2

I am helping someone sort out a site, it suddenly wanted to be installed instead of showing the site itself. I found that the wp-config.php file was missing.

Fortunately there was a backup and I restored the wp-config, about a week later it was deleted again.

This time I extracted the backup zip file to a directory so it would be easily available, copied the wp-config and got the site working.

Today the wp-config has disappeared again. But a 'smoking gun' is that the wp-config file in the backup directory has also gone. (yes, I still have the zip).

I suspect there is a plugin on the rampage targetting that file name. I have suggested a fresh install and reinstall all the plugins, it might come to that.

But before doing that, short of disabling them all, any suggestions on how to work out which one plugin it might be? Or what might be doing this?

  • Normally you would disable plugins one by one. On this one, it can be tedious though. Have you considered a hack maybe? Check your server logs, you might get something there. Apart from that, your problem is very localized – Pieter Goosen Jul 20 '15 at 11:21
  • 1
    ... as a quick fix, you could try to make your wp-config.php file read-only. But you need of course to find the real cause why it's being deleted. – birgire Jul 20 '15 at 11:24
  • Is your website functional even after deleted wp-config.php? If that's the case then a security plugin might have been moving your wp-config.php to parent folder. – Robert hue Jul 20 '15 at 11:25
  • @PieterGoosen yes, that's why I asked here. I was hoping maybe someone had seen this before :P – Steve Jul 20 '15 at 11:30
  • 1
    I think you should also make a copy of wp-config.php to one folder down, to make sure your website is never down. Because if there is no wp-config.php in root folder, WordPress automatically check for config php file in one folder down. – Robert hue Jul 20 '15 at 12:29
2

The problem turned out to be that wp-config was infected with some sort of code. Typical of what you see at the top of infected .php files.

I have cxs running on the server and it was, quite rightly, detecting the malicious (I assume) code and quarantining the file.

When I restored the file, because I didn't look at the content, I was restoring an infected file each time and cxs was doing its job.

It was pretty frustrating trying to work it out, something twigged for me last night. Hope this helps someone else.

  • See my feeling about a hack was correct. You should inspect all other files and your db and make sure that you don't have any other infected files or db rows. This is extremely important – Pieter Goosen Jul 22 '15 at 5:08
  • @PieterGoosen fortunately cxs does a good job of finding those infected scripts. My observation of many similar infestations is that it doesn't extend to the database. But I wish I knew how they injected into scripts, there is no common plugin that I can identify apart from Akismet. – Steve Jul 22 '15 at 7:19
  • 1
    Look for unescaped, unsanitized and non validated inputs in your code. Injection through user input fields and URL's is most common. Also, make sure that you have atleast PHP 5.4 installed, all other versions is not supported anymore and most probably have security issues because it is no longer supported. Golden rule when writing code, escape, sanitize and validate according to the type of date recieved, and never ever trust any type of user input or any values coming form form data fields or URL's. – Pieter Goosen Jul 22 '15 at 7:26
  • 1
    I do tell all wordpress users to be very wary of plugins, you have no idea who wrote it and what the code is like. Thanks for your input @PieterGoosen – Steve Jul 22 '15 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.