WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hi when I try to enter my site I get redirected to another site. IT appears the htaccess file has been changed. When I scan the site with Sucuri I get this error Known javascript malware. Details: http://sucuri.net/malware/malware-entry-mwhta7 Location: http://ca-no.ru/example/status.php

How do I fix this permanently? I already had this problem last week and reset the htaccess file, however it happened again.

share|improve this question

closed as off topic by toscho Jun 23 '12 at 7:27

Questions on WordPress Development Stack Exchange are expected to relate to WordPress within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

I also found this file in wp-admin pastebin.com/CCSmKpUM – drtanz Mar 27 '12 at 9:26
up vote 1 down vote accepted

This is a case of general security. At a minimum do the following steps:

  • Delete the file you found in wp-admin
  • Delete the htaccess file
  • Download the official wordpress from wordpress.org and upload it to your server, overwriting anything it finds. If possible delete the wp-admin and wp-includes folders and any files starting with wp- in the root folder.
  • Do the same for any plugins or themes, use local backups if they aren't from the repository
  • Set up the correct permissions for your folders very important
  • Move wp-config.php one folder up from your index.php if possible
  • Do the same for any other WordPress installs on that server, if one is compromised, they're all compromised, and you need to keep them all up to date
  • Check for Timthumb, if you're using it consider using the WordPress APIs instead, and if you won't, then make sure you're using the very latest version.
  • Run your active themes through the WordPress theme check plugin, fix as many of the warnings and deprecated notices as is possible
  • Check your plugins for security breaches. Some people use plugins that are by design gaping security holes, e.g. embedding PHP code in posts
  • Perform appropriate checks on any non-WordPress software installed.

If you have backups, remember that simply restoring them will not make everything fine, as you're still open tot he same attack. You need to close the hole that let the malware in.

For good measure you should also:

  • Use FTP or shell to change the file system, and do manual wordpress/plugin updates, only the wp-content/uploads folder should be writable
  • Change the first admin user to a normal user and use a different admin account, and change the user name
  • Use any database prefix other than wp_
  • Use the WordPress upload mechanisms and WordPress filesystem API instead of reinventing the wheel when writing uploaders or writing/reading files using the native PHP file APIs
  • Disable the use of eval in php.ini
  • Always keep WordPress up to date and avoid deprecated APIs
share|improve this answer
Excellent explanation, could you explain further what you mean by changing the file system? – drtanz Mar 27 '12 at 11:25
Writing/reading/editing files, you can use the PHP file APIs but it's safer to use the WordPress APIs. The WordPress APIs will also handle requesting FTP login details if direct write access is unavailable with no extra effort on your part – Tom J Nowell Mar 27 '12 at 11:58
Got it, thanks! – drtanz Mar 29 '12 at 14:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.