Wordpress Hacks/Defacing [closed]

Question

Im trying to figure out how Wordpress sites become defaced/hacked. I know development very well. I know how to secure code, etc. But I am finding recently, that tons of Wordpress sites are becoming defaced. Both sites I developed, and others. Is it simply outdated Wordpress installs? Even when Wordpress is running version 3.1, sites are still being defaced.

All user input is validated, both on the front-end and back-end. WP nonces are used wherever possible. Servers are fairly secure (not 777).

????

I'm loosing faith in Wordpress. If it is my fault, I will gladly admit and fix, but the only answer seems to be outdated Wordpress sites, and I find that hard to believe.

Answer 1

Even when Wordpress is running version 3.1, sites are still being defaced.

Even? There had been one major and five security releases since that version. If you are implying that 3.1 should be reasonably secure - it is not.

but the only answer seems to be outdated Wordpress sites

What had you done to exclude themes, plugins and hosting used to jump to conclusion that WP is sole possibility?

If you are concerned about security of your sites had you considered hiring expert to perform proper security audit?

Answer 2

Imo it's your server or your host. Hosts that are known for not really caring about security on their shared services are dh and mt (and some others out of the big players). Both had been successfully attacked and infected multiple times last year. As i use one of those myself (contract running) and had the same problem as you (different installs, no plugins, custom themes, etc.), I'd go and ask them. But don't expect any real answer.

Answer 3

Many of the serious vulnerabilities in WP lately are actually in the plugins. I recently found a combination of plugins that, when installed together, caused WP to accept ANYTHING as a password. As long as an attacker knew a valid administrative login (hello, Admin!) on a site running those plugins they could do anything.

In addition to that some sites and providers are not set up in a secure manner. There are an alarming number of sites out there with minor issues that give away enough information to allow an attacker to access the database directly or compromise the host entirely.

Adding to that as well; people often reuse passwords. If your email password and your WP password are the same that gives an attacker who targets you personally more opportunities to find out what it is.

If your site has been defaced or otherwise accessed by an unauthorized user you should take a careful look at your plugins and their versions, WP and it's version, your theme, your database configuration, and also your host configuration. It's possible there's an information disclosure somewhere or a poorly secured administrative interface that's allowing them in.

The issue may not be WP itself at all.