It's Crazy How much WP Websites get Attacked...

Why many WP Hacked? Easy

A thousand of plugins installed and not updated with vulnerabilities. Like security plugins have a lot of vulnerabilities.

Themes that require plugins to personalize etc.
Nulled themes and plugins.

Weak passwords and username obviously.
Permissions chmod 777..

That's the truth.
 
Advertise on BHW
Scorpion Ghost said:
I use wordfence.. or wordforce.. something like that.

But even if a hacker gained admin access, what the hell they gonna do? Not like i keep my crypto private keys in my wordpress website files.

Whatever hacker, move along sir, nothing to see here :p
Click to expand...
what someone could do is get shell access and from there root on your server not just wp.
if you dont have anything interesting, well he could use your server to attack other systems which might get you into trouble.
 
Sugirl said:
What if you add content every day and your backups are taken maybe once a week?
What if you make $500/day from your site, it would massively suck if you had to loose that $ for a couple of days , or even worse, get your website's search engine rankings fcked up...
Click to expand...
there are plugins for automated daily backup. the real problem is, as you say, the rankings getting fucked up. also, if they use your page as platform for scams/spreading more malware, that could royaly fuck up your business. i think a good answer is activating 2AF for your site.
 
hack this

9fus8vzy78ef3iz8gfu9a4

FS`23,0943it42T`O**gtkj98/.g423-$@I$R#@KFS7^f3F$(GZ(Fkk
 
If I couldn't hack a target WP Site I used to check every website hosted under same IP and then proceed to check if there's one vulnerable. Then I'll upload a shell and root the web server. Then I'll move to the main target and whoala.. Those good old days.
 
Scorpion Ghost said:
I use wordfence.. or wordforce.. something like that.

But even if a hacker gained admin access, what the hell they gonna do? Not like i keep my crypto private keys in my wordpress website files.

Whatever hacker, move along sir, nothing to see here :p
Click to expand...
Well, there are lots of things, hackers can do...
- Spread other malware to the websites visitors
- Inserting hacklinks
- Inserting auto generated pages ... if you do lots of casino queries in google, you will find this hack for sure!
 
It's normal just check GitHub you will find a bunch of scripts that auto search wp sites and brute force it with the username:password you have entered.
In other forums, I've seen people selling hacking WordPress admin panels for 1$ each lol. I suggest changing the admin panel location because mostly automatic scripts only performs bruteforce attack on wp-admin and won't bother finding the location of the admin panel if you have changed to something else
 
Jongosv2.0 said:
Just add htpasswd in wp-admin folder and you good to go
Click to expand...
I dunno, a lot of themes use admin-ajax.php in the wp-admin folder for frontend things. The user would end up getting a load of login boxes every time some frontend ajax is attempted.
 
Steptoe said:
I dunno, a lot of themes use admin-ajax.php in the wp-admin folder for frontend things. The user would end up getting a load of login boxes every time some frontend ajax is attempted.
Click to expand...
Works for me. Even with ajax!

But anyways: WP is just pretty easy to hack. You just look for versions with vulnerabilitys like SQL-Injection, then you may not even need a password.

Thats why the wp-admin folder need to be protected.

Some ppl have a bot to search for dorks like: wordpress 3.x.x

Now also there are a lot of public vulnerabilitys for wp. Just check what is easy to hack and search on google for the version.
 
Last edited:
itz_styx said:
what someone could do is get shell access and from there root on your server not just wp.
if you dont have anything interesting, well he could use your server to attack other systems which might get you into trouble.
Click to expand...

alexono1 said:
Well, there are lots of things, hackers can do...
- Spread other malware to the websites visitors
- Inserting hacklinks
- Inserting auto generated pages ... if you do lots of casino queries in google, you will find this hack for sure!
Click to expand...

Yeah you're right guys. I just do things in unorthodox ways, and it works for me somehow someway :eek:
 
Wordpress is a weird one for sure. These days we can see from our logs that our waf is blocking around 1.2mil+ Wordpress hacking attempts a day and steadily growing.That’s excluding brute force attacks to wp-login.

If you are using Wordpress, you really need to take care of your websites and keep everything updated and secure. There are huge botnets out there who will find a vulnerability on your site if they want to and you let them.
 
The same happens in other large cms, Joomla, Drupal, etc.
 
The problem is with cPanel. Most providers do not enforce 2FA.
Furthermore, the server software and cPanel is not always updated as often as it should be.

Also, it's all too easy to find the website's host and your admin email.
From there it's pretty simple to gain access.
 
jeeez and what are they gonna do when they hacked your site? Did you put gold bars there? haha
 
Sugirl said:
I do run few medium-sized websites, and I could not believe how many brute force attempts my /wp-admin page gets after installing the plugin that limits brute force attempts and logs login attempts.
Most of my websites get around 400-700 DIFFERENT login tries per day all from different IP's, with each sending multiple password tries, so essentially even with brute force limiting I get around 2000-2500 password tries per day sent :D

God only knows how many it was before the brute force limiter...Blows my Mind that there are so many people trying to ''hack'' websites.

When installing new wordpress installation, change your username from admin to something else , but not your website name as they try for it quite frequently..
also..Install a plugin that changes the location of your login page to something else..
Click to expand...

IT is the themes and plugins.
WordPress is a mature product and mostly the self hosted versions gets hacked. I barely heard the cloud version getting hacked.
IF you do not use extra plugins from unknown source, permission correctly then wp is not going to disappoint you.
 
Jeff Vh said:
I find it crazy WP is still being used.
Click to expand...
I looked at the database system in wp yesterday. It's so little. Outside of woocommerce it's crap. A client will install tons of plugins thinking he will get something for free.
 
apart from changing the login URL remember to disable xmlrpc.php because if you dont you still get the brute force login attempts
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top