Tell me more ×
WordPress Answers is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

Two questions in one. A php file was recently introduced in the root directory of my Wordpress installation (a domain installation). It didn't disturb my website but was apparently using the domain address to propagate ads.

1) How can someone paste a file into my root directory? How to stop that from happening again?

2) The file contain quite exactly this code.

Thanks!

share|improve this question

1 Answer

up vote 1 down vote

You got hacked. Use http://sitecheck.sucuri.net/ to check to see sucuri detects the signature.

Tell your host; if they don't want to help, consider changing hosts to someone more secure, like Recommended WordPress Web Hosting

See FAQ: My site was hacked « WordPress Codex and How to completely clean your hacked wordpress installation and How to find a backdoor in a hacked WordPress and Hardening WordPress « WordPress Codex. Change all passswords. Scan your own PC.

share|improve this answer
Sucuri doesn't detect anything at the moment: my host was helpful, they ran some scan and point me in the right direction. I manually removed the dubious file. I actually knew I got hacked. But what about my two questions (they remain unanswered): 1) How can someone access the root folder of my installation; 2) What’s this code can be used for? – Parneix Mar 13 '12 at 2:32
"How can someone access the root folder of my installation?" Your host is insecure. "What does the code do?" Try any of the online php decoders to decode it. – songdogtech Mar 13 '12 at 3:05
My host is on your list of recommended Wordpress Web Hosting. I'll write to them to try to get more info. And thanks for the suggestion about php decoders. – Parneix Mar 13 '12 at 3:09
It seems you were right about my host being insecure (it's Dreamhost): see on March 9, 2012 “Dreamhost’s Gross Negligence To Blame For Recent Hacks” Excerpt: “We also have to question why WordPress continues to list Dreamhost as a recommend web host.” – Parneix Mar 15 '12 at 15:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.