Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I moved to a new server recently, a week later a site got hacked, all they did was change the index.php file of the current enabled theme, no big deal. I did have a few security precautions in place, no admin user name, all latest versions, no timthumb issue, .htaccess security etc.

I dont want this to happen again, what I did notice is when logged into my WP admin I can edit the permalinks, or any file within the editor (I tested editing the index.php) and it will save.

On my last two servers, I had to go into the FTP set the permissions of the files to 755 or 777 before making any changes, then put them back to 644.

They are currently set to 644 but I can fully edit them within the admin, do you think this is my problem? Kinda worries me.

Thanks, Matt

share|improve this question
    
0% accept rate < please go back and care about the (very detailed) answers on some of your Qs. That's not how the system works. –  kaiser Jan 5 '12 at 1:41
    
I cant vote up until I have 15 rep. I did "thank" and set the answers to useful. Thanks im new to this site! –  matt Jan 5 '12 at 18:29
    
You can mark answers as solution. The check mark is right beneath the voting arrows. –  kaiser Jan 5 '12 at 18:32
add comment

2 Answers

up vote 2 down vote accepted

You can...

  1. Learn about file permission (on wordpress)
  2. Install Wordpress Firewall plugin (version 2 for 3+ versions) (this dissalow access to any folder or file indirectly)
  3. Hide Your Wordpress Version
  4. Try to update plugins & Wp
  5. install Login Lockdown Plugin (this stops any brute force attemts)
  6. Verify that your theme doesnt show "publish by $username" but shows "display name"
  7. Use secret Keys in wp-config.. Keys Generator: here
  8. Move wp-config up one directory (wordpress would look for it dont worry..)

Hope this helps... if nothing else - at least install the plugins.

A small tale.. i used to host one of my website in some 1$ per month server (cant recall its name).. anyhow, it got hacked 4 times in 6 month's.. and i know a thing or two about wp security... nothing helped!

But - Once i left that hosting, the hacking stopped... :)

Have a gr8 day.

share|improve this answer
    
Thanks, I have used a few things to help with security and I am now on VPS hosting. About moving the wp-config up a directory, what if its in my root/www folder? All my wp installs are in the root as they are wp websites not just blogs so I dont think that will work. The thing I really want to know is weither its normal to have the ability to edit files from the wp admin even if the permissions are set to 644. –  matt Jan 5 '12 at 2:25
    
Edit wp-admin files from where... ? do you mean that the system / wordpress can edit those ? –  Sagive SEO Jan 5 '12 at 14:33
    
Yee... Moving wp-config is a problem for multiple installations –  Sagive SEO Jan 5 '12 at 14:33
    
Sagive SEO. To answer your question when logged in under Appearance > Editor any of the theme files can be fully edited and saved, even with permissions of the files set to 644. I know there are lots of security measures I can take but I just want to clear this up first and formost. It seems strange that I can do this. –  matt Jan 5 '12 at 18:27
1  
its ok you can edit that via your admin interface... On some servers thats not the case but those are inside server settings. On the othere hand use those plugins i reccomended to stop any brute force attackes & SQL injection attempts.. –  Sagive SEO Jan 5 '12 at 20:55
add comment

I would strongly suggest checking the site out with someone like Sucuri Security since often times these hacks leave various backdoors to let themselves back in, or remnants in the database itself. It's very possible that a previous hack wasn't completely cleaned.

share|improve this answer
    
Thanks I do use BPS security on all my sites...I gave it a scan with that one and nothing came up. Seems clean. –  matt Jan 4 '12 at 18:08
    
It might be worth signing up and having them do a deep scan to look for suspect files that could pose a problem later on. –  Norcross Jan 4 '12 at 18:33
    
Ill look into that, im cerious as to why the files are editable though through the wordpress admin as I described above, is this normal, I have not come across it on the other 3 servers I have used in the past. Thanks. –  matt Jan 4 '12 at 20:07
    
well, things like the permalinks aren't editing WP files, rather, they write to the .htaccess file. Most of the other pages are saving settings to the database, not actually editing any files directly. –  Norcross Jan 4 '12 at 21:51
    
Can You share the server Name? (or give a hint)... thanks @Norcross ... didnt know that website –  Sagive SEO Jan 4 '12 at 22:32
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.