I've posted one wordpress php code injection senario on SO before, url:https://stackoverflow.com/questions/26826082/what-is-the-highly-efficient-way-to-remove-a-block-of-string-pattern-in-php-file
I found it happens regularly in some of the wordpress site, the consequence is it caused plugin crash, or unable to login /wp-admin untill u've removed all the injection patterns from all php files as using the time consuming method I mentioned in the above post, however till now i do not know where the flaw is for attacker to inject such code in wordpress.
Nevertheless, after researching besides regularly clean files backup. I've got below wordpress security plans to avoid injections :
Solution 1. wordpress update plan
meaning always check out updates wordpress to latest version always check out updates making sure plugins to latest version.
Solution 2. strict file/folder permission config on wordpress [php,normal files,folders]
never allow php file updates on production site, apache chmod set all wordpress *.php files to chmod 644; all normal files *.js *.css *.html etc to 755; wp-upload folder set chmod to 755 rest wordpress folder set chmod to 644;
For these two approches,
Solution1: (focus on update to latest version counting on latest patches'll fix vulnerabilities while leaving chmod as default permission when wordpress/plugin is installed. )
actually is very labor consuming cause there are so many updates to take care of and u never know whether cetain plugin update will cause compatibility issue with the wordpress version. and I don't think it can cover everything to prevent injection in my SO post. furthermore,if site already got injected and u didn't relize before you go any update process, it will usually cause plugin crash as I've been through many times before. But updating plan is the most popular method to reinforce wordpress security but requires human monitoring and maintenance during the updates.
Solution2:(focus on customizing chmod permissions to disallow file changes) Here is a reference link of codex on wordpress chmod setting: http://codex.wordpress.org/Changing_File_Permissions
looks reasonable but will definitely have to test if chmod overprotection cause incompatibilities with the working plugins, etc. As certain plugins requires insecure permissions to work. It also means little changes can be made to production site as per the permission configuration.
So guys, which approach would u suggest to secure the wordpress php files from being injected. any comments on the above two solutions.
Or any better plans to fight against such kind of code injections?
( solutions with less human monitoring involvment are preferred.)