How to Keep Wordpress from Getting Hacked?

twoj04

Power Member

Apr 23, 2009

631

373

• Oct 13, 2009

• #1

Hey everyone, Fatal error: Cannot redeclare pbr9() (previously declared in /home/xxxxx/public_html/index.php(1) : eval()'d code:1) in /home/xxxxxx/public_html/wp-config.php(1) : eval()'d code on line 1.


Just got this on a bunch of my sites on the same block. Probably someone who got mad or something.

Anyhow, has anyone gotten this before? I checked my wp-config and sure enough there was a bunch of code at the top. Pretty sure I was hacked, but was posting to see if anyone knew if it was just an error.

Also, how do I prevent this from happening in the future?

Thanks

 

V

VulcanMan750

Junior Member

Nov 21, 2008

105

27

• Oct 13, 2009

• #2

hmmm, this is the second post with the same wordpress error?

can you login in under wp-admin?

I'm no security ninja, but at the very least you should be using htacess and robots.txt to keep google from indexing info about your blog, like what plugins you're using, what theme, what version, etc... all those can be compromised.

 

twoj04

Power Member

Apr 23, 2009

631

373

• Oct 13, 2009

• #3

Hey, sorry didn't find anybody else with the same error. No I couldn't login. Reinstalling WP now.

Will look into the robots.txt and such, never worried about security stuff because had not gotten hacked before.

 

topsytips

Regular Member

Aug 11, 2008

334

235

• Oct 13, 2009

• #4

There's a plugin called Login Lockdown that you might want to consider installing once you get your blog back up and running.

 

V

VulcanMan750

Junior Member

Nov 21, 2008

105

27

• Oct 13, 2009

• #5

Another good idea is a WP database backup plugin. It will email you your database and WP settings on a set schedule so you can reinstall to the last known working version.

Maybe some other BHW WP users can share their security tips and tweaks.

 

twoj04

Power Member

Apr 23, 2009

631

373

• Oct 13, 2009

• #6

Hey everyone, thanks and yea if anyone can share their advice on how to prevent this from happening in the future will be extremely appreciated with +thanks and such

I am going through and finding that it was pretty simple to hack me.

 

S

sxmcdo6

Newbie

Sep 7, 2009

9

13

• Oct 13, 2009

• #7

Are you using secure FTP??? One of my WP domains was getting injected with iframes until i took the time to set it up. From what I can gather File-zilla is notorious for leaking info.

 

twoj04

Power Member

Apr 23, 2009

631

373

• Oct 13, 2009

• #8

Ok updates,

1. Re-installed WP on all domains.
2. Added extra PW security to all WP related files
3. Added robots.txt and beefed up the .htaccess
4. Added 2 security plugins
5. Changed all passwords
6. About to start using SSH or Secure FTP over FileZilla
7. Have WP-DB Backup email me twice a day with backups in case this happens again.

Anything else I can do?

Cheers