Wordpress Hacked traffic dropped -> $$$dropped

Stuart94

Registered Member

Oct 7, 2015

51

2

• May 23, 2016

• #1

So recently my wordpress site was hacked and i don't know why someone would hack my site . I only have like 100-200 visitors per day. BUT anyways the hacker posted porn all over my site and since then everything dropped from having 100 visitors to 30. And i dont know what to do pls someone help i changed the password but i fell like thats not enough.

What should i do to prevent hackers ? and how did this hacker my site ?

 

kugundo

Regular Member

Jun 21, 2013

224

77

• May 23, 2016

• #2

You can use Two Factor Authentification with for example "Clef" , use Login Limit Plugin and other Plugins like HidemyWP to prevent your website being hacked in the future.

We cannot tell how the Hacker achieved this, there's more than one way. Maybe you had a weak password and he used "Brute Force" to gain access.

 

iamcholo

Junior Member

Oct 2, 2015

196

59

• May 23, 2016

• #3

Hey Stuart,

Running a WordPress Site without protection is f8cking crazy.
I'd suggest to take a look at the following plugins:

• Wordfence
• Block Bad Queries (BBQ)

Also, check if you hosting company has been hacked. (Send a ticket support)

Good luck!

 

Stuart94

Registered Member

Oct 7, 2015

51

2

• May 23, 2016
• Thread Starter Thread Starter

• #4

hey kugundo and iamcholo thx for fast help. i will definitaly try out those plugins hope it helps .
but one question i downloaded a plugin can a hacker manipulate a plugin and get acces through that ?

 

LuckyCharm007

Elite Member

Jul 8, 2015

2,211

1,583

• May 23, 2016

• #5

PM me your domain name. I'll run a scan on it and check what happened. Usually hackers use a "backdoor" - Nulled theme, outdated plugin or lack of security to access your files. Also, Check your htaccess to see if there is something that shouldn't be there. 90% of the time, they use your domain to spam emails or redirect users to porn site via mobile site.

 

RuthSam

BANNED

Mar 19, 2010

3,804

1,014

• May 23, 2016

• #6

LoginLockDown great tool and WordFence.. if you have money SUCURI is great and cloudflare!

 

HelloInsomnia

Elite Member

Mar 1, 2009

1,801

3,042

• May 23, 2016

• #7

As others suggested use WordFence and you will need to research how to do this a bit but change your nicename in the database, this prevents people from finding your username in the source code. And obviously use a strong password as well.

 

Conor

Elite Member

Nov 7, 2012

3,621

6,217

• May 23, 2016

• #8

Two plugins:
Scan your site with this: https://wordpress.org/plugins/gotmls/
Secure it with this (Go through the settings carefully): https://wordpress.org/plugins/better-wp-security/

 

DunDidIt2X

Elite Member

Mar 22, 2012

2,863

2,432

• May 23, 2016

• #9

You need to also prolly clean your site files too. They prolly have back doors all over.

 

immaletyoufinish

Regular Member

Mar 3, 2016

219

119

• May 23, 2016

• #10

Disable xmlrpc as that is being used to brute force passwords a lot these days. Also rename the default table prefix in the database from wp_ to something else. These are critical steps for hardening wordpress.

By default wordpress is a security nightmare. It's like parking your ferrari in the ghetto and leaving it unlocked with the windows down and keys in the ignition.

 

dakkidb

Junior Member

Mar 12, 2009

131

31

• May 23, 2016

• #11

I got hacked too back in 2013. Damn hackers. Best thing to do is create a support ticket ASAP to your hosting company so they can restore a backup of your site.
And as everybody said here: add security plugins this time!