A member messaged me how to protect themselves from such hacks.. I think the reply would benefit anyone reading the thread, so, here it's.
========================
As a matter of fact I am prefessional ethical hacker myself.. so it was okay.
The good news, its really simple to prevent hacking damage.
There are two main ways to get hacked other than skids bruteforce and these basic stuffs.
1 - you upload nulled plugin which contains edited code of the plugin which gives the plugin provider control over the website
2 - Someone finds an exploit in the original code of thw plugin. Unfortunately, for really famous plugins its likely intentional.
The first reason, its really easy to prevent. Download plugin even nulled ones from good resources. Like famous forums where the cracker is a forum member. Or famous websites where the owner is reputable.
In forums they earn money from memberships and for reputable websites, they earn from ads.
As for second reason, you can't prevent the hack because like I said, its reputable plugin.. elementor, or slider revolution for example.
The easiest way to overcome Any hacking no matter what, is to have regular daily backup for the last 7 days at least. So, if you are hacked, just restore the older backup and you are done (Y). Simple and easy.
If you have really sensitive website, subscribe to sucuri, their firewall and file channges monitoring is really powerful.
Another simple method would be don't set auto update for plugins, and check sucuri blogs or any volunerability monitoring website if the new update is safe. It takes 2 days to find out if there is some exploit which makes wordpress the most powerful cms unlike gurus want you to think.
Finally, don't waste your time on any defense plugin, for exploit hacking they are worthless.
Pro Tip, 99,99% of hacking methods include some code change, or file edits. So, even if you got hacked, just find file changes on your server and remove it.
To Summarise
- Interval backup to remote drive is a must and most hosting provider provide this service btw. Or you can use any backup plugin. Be cautious, back up plugins usually backup wp-content folder only. While malicious codes are usually in the main folder.
So, its always better to backup the whole website including main wordpress files.
Or if you back up the wp-content, then make fresh install for the wordpress core to removd any malicious code hidden there.
- Don't upload any php code from some shady source
And this is it.
