My website has been hacked - I need help

MadsDK · Mar 30, 2023

Hi

I have been fighting a tough battle for the past week against a hacker who keeps injecting malware into my file manager and I have no idea how this is possible and how to fix it once and for all.

I have since I discovered the malware files:

Changed all passwords
Updated all my plugins and themes
Installed WordFence, and through Festinger got the premium version.
Activated 2FA
Of course, removed all malware that WordFence finds and also what the scan report from BlueHost shows.
Blocked most of the world from accessing my websites, so only my top geographies can access my sites.

And the hacker continues to be able to inject malware into my websites. I have also not been able to find out which website(s) are being accessed through.

The same files are constantly being changed (wp-config, wp-settings, index.php) and the same files, with the same names, are being uploaded.

WordFence allows me to see which suspicious pages people are visiting. Here's a screenshot of some of them for one of my websites:

These seem very suspicious to me, but they could also just be bots trying to find weaknesses and not the actual hacker.

I hired someone a few days ago to remove backdoors, malicious files, etc. from a scan report, but these files just come right back again, and BlueHost is not very helpful. I am therefore writing in here, hoping that there is someone who has been in the same situation and found the solution.

RAP · Mar 30, 2023

It seems the hacker is able to upload php files.

Use 8G firewall:

https://perishablepress.com/8g-firewall/
It's very strong with strict rules to prevent hackling / inject code / pass GET params.

Use it immediately (add it to your .htaccess).

TheMarquis · Mar 30, 2023

MadsDK said:
Of course, removed all malware that WordFence finds

You have to remove them before uploading on the server, not after.

My advice is:

Backup the site and download a copy into your pc.
Scan it with VirusTotal, and see where is the problem [usually, a nulled theme or plugin(s)].
Find the issue and apply the fix.

After you clean it, reupload your site. Don't forget to change all the old password and username + the WordPress salt keys.

If you have more sites hosted on the server (it's a shared one, right?), those are in danger too. In the best case scenario, after the clean-up, I would totally change the hosting provider, but it's up to you.

Good luck!

Ashk881 · Mar 30, 2023

You haven't beeen able to clear all backdoors clearly if the files can still be added. Either there's an exploit in your code that simply generates the files after some action like a visit or there's a cronjob somewhere or the hacker is simply uploading files themselves.

Those wordfence logs are simply logging script-kiddies who are running automated exploit bots. See how they are trying to GET/POST to xmlrpc and login.php? Thats a common brute-force exploit. You've disabled xmrpc right?

How back do you have backups for? I recommend ditching Bluehost and this wp install, get your content from a backup and just install it somewhere else.

Don't reuse files or anything from this install. Either use a backup that was working or export the content and move to another host and reinstall wordpress there and import your content. This time don't use sus plugins

MadsDK · Mar 30, 2023

RAP said:
It seems the hacker is able to upload php files.

Use 8G firewall:

https://perishablepress.com/8g-firewall/
It's very strong with strict rules to prevent hackling / inject code / pass GET params.

Use it immediately (add it to your .htaccess).

Thank you very much for your comment. I will get the firewall installed. However, I first need to find out which .htaccess is active. I apparently have a few that have probably been added in relation to PHP updates. I am awaiting BlueHosts support's response as to which one is active.

MadsDK · Mar 30, 2023

TheMarquis said:
You have to remove them before uploading on the server, not after.

My advice is:

Backup the site and download a copy into your pc.

Scan it with VirusTotal, and see where is the problem [usually, a nulled theme or plugin(s)].

Find the issue and apply the fix.

After you clean it, reupload your site. Don't forget to change all the old password and username + the WordPress salt keys.

If you have more sites hosted on the server (it's a shared one, right?), those are in danger too. In the best case scenario, after the clean-up, I would totally change the hosting provider, but it's up to you.

Good luck!

Hi TheMarquis. Thank you very much for your comment! I'm currently using UpdraftPlus for backups, and have so far run the database and plugins through VirusTotal without finding anything. Is it possible to download the entire File Manager and scan it?

I only use Festinger's nulled plugins as I believe they are pretty safe.

And yes, I use shared hosting. I am strongly considering switching when my current hosting plan runs out. However, I am afraid of possible problems when transferring to a new host.

TheMarquis · Mar 30, 2023

MadsDK said:
Is it possible to download the entire File Manager and scan it?

Yes: Select all the folders and files > Compress (with .zip) > download the .zip archive.

MadsDK said:
I only use Festinger's nulled plugins as I believe they are pretty safe.

Yes, Festinger's files are safe in my opinion, too.

MadsDK said:
I am afraid of possible problems when transferring to a new host.

There should be no issues. Keep in mind that many hosting providers offers free website transfer, so just get in touch with their support team before buying the hosting plan.

MadsDK · Mar 30, 2023

Ashk881 said:
You haven't beeen able to clear all backdoors clearly if the files can still be added. Either there's an exploit in your code that simply generates the files after some action like a visit or there's a cronjob somewhere or the hacker is simply uploading files themselves.

Those wordfence logs are simply logging script-kiddies who are running automated exploit bots. See how they are trying to GET/POST to xmlrpc and login.php? Thats a common brute-force exploit. You've disabled xmrpc right?

How back do you have backups for? I recommend ditching Bluehost and this wp install, get your content from a backup and just install it somewhere else.

Don't reuse files or anything from this install. Either use a backup that was working or export the content and move to another host and reinstall wordpress there and import your content. This time don't use sus plugins

Hi Ashk881. I appreciate your comment! Thanks for explaining what the WordFence logs mean. I have now disabled xmlrpc - thanks!

I'm not sure exactly when the hacker gained access and I'd be a bit sad to remove all my work lately. And thanks for your tips!

RAP · Mar 30, 2023

MadsDK said:
Thank you very much for your comment. I will get the firewall installed. However, I first need to find out which .htaccess is active. I apparently have a few that have probably been added in relation to PHP updates. I am awaiting BlueHosts support's response as to which one is active.

It's easy only the file called .htaccess

Not any others like .htaccess.backup, .htaccessXXXX.

Add the 8G firewall code there.

.htacess is 1 single file with this exact name.

Other are backup copies.

flowkey · Mar 30, 2023

i had similar issues, what i found to be working is to restore the back up to a date that you think this infection hasn't occured yet, like a day you installed a plugin or theme. etc then scan the files first and find out what got the infection most of the time not properly deleting the culprit will just result in this infection being reinstalled again and again.

Wilson Grant Fisk · Mar 30, 2023

Try the free version of CloudFlare, it could be bots scanning your site.

https://www.cloudflare.com/en-gb/

MadsDK · Mar 30, 2023

RAP said:
It's easy only the file called .htaccess

Not any others like .htaccess.backup, .htaccessXXXX.

Add the 8G firewall code there.

.htacess is 1 single file with this exact name.

Other are backup copies.

Thank you! I have now installed the firewall. I hope it blocks it.

MadsDK · Mar 30, 2023

flowkey said:
i had similar issues, what i found to be working is to restore the back up to a date that you think this infection hasn't occured yet, like a day you installed a plugin or theme. etc then scan the files first and find out what got the infection most of the time not properly deleting the culprit will just result in this infection being reinstalled again and again.

Thank you for your comment. Unfortunately, I am not sure when the files were first infected, nor which site(s) are affected.

Gogol · Mar 30, 2023

Are you sure your site doesn’t have a backdoor?

E.g. like a vulnerable upload widget that is open to public. It is not a malware by itself, but the attacker can use it to upload a shell any time they want.

Ashk881 · Mar 30, 2023

MadsDK said:
'm not sure exactly when the hacker gained access and I'd be a bit sad to remove all my work lately. And thanks for your tips!

You will not lose all your work, just the current setup.

What themes/plugins are you using? Are they free? are they nulled?

Trying to "fix" the install is a losing battle. Wp source files are big and exploit code can be anywhere because of the way php works. It's finding a needle in a haystack and virus-scanners etc won't work. Restoring a backup on a different host/reinstalling wp and importing content would be the fastest/least effort option that guarantees a fix.

MadsDK · Mar 30, 2023

Gogol said:
Are you sure your site doesn’t have a backdoor?

E.g. like a vulnerable upload widget that is open to public. It is not a malware by itself, but the attacker can use it to upload a shell any time they want.

I think it is a backdoor that is the problem. I just can't find it, and neither can WordFence and BlueHost's scanners. I'm currently trying to find the problem via. VirusTotal, but I have the problem that my files are larger than their limit of 650 MB.

MadsDK · Mar 30, 2023

Ashk881 said:
You will not lose all your work, just the current setup.

What themes/plugins are you using? Are they free? are they nulled?

Trying to "fix" the install is a losing battle. Wp source files are big and exploit code can be anywhere because of the way php works. It's finding a needle in a haystack and virus-scanners etc won't work. Restoring a backup on a different host/reinstalling wp and importing content would be the fastest/least effort option that guarantees a fix.

It may well be my way out. It is not something I have tried before, and I, therefore, do not know how much it transfers. I use paid themes, that are not nulled, and both free and nulled plugins.

My main website is built with Elementor - can all the pages (homepage, etc.) from here be transferred, or would I have to start from scratch?

Veil123 · Mar 30, 2023

It is an exploit of a plugin. One of client's website had the same attack a while ago. How many websites/subdomains/addon domains you have under one server/cPanel?

MadsDK · Mar 30, 2023

Veil123 said:
It is an exploit of a plugin. One of client's website had the same attack a while ago. How many websites/subdomains/addon domains you have under one server/cPanel?

I have six websites under my cPanel

Ashk881 · Mar 30, 2023

MadsDK said:
My main website is built with Elementor - can all the pages (homepage, etc.) from here be transferred, or would I have to start from scratch?

Themes and themepages should be fine i believe. It's the plugins that are problematic.

My website has been hacked - I need help

Regular Member

Senior Member

Elite Member

Elite Member

Regular Member

Regular Member

Elite Member

Regular Member

Senior Member

Registered Member

Elite Member

Regular Member

Regular Member

Administrator

Elite Member

Regular Member

Regular Member

Elite Member

Regular Member

Elite Member

Main Menu

Marketplace

Making Money

BlackHat World