WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im trying to figure out how Wordpress sites become defaced/hacked. I know development very well. I know how to secure code, etc. But I am finding recently, that tons of Wordpress sites are becoming defaced. Both sites I developed, and others. Is it simply outdated Wordpress installs? Even when Wordpress is running version 3.1, sites are still being defaced.

All user input is validated, both on the front-end and back-end. WP nonces are used wherever possible. Servers are fairly secure (not 777).


I'm loosing faith in Wordpress. If it is my fault, I will gladly admit and fix, but the only answer seems to be outdated Wordpress sites, and I find that hard to believe.

share|improve this question

closed as off topic by toscho Nov 26 '12 at 13:06

Questions on WordPress Development Stack Exchange are expected to relate to WordPress within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Maybe because of that TimThumb bug that's floating around lately? – onetrickpony Sep 14 '11 at 22:03
Any solution? Please mark something as solved or add your own answer and mark this one as solution. – kaiser Oct 24 '11 at 12:57
up vote 3 down vote accepted

Even when Wordpress is running version 3.1, sites are still being defaced.

Even? There had been one major and five security releases since that version. If you are implying that 3.1 should be reasonably secure - it is not.

but the only answer seems to be outdated Wordpress sites

What had you done to exclude themes, plugins and hosting used to jump to conclusion that WP is sole possibility?

If you are concerned about security of your sites had you considered hiring expert to perform proper security audit?

share|improve this answer
The purpose of these sites do not merit a security expert. There are 0 plugins, and custom themes on all of theme. The custom themes are secure. The security issues are either Server related, or Wordpress installation related. If it truly is outdated WP installs, then good. Easy fix! – Chris Sep 14 '11 at 21:28

Imo it's your server or your host. Hosts that are known for not really caring about security on their shared services are dh and mt (and some others out of the big players). Both had been successfully attacked and infected multiple times last year. As i use one of those myself (contract running) and had the same problem as you (different installs, no plugins, custom themes, etc.), I'd go and ask them. But don't expect any real answer.

share|improve this answer

Many of the serious vulnerabilities in WP lately are actually in the plugins. I recently found a combination of plugins that, when installed together, caused WP to accept ANYTHING as a password. As long as an attacker knew a valid administrative login (hello, Admin!) on a site running those plugins they could do anything.

In addition to that some sites and providers are not set up in a secure manner. There are an alarming number of sites out there with minor issues that give away enough information to allow an attacker to access the database directly or compromise the host entirely.

Adding to that as well; people often reuse passwords. If your email password and your WP password are the same that gives an attacker who targets you personally more opportunities to find out what it is.

If your site has been defaced or otherwise accessed by an unauthorized user you should take a careful look at your plugins and their versions, WP and it's version, your theme, your database configuration, and also your host configuration. It's possible there's an information disclosure somewhere or a poorly secured administrative interface that's allowing them in.

The issue may not be WP itself at all.

share|improve this answer
If those plugins were in the Repo, I hope you raised some flags about them... – brasofilo Nov 26 '12 at 14:33
@brasofilo: They were. I contacted WordPress and they pulled the plugins until they were corrected. – Nathan V Nov 26 '12 at 14:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.