WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My Wordpress site is beign hacked by some hackers of Saudi Arabia. How can i prevent them from hacking. I have also found that many other Wordpress sites have also been hacked.

share|improve this question

closed as not constructive by Rarst Apr 16 '12 at 14:54

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Unfortunately security hardening is overly broad topic and doesn't make good question (security depends on hosting, server stack, specifics of WordPress installation, specifics of WP users and their workflow, etc, etc). As for your specific issue - it is out of scope per FAQ. What you need is security professional looking at your compromised installation, not random advice from the street. – Rarst Apr 16 '12 at 14:56

Look at this answer I wrote for a more extensive explanation:

Malware on site

For a summary:

  • Add a login limiting plugin
  • Move wp-config.php out of the public html folder ( WordPress will look one folder up from its root directory if it isn't there
  • Use the correct file and folder permissions
  • Do not use the admin username
  • Make sure the first user in the database with ID 1, is not the admin
  • Hide what version of WordPress you're using ( by removing the generator tags in the header, use google for the code snippet, its a copy paste operation )
  • Use nonce's and check capabilities when building custom code
  • Use the wordpress filesystem APIs instead of writing your own upload code
  • Develop locally using LAMP/WAMP/XAMPP and do regular backups. If your site is compromised its just a matter of re-uploading what you have on your compute
  • Never, use eval, it's a huge security risk
  • Always use the latest version of WordPress
  • Always use the WP AJAX apis instead of using a custom PHP file and including blog headers php file
  • Avoid shared server environments ( there's a very real risk that someone else on the server isn't doing any of the above and gets hacked, and it cross infects your own secure install )
  • Don't use the wp_ db table prefix
  • Add a htaccess file to the wp-admin folder to password secure it to your IP
  • escape and validate all inputs no matter how trivial
share|improve this answer

There is a good article about hardening your WordPress website. I have found this article very useful and followed the instructions accordingly.

Hardening WordPress

Alternatively you can use the following plugins for your own satisfaction:

Limit Login Attempts

Many thanks.

share|improve this answer

Contact me Your Web Host webmaster...

and also update me WordPress Latest Versions and plugins, and also you can use this plugins..

WP Security Scan

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.