Wordpress: Constant Hack attempts...need some advise.

Duffers5000 · Feb 28, 2013

Like most Wordpress users I have been hacked over the years and have learned some Lessons.

I have WPBetter Security running on my sites and changed passwords to major difficult level. I have a lockout and ip notification for anyone thats trying to brute there way in. So after three failed attempts I get a notification and an IP to add to the blacklist.

On one of my sites I am getting hit 5-10 times a day. So someone really wants in. As much as I would like to think I am secure I also know that its only a matter of time so I am looking for suggestions.

Not that it matters but all the Hits have been coming from Italy, Spain and Argentina.

Thanks

mrblackjack · Feb 28, 2013

find out with your hosting provider, if the following mods are installed on the Apache server:
1. Mod Evasive - useful against DoS / Brute Force attacks
more info here:
http://library.linode.com/web-servers/apache/mod-evasive
2. Mod Security - can monitor the HTTP traffic in real time in order to detect attacks. Useful against Sql injections, etc.
more info here:
http://library.linode.com/web-servers/apache/mod-security

I use both of them with combnation of mod_rewrite to create a set of rules against attackers / spammers.

MixerDJ · Feb 28, 2013

if you are in shared server you will get hacked even if you have good security.There is a method called symlinking.with that one if hacker hack in to server he can read you config file using special commands.so even you have strong pw the can change it

Duffers5000 · Feb 28, 2013

Okay so I am with Hostgator. I have experienced the server side hack, where all my sites where redirected to some Russian Pharma. Hostgator were pretty good at clearing that one up. At the moment its just the one site getting picked at constantly. Its also a good site with a tonne of content so Im not keen on getting hit.

marttali · Feb 28, 2013

Next time you install wordpress do not leave user "admin", choose something else for "admin" name, makes it a lot harder.
Do not install wordpress database with the default WP_ as table prefix, instead of "wp" use "gfghuilfs" for example

audioguy · Feb 28, 2013

If you update your WP to the latest version and have secure password (and also other security measures), you don't have to worry.

Sooner or later they're going to figure out that perhaps their time is better used elsewhere.

A strong password, even with automatic program that guesses at several blazing speed, still need lifetimes to crack.

Test your password here:

http://howsecureismypassword.net/

I won't input my own password, but a variety of it... and see how long it takes to crack it.

CISadam · Feb 28, 2013

If you don't care about international traffic, you can deny the entire IP range for the countries you're seeing the most attacks from. I use Better WP Security too after getting hacked on a shared-hosting shitshow

CISadam · Feb 28, 2013

You can also use the wp Salt key to change the way WP stores user cookies and make your site way more secure.

Duffers5000 · Feb 28, 2013

Okay thanks for the suggestions.

So basically I have a very very long hard and difficult password set up. I am using the latest wp 3.5 and I run better wp security plug in. So you reckon Im ok ?

Its just the constant hits that are worrying and also the fact they seem to come in groups from the one country. Site has an international interest so bulk blocking country ips is not really an option.

infoasian · Feb 28, 2013

My sys-admin configured my server in a way that admin scripts are accessible by one IP, only. That is a static IP of a VPN that only me and my admin have access to. An alternative would be to use own, handmade certificate.

edgematch · Feb 28, 2013

In another thread that you also joined

http://www.blackhatworld.com/blackh...-my-wordpress-sites-got-hacked-what-next.html

people gave some good plugin names.

Duffers5000 · Feb 28, 2013

And it was the last post in that thread that has me thinking Im not safe.

edgematch said:
In another thread that you also joined

http://www.blackhatworld.com/blackh...-my-wordpress-sites-got-hacked-what-next.html

people gave some good plugin names.

kasiviswanath · Feb 28, 2013

If you update your WP to the latest version and have secure password.

ubersaki · Feb 28, 2013

you cant always help it. They can get your info easy if they can symlink the server. not hard to do..

bertbaby · Feb 28, 2013

MixerDJ said:
if you are in shared server you will get hacked even if you have good security.There is a method called symlinking.with that one if hacker hack in to server he can read you config file using special commands.so even you have strong pw the can change it

I'm not surprised that there are server side exploits against blogs but this is the first time for me to find out there is a name for that type of attack.

The only other thing I would reiterate is to be sure to have reasonable backups as well. Don't always rely on the hosting company.

kasheshe · Feb 28, 2013

Have you tried wordfence. It cleared my headaches for good. And someone said hostgator can help. my experience with them is excellent too on sites I didn't want to spend too much time on.

But wordfence, manual installs with changes from default wordpress database names will give you nights that are rather peaceful. There is a free version and a paid version.

Duffers5000 · Feb 28, 2013

Thanks I'll look into that.

kasheshe said:
Have you tried wordfence. It cleared my headaches for good. And someone said hostgator can help. my experience with them is excellent too on sites I didn't want to spend too much time on.

But wordfence, manual installs with changes from default wordpress database names will give you nights that are rather peaceful. There is a free version and a paid version.

Wilson Grant Fisk · Feb 28, 2013

Duffers5000 · Feb 28, 2013

Cheers man I appreciate the effort you put into that. I take it wordpress security is a passion for you !!

Using all those plug ins at the same time not slow down your site ?

Wilson Grant Fisk · Feb 28, 2013

It has a minimal effect on loading speeds but with W3 total cache and cloudflare CDN it doesn't affect it too much.

Like I said I am also under attack at the moment, the site they are targeting is pretty crap as I haven't done much work to it so they might actually be after another site on the same server.

The thing is once they have access they can hide and instal anything and just be a pain in the arse or cause more serious problems.

You don't need to run all they plugins I suggested, just have a look through and see which ones you are comfortable with.

Also I have heard good things about the following plugins but have not tested them personally so you might want to check them out too.

http://wordpress.org/extend/plugins/better-wp-security/
http://wordpress.org/extend/plugins/bulletproof-security/
http://wordpress.org/extend/plugins/sucuri-scanner/

Wordpress: Constant Hack attempts...need some advise.

Elite Member

Senior Member

Regular Member

Elite Member

Junior Member

Power Member

Newbie

Newbie

Elite Member

Supreme Member

Elite Member

Elite Member

Newbie

Newbie

Elite Member

Regular Member

Elite Member

Elite Member

Elite Member

Elite Member

Main Menu

Marketplace

Making Money

BlackHat World