WTF My Website Got Hacked?

Hope you get it fixed soon

Dude, just switch the hosting.

I'd recommend you to install these two plugins-

BulletProof Security -Harden your site's security
WordPress Database Backup -To backup your site every once in a while, so that you can always restore in case a hacker deletes the contents on your site
Hope it helps m8

So you got it hacked twice in the same week? WTH! You could look at fiverr and have a reputable trusted seller look at your sites security to make sure it is secure.

xxsaumitraxx said:

I'd recommend you to install these two plugins-

BulletProof Security -Harden your site's security
WordPress Database Backup -To backup your site every once in a while, so that you can always restore in case a hacker deletes the contents on your site
Hope it helps m8

Click to expand...

I had the same problem but hacked by someone else called haxor. I installed the above plugins at the suggestion of my hosting administrator. Apparently it's a common problem with wordpress and some plugins which leave you vulnerable.

I had the same problem when I first started. Had to redo everything!

Very sad about this topic. Once I get hacked because I get keylogger on my pc..
So these are the things you have to do :

Choose a good web hosting with good support, the one I'm using is abit expensive but their support is awesome and ddos attacks are blocked so in this case I have no worry and daily they take backups..

Change the URL of your Admin page and config file. If you install any new plugin just check whether in the plugin file they have sth like 'index.hml or index.php', if it doesn't have just create new file called 'index.hml' in the file.. Also update the wordpress if there is any new updates...

You might get keylogger, trojan or smth like that, as long as they make the server exe fud non of the anti viruses can catch so be careful about what you downloading to your pc..

If you're using that "Popular Overbloated Script" (I usually use an acronym for it, it's easier to remember), make sure to check this URL regularly (or any similar security related website):


If you see your current WP version listed there, or any of your plugins, themes, whatnot, make sure to read about the problem, and apply the Solution listed. Particularly so if you're running many WP websites.

I usually stay away from that blog platform that got bloated into a non-ideal CMS, but I understand how it makes things easier for many, more so if you're automating things. And as already mentioned, plenty of times it's not even your fault. Incompetent server admins are often to blame.

It is quite common and some of the old VB forums too are becoming victims of these hackers..

Its not abnormal to suffer a hack even once a year.

But I had a site on separate hosting that got hacked, then like a month later it got hacked again.

After that, I'd had enough of the host (Downtownhost). I cancelled. Maybe this wasn't their fault but I never had that frequency of hacking on Hostgator.

Got 5 or 6 malwar-ed a couple weeks ago with shared hostgator. They all have a few 5> updated plugins, one being Better WP Security that has since been deleated.


HG said it injected in through FTP. It baffels me how they got in with my over perinoid passwords + we haven't used FTP since around April... All we were doing was carring around the URLs for links.


Will be testing BulletProof Security and already do full backups every edit (helped anger control a lot).
HG was good at cleaning up quick
Good luck! It aint over till it's over

wow, don't people have anything better to do?

Thanks, I will apply this if I got hacked....

Shared hosting ? If you use shared hosting there are many vulnerabilities in some files.... please check it as all people from your server or shared host can gain access.... just google problem with shared hosting, vulnerabilities in shared hosting, shared hosting dangerous and what ever....

it's sad if you can't secure your own PC or simple Wordpress installation. End of story.

You're trying to start a business & make money online. Act like it. Otherwise please give up now, or get smart. You're making the rest of us look bad.

step 0) go ahead and just reformat your whole computer, clean wipe. dban that shiz. I'm sure you probably have many trojans/viruses that you won't be able to completely eradicate (unless dedicated and hungry to learn). Reformatting is a fresh start, and new beginning. Plus it'll make windoze run faster without fail.
step 0.1) partition your hard drive. One smaller partition (for windows 7) about 30-50Gb. A separate partition(s) for your data. This will serve as a fall back in the future when you infect your OS or just need a fresh start; or faster windoze install.

-----------------------------
for everyone else that doesn't install exe's they found online or nulled SEO software (just don't do it. only install software to your main OS from legitimate sources with ongoing updates/support)
-----------------------------

step 1) secure your own pc, download comodo firewall set to custom policy and increase settings to paranoid status (for firewall only not defender/programs). start watching what ips/ports are connecting where, google them, allow or deny on case-by-case basis. It will get old quick. in a week you'll be a master. in a month you'll be a *****. in a year you'll be chuck fsckin norris. always backup those firewall program settings for when you reformat later. (I don't let programs connect to the internet unless they specifically need the internet, ie web browser)
step 2) go buy eset nod32, it's cheap as shit and one of the best anti-viruses imo. coupled with router hardware-level firewall, comodo software firewall, and diligent software screening you'll be set.
step 3) regularly update windows/OS if needed (i usually get by without this, but i'm probably an exception to the rule)

PARANOIA BONUS STEP ) follow the N\ S\ A's security guidelines and secure windows up like a pro. giggle it.
PARANOIA BONUS ROUND ) realize win.doze phones home like ET and tracks more than most spyware. giggle up date as well. try to get rid of giggle update, it's acts like a lot of malware and reinstalls itself even after uninstalling all related software.

step 4) if you have to use hacked or nulled software, or any software you don't trust: use virtualbox to completely isolated a guest OS, and don't communicate between the guest and host OS AT ALL. go even further and dl a sandboxing application if needed, and even install viruses for fun if you want; just create snapshots of the OS before installing untrusted software and if it acts strange revert back to clean snapshot. Your network is still open to attack if you don't have everything setup like a pro, but i'm not gonna hold your hand the entire way... do some research, other people have already spent months/years/lifetimes securing computers and probably compiled the information in a blog post; learn to how to use giggle operators when searching.

So now you're kind of secure -- (at least you feel secure.. there are new and very high functioning viruses being developed that antivirus' just aren't made to detect, but those are less worried about your nonexistent blog business and more about spreading itself til it finds it's target of interest, ie not you or your botched wordpress installations, etc)

step 5) get off shared hosting . <---- see the period. Period. It's not secure unless done right, and trust me, for the price you're paying it won't be done right.
step 5.01) just imagine this scenario for a second. I'm a hacker or malicious competitor that is targeting YOU SPECIFICALLY. All I would have to do (as its already been said: depending on the amount of websites on the shared host or node... for this example we'll assume it's a smaller noname webhost or free trial throwing everyone on one shared server) is sign up for a free trial with the web host, intentionally infect the server, then hack every website that's on the node or only target your competing website. Most likely the host isn't separating the databases properly, so it's child's play to compromise every DB hosted there.

P.S. I'm not a hacker, and have never attempted to hack, this is all preventative security research, as well as curiosity-based research; somewhat like my interest in this forum. (one guy said 1-10% of Wordpress sites online are hackable, I would completely agree and argue that it's probably more like 20-40%+ even conservatively speaking) If an experience hacker is ever actually determined to hack your Wordpress installation, this number sky rockets based on the motivation/patience level of the hacker. When you allow guest registration it opens up many different points of attack to escalate guest privileges or use other vulnerabilities.

Also all these new themes with their unprotected frameworks, and loose or rather nonexistent security requirements/guidelines make it even worse.
Woo.th.em.es response to this exploit was unacceptable. they almost completely ignored the vulnerability:
https // gist github . com / 2523147

to hurry up and finish this post I'll add a few more things, but the rest of the research is up to you. Will create a separate longer post if people find this useful though.

step 6) if you use downloaded themes from sites other than wordpress com, install plugins Theme-Check, Theme Authenticity Checker (TAC), exploit Scanner, and find out which you like best. I use a combination of them. Make sure after you clean the themes that you uninstall any unnecessary plugins.
step 7) Having a lot of plugins will lead to vulnerabilities. Try to use the minimum amount possible, and develop your theme for other needed functions/features. DON'T USE SHADY PLUGINS.
step 8) Check that your theme has the timthumb version 2 not v1, or use Timthumb Vulnerability Scanner if you need to
step 9) Check out bulletproof security, better wp security, wordfence security, and learn what they are doing and decide which ones are best for your implementation. This is mostly security by obscurity, but detecting/blocking login attempts can def thwart some crackers. This will cause server load, and I usually don't worry about it for low traffic sites.
step 10) remove default admin account, and also remove the forgot password link. Try to create ultra secure passwords: https www grc com / passwords htm
step 11) CHANGE THE DEFAULT DATABASE PREFIX FROM WP_ ... This is a huge security improvement and should be done to every wordpress blog. This will help stop the SLEW of sql injections that can easily target prenamed DB tables. Make it something alphanumeric and cryptic.
step 12) noindex/disallow private/important parts of your site.
step 13) make sure permissions are correct. SOOO many sites out there let google index wp-content, and give access to sensitive data. Even putting DB dumps that then are indexed by google and are a google dork away from exposure.
step 14) like someone else said: WP-DBManager. Great plugin. I have it send nightly dumps to email so any comments/edits are always saved. Had months of posts deleted, and have updated daily ever since; no exceptions.
step 15) this should be a given but: UPDATE WORDPRESS AS SOON AS UPDATE COMES OUT. UPDATE PLUGINS/THEMES AS SOON AS THEY HAVE UPDATES.


k I'm tired of writing, but there's a lot more. This should stop the majority of attacks, but in reality you need to have a secure server. Most people will think they don't have the money to get a professionally secured/managed server, but it's well worth the cost when it's your business/income & livelihood you're protecting.

Good luck. Let me know if this helps.



***this information is provided for informational purposes only with no guarantee of anything whatsoever. Do your own research.***

How did you solve this problem? or is it still 'breaking your head'?

Thanks, I hope all is ok again!

Very sad.
But how to hack your site.
My wordpress site is running.
If you can know to hack site please pm me.

Which hosting do u use?

If you're running your website on WordPress, make sure you use Better WP Security. It's a great plugin that makes some neat changes to your WP blog to make it more secure.