep 10, 2010

11,817

26,660

• Apr 12, 2013

• #4

You must be having a backup, don't you?

@OP
See this: http://www.blackhatworld.com/blackh...news-wordpress-blogs-under-attack-beware.html
It's not only you..

 

dbuck

Registered Member

Dec 14, 2011

55

23

• Apr 12, 2013
• Thread Starter Thread Starter

• #5

Ya I'm backed up, and thanks for the link gOgOl

 

dbuck

Registered Member

Dec 14, 2011

55

23

• Apr 12, 2013
• Thread Starter Thread Starter

• #6

Strange...it was all my sub-folders that got hit. my main sites and sub domains are fine. also 2 of my sites a made by hand were hit but not that bad...

 

bertbaby

Elite Member

Apr 15, 2009

2,025

1,535

• Apr 12, 2013

• #7

One of my hosts, FatCow, told me that all of their WordPress sites are under attack. Last month alone I saw a 100,000 hits on my wp-login file.

To thwart the attacks I added a security plugin WordPress SEO, timed out the number of logins, began blocking IP addresses and renamed my wp-login files. The number of hits has been reduced greatly but the attacks do continue. Oh, yes I did used Backup Buddy.

 

ziplack

Supreme Member

Feb 18, 2010

1,493

879

• Apr 12, 2013

• #8

heres a fix for that
add this to your htaccess file


<Files wp-login.php>
Order Deny,Allow
Deny from all
Allow from 11.11.11.11
</Files>

Please note you need to replace 11.11.11.11 with your IP address so that you can access wp-login.php

 

bertbaby

Elite Member

Apr 15, 2009

2,025

1,535

• Apr 12, 2013

• #9

ziplack said:

heres a fix for that
add this to your htaccess file


<Files wp-login.php>
Order Deny,Allow
Deny from all
Allow from 11.11.11.11
</Files>

Please note you need to replace 11.11.11.11 with your IP address so that you can access wp-login.php

Click to expand...

That assumes you have a static IP address of course as opposed to a dynamic IP.

 

dbuck

Registered Member

Dec 14, 2011

55

23

• Apr 12, 2013
• Thread Starter Thread Starter

• #10

I kinda Thought that is how it works bertbaby...thanks........ Now I've got one sub-subdirectory with a hacked WP install that I am just deleting it cause I dont use it.

Now all the installed files are deleted, but theres one file that remains in the directory and I cant delete it...or the directory. Anyone have an idea why This file wont let me delete it.

 

wpbacklinks

Elite Member

Mar 27, 2010

3,762

1,499

• Apr 12, 2013

• #11

Simple Login Lockdown plugin will also helps.

i use dynamic ip, so its impossible to use htaccess way.

 

BlueZero

Power Member

Jul 6, 2011

506

261

• Apr 12, 2013

• #12

Also myhosting is shutting down WP sites. They are also restricting access to wp-login with htaccess. Seems to be very wide hacking problem.

 

dbuck

Registered Member

Dec 14, 2011

55

23

• Apr 12, 2013
• Thread Starter Thread Starter

• #13

same here blueZero, but its my whole account until I fix the problems on my end.....been at it all day. Sucks...

 

dbuck

Registered Member

Dec 14, 2011

55

23

• Apr 12, 2013
• Thread Starter Thread Starter

• #14

dbuck said:

I kinda Thought that is how it works bertbaby...thanks........ Now I've got one sub-subdirectory with a hacked WP install that I am just deleting it cause I dont use it.

Now all the installed files are deleted, but theres one file that remains in the directory and I cant delete it...or the directory. Anyone have an idea why This file wont let me delete it.

Click to expand...

I should rephrase This...I have a WP installed on a sub-directory that was hacked and cant delete the directory.

 

bertbaby

Elite Member

Apr 15, 2009

2,025

1,535

• Apr 12, 2013

• #15

Can you access the control panel at your host and use their file manager?

 

ziplack

Supreme Member

Feb 18, 2010

1,493

879

• Apr 12, 2013

• #16

bertbaby said:

That assumes you have a static IP address of course as opposed to a dynamic IP.

Click to expand...

i dont have static ip adress but i use a no-ip.org redirection

 

ziplack

Supreme Member

Feb 18, 2010

1,493

879

• Apr 12, 2013

• #17

my current hosting and godaddy its under brute force attack
wordpress and joomla website are targeted
be safe guys

 

bertbaby

Elite Member

Apr 15, 2009

2,025

1,535

• Apr 12, 2013

• #18

ziplack said:

i dont have static ip adress but i use a no-ip.org redirection

Click to expand...

Neat, I have to look into that. Thanks!

 

dbuck

Registered Member

Dec 14, 2011

55

23

• Apr 12, 2013
• Thread Starter Thread Starter

• #19

I can access the control panel bertbaby.....I've tried to delete the dir this way and doesnt work. I have found some new dir on the sever I know I didnt make....I'm looking into that right now.