[IMPORTANT] Secure your wp from bastards. For noobs and not only.

Got my Wordpress protected few days.
Got hacked again today :|

I find that they are hacking through js file such as:
plugin/jquery-1.3.2.min.js
/wp-includes/js/jquery/jquery.js
/wp-includes/js/l10n.js

Any suggestion?
 
Advertise on BHW
Blame your hoster. And google for those files, masybe there will be some useful info
 
wish I had found this earlier

been searching for 4 days what was screwing around with my .htaccess file and finally found out about that thumb.php exploit in my theme

this hurt my site pretty badly, last couple weeks was seeing barely any visitors and wondering what was going on and lost lots of ranking with google :(

time to bring the site back up, hopefully doesn't take too long
 
der.brain said:
Hey guys that is security for kids ;-)

Please use this to protect your servers:

- Modesuce
- CSF Firewall
- Ddos Deflate (Sorry do not have a link)

This protects your whole server and you do not need to do something at your WP.
It does not make sense cause if you install another CMS you have to do the whole shit again.
So do it once, do it professonal and stay online whith a bullet proved server!

Brain
Click to expand...
your fix is server side...what about us that rent...server/hosting accounts...I guess the fix ( some other fix not this one ) still needs to be applied within wp...huh.
 
I remember when all my blogs were hacked because the server got infected. It was a pain fixing all my blogs.
 
There are two types of admins. Those who backup, and those who don't yet...

There are two types of admins. Those who backup, and those who verify that it restores...
 
take regular backups...................that ll help u in this type of situations...................
 
Im actually get warnings for WP firewall about lots of wierd queries. Sometimes like a dude spent whole night on one IP trying stuff lol
 
backupbuddy plugin is nice and worth it if you have alot of websites.
 
Is it any plugin that autoinstalls updates? Is it safe at all?
 
I have GAZETTE theme, what with thumb.php file. I opened it but can not see anything with respect to $allowedsites

Is it added only to affected site or is it written by the original coder it self?
 
My site was hacked... luckily I had a recent (not too recent though that it had signs of injections) backup, more luckily it wasn't touched. The hacked site had timthumb vulnerability. Now I am using this plugin: timthumb-vulnerability-scanner.

Looks like it is a good solution. Not too sure until my site is attacked again through that loophole.:) Then I will be sure that it was useless. lol


BTW, OP, how can I make sure that
1.
only my IP can open the /wp-admin file? Using .htaccess? And what about the permissions for the files and folders?
2.
same for FTP access >> only my IP should be able to get access. Anything exists for enabling this?

Thanks!



P.S.: Thanks and +Rep added! Good helpful thread!
 
Last edited:
Thanks for covering almost every aspect, security has always been my concern.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top