Tell me more ×
WordPress Answers is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.
up vote -1 down vote favorite

I am working in web hosting company so my job is to fix clients problem, one of the biggest problem we are facing right now is that our only word press customer site got hacked 'not one all of them', and we have around 1200 word press customer that are hacked.

Most customer site's are up to date and they have around 4 to 5 security plugins, and we have tried every security plugins on the planet earth, and we have also tried manually editing the sites ( manually secure ). All other CMS are working fine like joomla and custom made site's.

How can we fix the hack issue ?

one of the shocking thing is that my site is on the same server and i haven’t got hacked !!. i have no security plugins installed but my wp-config.php file is in my home directory so its not in 'public_html' ( cpanel )

share|improve this question
Recovering from hacks is off topic here per our FAQ. See wordpress.stackexchange.com/q/19696 for further advice. – toscho♦ Dec 11 '12 at 15:46
thank you...... – Qasim Dec 11 '12 at 16:01
I think the question is just about how to avoid hacks, not recover. Things that could help you are requiring at least "Strong" passwords from users, and the "Limit Logins" plugin that locks out users after a set number of incorrect attempts to login. Helps prevent brut force attempts. Security plugins tend to not be too helpful, and 4 to 5 of them sounds completely redundant. If you are going to use them, find one or two that actually work for you. And then do some research, there buttloads of posts on the basics of securing wordpress. – Jake Dec 11 '12 at 22:57

closed as off topic by toscho♦ Dec 11 '12 at 15:46

Questions on WordPress Answers are expected to relate to WordPress within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

1 Answer

up vote 0 down vote

WordPress sites, are always in the clear of getting hacked, and there is no way to really stop it. It all depends on how the sites are set up.

Do the .htaccess allow anyone clearance to edit or access the wp-config.php?

Are all the sites linked to the same database server?

Are the passwords used to access both the customer backend and the server administration backend the same?

Do you use random passwords?

What kind of hack is it? Is it based off decoded Base64 JavaScript?

Can the customers at all access their backend? What if you run the sites locally?

It's hard to give help on a specific hack, but if the servers are shared, or in the same clusters its possible that one hack can take down them all.

If I have to recommend a good security service. I would recommend Sucuri, it is a commercial service but does a great job of taking care of any clean up after a dirty hack.

I could also recommend a service like ManageWP to manage and control your WordPress websites, including security scanning and updating your installs.

Hope I could be of help

share|improve this answer
No all the sites are on the different server, every server have its own DB, passwords are only access by customers, most of them using strong and random passwords, most of hack is JAVA and SQL injection, and thank you for the help. – Qasim Dec 11 '12 at 15:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.