0

My site was hacked some weeks ago. I have deleted the old files and copied a backup file on the server. For some reason it is showing 500 internal server error.

What have I tried?

I have tried to delete all the plugins but the error is still there. Please guide.

Edit:

Here is how my .htaccess file looks like,

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

Following is my error log:

MAIN error_log:
[Wed Aug 26 06:25:28 2015] [notice] [client 198.11.179.195] mod_rbl: 198.11.179.195 is listed in RBL.
[Wed Aug 26 06:25:28 2015] [notice] [client 182.18.129.224] mod_rbl: 182.18.129.224 is listed in RBL.
[Wed Aug 26 06:25:29 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:29 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:29 2015] [notice] [client 91.72.17.134] mod_rbl: 91.72.17.134 is listed in RBL.
[Wed Aug 26 06:25:29 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:29 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:29 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:29 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:29 2015] [notice] [client 198.11.179.195] mod_rbl: 198.11.179.195 is listed in RBL.
[Wed Aug 26 06:25:29 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:29 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:29 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [notice] [client 89.248.167.137] mod_rbl: 89.248.167.137 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [notice] [client 185.93.187.69] mod_rbl: 185.93.187.69 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [error] [client 104.41.151.86] ModSecurity: Access denied with connection close (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/httpd/modsecurity.d/eig_rules.conf"] [line "615"] [id "900036"] [msg "Wordpress BOT exploit :: No UA/Referer"] [hostname "www.bgyinfosys.com"] [uri "/foodsawasdee/wp-login.php"] [unique_id "Vd2wOkKT9FYAACSiIEQAAAFO"]
[Wed Aug 26 06:25:30 2015] [notice] [client 185.93.187.69] mod_rbl: 185.93.187.69 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [error] [client 189.11.10.177] Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace., referer: http://cemat.edu.pe/
[Wed Aug 26 06:25:30 2015] [error] [client 189.11.10.177] Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace., referer: http://cemat.edu.pe/
[Wed Aug 26 06:25:30 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [error] [client 104.41.151.86] ModSecurity: Access denied with connection close (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/httpd/modsecurity.d/eig_rules.conf"] [line "615"] [id "900036"] [msg "Wordpress BOT exploit :: No UA/Referer"] [hostname "www.bgyinfosys.com"] [uri "/foodsawasdee/wp-login.php"] [unique_id "Vd2wOkKT9FYAACVuLSIAAAHW"]
[Wed Aug 26 06:25:30 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [notice] [client 52.28.117.58] mod_rbl: 52.28.117.58 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [error] [client 104.41.151.86] ModSecurity: Access denied with connection close (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/httpd/modsecurity.d/eig_rules.conf"] [line "615"] [id "900036"] [msg "Wordpress BOT exploit :: No UA/Referer"] [hostname "www.bgyinfosys.com"] [uri "/foodsawasdee/wp-login.php"] [unique_id "Vd2wOkKT9FYAACVuLSkAAAHZ"]
[Wed Aug 26 06:25:30 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [notice] [client 198.11.179.195] mod_rbl: 198.11.179.195 is listed in RBL.
[Wed Aug 26 06:25:30 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:31 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:31 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:31 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:31 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:31 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:31 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:31 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:31 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:31 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:31 2015] [notice] [client 119.31.234.188] mod_rbl: 119.31.234.188 is listed in RBL.
[Wed Aug 26 06:25:31 2015] [notice] [client 89.248.167.137] mod_rbl: 89.248.167.137 is listed in RBL.
[Wed Aug 26 06:25:32 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:32 2015] [notice] [client 198.11.179.195] mod_rbl: 198.11.179.195 is listed in RBL.
[Wed Aug 26 06:25:32 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:32 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:32 2015] [notice] [client 119.31.234.188] mod_rbl: 119.31.234.188 is listed in RBL.
[Wed Aug 26 06:25:32 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:32 2015] [notice] [client 52.28.117.58] mod_rbl: 52.28.117.58 is listed in RBL.
[Wed Aug 26 06:25:32 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:32 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:32 2015] [notice] [client 149.210.165.239] mod_rbl: 149.210.165.239 is listed in RBL.
[Wed Aug 26 06:25:32 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:32 2015] [notice] [client 119.31.234.188] mod_rbl: 119.31.234.188 is listed in RBL.
[Wed Aug 26 06:25:32 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:33 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:33 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:33 2015] [notice] [client 119.31.234.188] mod_rbl: 119.31.234.188 is listed in RBL.
[Wed Aug 26 06:25:33 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:33 2015] [notice] [client 198.11.179.195] mod_rbl: 198.11.179.195 is listed in RBL.
[Wed Aug 26 06:25:33 2015] [notice] [client 203.155.20.3] mod_rbl: 203.155.20.3 is listed in RBL.
[Wed Aug 26 06:25:33 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:33 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:33 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:33 2015] [notice] [client 107.173.245.2] mod_rbl: 107.173.245.2 is listed in RBL., referer: http://media.bramptonsda.org/
[Wed Aug 26 06:25:33 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:33 2015] [notice] [client 203.155.20.3] mod_rbl: 203.155.20.3 is listed in RBL.
[Wed Aug 26 06:25:33 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:33 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:34 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:34 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:34 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:34 2015] [notice] [client 203.155.20.3] mod_rbl: 203.155.20.3 is listed in RBL.
[Wed Aug 26 06:25:34 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:34 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:34 2015] [notice] [client 107.173.245.2] mod_rbl: 107.173.245.2 is listed in RBL., referer: http://media.bramptonsda.org
[Wed Aug 26 06:25:34 2015] [notice] [client 198.11.179.195] mod_rbl: 198.11.179.195 is listed in RBL.
[Wed Aug 26 06:25:34 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:34 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:34 2015] [notice] [client 107.173.245.2] mod_rbl: 107.173.245.2 is listed in RBL., referer: http://media.bramptonsda.org
[Wed Aug 26 06:25:34 2015] [notice] [client 203.155.20.3] mod_rbl: 203.155.20.3 is listed in RBL.
[Wed Aug 26 06:25:35 2015] [notice] [client 107.173.245.2] mod_rbl: 107.173.245.2 is listed in RBL., referer: http://media.bramptonsda.org/index.php/component/users/?view=registration
[Wed Aug 26 06:25:35 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:35 2015] [notice] [client 192.169.60.146] mod_rbl: 192.169.60.146 is listed in RBL.
[Wed Aug 26 06:25:35 2015] [notice] [client 107.173.245.2] mod_rbl: 107.173.245.2 is listed in RBL., referer: http://media.bramptonsda.org/index.php?option=com_user&view=register
[Wed Aug 26 06:25:35 2015] [error] [client 216.244.82.251] Failed loading /usr/php/54/usr/lib64/php/modules/ZendGuardLoader.so:  /usr/php/54/usr/lib64/php/modules/ZendGuardLoader.so: undefined symbol: zend_new_interned_string
[Wed Aug 26 06:25:35 2015] [notice] [client 203.155.20.3] mod_rbl: 203.155.20.3 is listed in RBL.
[Wed Aug 26 06:25:35 2015] [notice] [client 50.63.153.98] mod_rbl: 50.63.153.98 is listed in RBL.
[Wed Aug 26 06:25:35 2015] [notice] [client 198.11.179.195] mod_rbl: 198.11.179.195 is listed in RBL.
[Wed Aug 26 06:25:36 2015] [error] [client 101.169.255.249] Failed loading /usr/php/54/usr/lib64/php/modules/ZendGuardLoader.so:  /usr/php/54/usr/lib64/php/modules/ZendGuardLoader.so: undefined symbol: zend_new_interned_string, referer: https://www.google.com.au/
[Wed Aug 26 06:25:36 2015] [notice] [client 89.248.167.137] mod_rbl: 89.248.167.137 is listed in RBL.
  • What does your server error log says? – Sisir Aug 26 '15 at 12:17
  • I have attached them. – Fahad Uddin Aug 26 '15 at 12:32
  • @FahadUddin, looks like you are loading the external libraries inside the WordPress. In that case the WordPress error log will not help you much. You need to check the web server error log. – prosti Jan 11 '17 at 18:11
0

Check for old or missing hidden files like .htaccess etc. These are prone to cause 500 Internal server error especially when not matching the installation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.