Wordpress sites keep getting hacked

angelas111 · May 16, 2017

My sites keep getting hacked over and over. I googled some of the php from one of the injected files and this came up: https://pastebin.com/mC6bNh1V

I've changed my root password, changed ftp password, updated all my plugins and wp versions but they still keep getting in.

I even found the weird folders on one of my non-wp sites so it may not be because of wordpress.

Has anyone seen this before and have an idea of how I can defend against it?

virtualpurity · May 16, 2017

angelas111 said:
My sites keep getting hacked over and over. I googled some of the php from one of the injected files and this came up: https://pastebin.com/mC6bNh1V

I've changed my root password, changed ftp password, updated all my plugins and wp versions but they still keep getting in.

I even found the weird folders on one of my non-wp sites so it may not be because of wordpress.

Has anyone seen this before and have an idea of how I can defend against it?

Do you have other websites hosted on the same account ?

Are you using a cracked/nulled theme ? Or any cracked/nulled plugin ?

bartosimpsonio · May 16, 2017

Are you using a common mysql password for multiple sites?

Innovatorz · May 16, 2017

angelas111 said:
My sites keep getting hacked over and over. I googled some of the php from one of the injected files and this came up: https://pastebin.com/mC6bNh1V

I've changed my root password, changed ftp password, updated all my plugins and wp versions but they still keep getting in.

I even found the weird folders on one of my non-wp sites so it may not be because of wordpress.

Has anyone seen this before and have an idea of how I can defend against it?

Seen this before. You can use WordFence for starters. For cleaning ht access file, please hit me up on PM.

angelas111 · May 16, 2017

bartosimpsonio said:
Are you using a common mysql password for multiple sites?

I'm using the same password for multiple sql but it has multiple letters and numbers, upper and lowercase

angelas111 · May 16, 2017

virtualpurity said:
Do you have other websites hosted on the same account ?

Are you using a cracked/nulled theme ? Or any cracked/nulled plugin ?

Nothing is cracked or nulled. Learned my lesson a long time ago with that.

virtualpurity · May 16, 2017

angelas111 said:
Nothing is cracked or nulled. Learned my lesson a long time ago with that.

Well i have seen the exact same thing countless of times and mostly the source of the infection has been a rouge plugin or theme.

They always leave a persistence scripts that checks if files are cleaned and if they are than the scripts re-downloads and re-infects. Try to find those first , than after deleting them clean all the php files from the malicious code.

If the pastbin code is the exact one that you are infected with you can go trough it and check all the the actions it performs and which files it changes/generates for example :

Code:

   chmod (".htaccess", 0777);
    $outht = fopen(".htaccess", "w");
fwrite($outht, "# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
 
# END WordPress");
fclose($outht);

This part rewrites your htaccess file etc..

I have found that removing the infection can be far more frustrating and time consuming than exporting the posts and wp data and re-creating the website again.

SpoonFeeder · May 16, 2017

The reason why it keeps occurring is because the malware is loading from your DB. You'll have to clean the DB as well as the injected files manually to get rid of it.

Billy Batts · May 16, 2017

You got SSH access?

bartosimpsonio · May 17, 2017

angelas111 said:
I'm using the same password for multiple sql but it has multiple letters and numbers, upper and lowercase

But if they're all the same then there's a single point where the malware is at, when you clean you blogs, it spreads again because it can access all other databases.

First thing is to get one unique username/password per blog.

MisterF · May 17, 2017

Was this a site you built yourself or outsourced ?

I once bought a couple of MNS hackproof sites from a seller on here and they got hacked after a month (funny enough).

suruchibali · May 17, 2017

Hey Bud,

Try to generate different passwords for your different websites using this http://pintient.com/1lnU.

Thanks and regards
Suruchi Bali

bartosimpsonio · May 17, 2017

MisterF said:
Was this a site you built yourself or outsourced ?

I once bought a couple of MNS hackproof sites from a seller on here and they got hacked after a month (funny enough).

Yeah maybe OP is using nulled theme, or a backdoored theme or some other infected installation (on purpose or by accident).

virtualpurity · May 17, 2017

bartosimpsonio said:
Yeah maybe OP is using nulled theme, or a backdoored theme or some other infected installation (on purpose or by accident).

He said he was not in the post above. But i have learned not to trust even the paid themes over time. If its not a popular theme or plugin , as soon as the sales drop or stop some of the developers sell their plugin to "blackhatters" because they are paying quite well for these kind of stuff.

Charlievurt · May 17, 2017

I have suffered the same problem before it is time confusing and frustrating but as others mentioned clean your DB install a fresh WordPress and avoid nulled themes.

bartosimpsonio · May 17, 2017

virtualpurity said:
He said he was not in the post above. But i have learned not to trust even the paid themes over time. If its not a popular theme or plugin , as soon as the sales drop or stop some of the developers sell their plugin to "blackhatters" because they are paying quite well for these kind of stuff.

You're right, I wouldn't trust the theme either. Anyway WP themes should not be used blindly. When you get a new theme, have a look at the source code. Check out what it does. If you see funny base64 coded stuff, that's a smell. Check what the base64 part does using a decoder and code pretty printer. Don't just trust themes, that's the main thing.

Ninah · May 17, 2017

I'm not an expert but creating an account on cloudflare might be helpful after you will clean your website. You will have free ssl certificate and lots of other great free stuff. I'm using cloudflare from the beginning so I don't know how it will be with your backlinks when you switch from http to https, so check this before. Good luck my friend, I know how frustrating this problem is.

roki4ka · May 17, 2017

Use wordfence and loginizer and put some security in the htaccess

Ninah · May 17, 2017

virtualpurity said:
He said he was not in the post above. But i have learned not to trust even the paid themes over time. If its not a popular theme or plugin , as soon as the sales drop or stop some of the developers sell their plugin to "blackhatters" because they are paying quite well for these kind of stuff.

I didn't know about it, very disturbing. I'm using now premium theme, I bought it when I was a complete newbie and now I regret my choice. I noticed lately my theme developers have been doing rarely updates. In the future, I'm planning to switch for something really safe like elegant themes or something like that.

blackpayman733 · May 17, 2017

with wp always troubling, im getting hack 2 service always : D so always make backups

Wordpress sites keep getting hacked

Elite Member

Elite Member

Elite Member

Regular Member

Elite Member

Elite Member

Elite Member

BANNED

BANNED

Elite Member

Repeat Selling Out MP - Doxxing - Harass Comps.

Newbie

Elite Member

Elite Member

Newbie

Elite Member

BANNED

Senior Member

BANNED

BANNED

Main Menu

Marketplace

Making Money

BlackHat World