This is a very common question. There are plenty of plugins available in WordPress Plugins directory Under GPL. And many plugins have some backdoor login attempts. So, can't trust which plugin is right to use.

And if I need to use an unknown plugin.I have few doubts,

  1. How can i find the backdoor login issues?
  2. What are all the preventive measures to prevent Backdoor Login?
  3. There are many plugins available to check the security issues. So don't suggest any plugin here, because I can't trust plugins, that's why I am coming to know the possible ways to find it.

And please don't vote it down. Because I need possible ways to prevent Backdoor login issues. I hope this will be useful to someone else, who infected with Backdoor logins. Because, many freelancers putting a backdoor login while delivering it to the site owners.

  • Plugins aren't inherently bad... What is bad is keeping outdated plugins installed on your system and outdated versions of WordPress. Most plugins on the WordPress Repository are trustable. They are reviewed by a team of developers but it is also on you to pick plugins that seem like they have a good following, rating, and author(s) so that it stays up to date. – Howdy_McGee Nov 21 '15 at 7:23
  • i don't think its bad, i have the fear of backdoor login problems. The very beginning the wordpress community developers check a plugin before approving it. Once the Plugin is submitted, the plugin developers can add any update and functions in the following updates. I am not sure, whether each update will be monitored by Community Developers. – Kvvaradha Nov 21 '15 at 7:34
  • I'm sure that theme updates are monitored and approved and I guess the same is true for plugins. – IXN Nov 21 '15 at 8:52

You are only focussing on one area of WordPress neglegting all others. Hackers use many many ways to hack a site and get access to such sites, not only through back end login and registering. WordPress by itself is quite secure if you keep up with installing updates as soon as they are released.

Also, keeping your PHP version updated is very crucial. At time of writing, you should not run any version of PHP below PHP 5.5 (Note, 5.5 will be EOL'ed in July 2016 and feature updates was already stopped). You should also make sure that your server is well protected, but this is something you should have checked when you bought your hosting. Low priced hosting is almost always not very secure and uses outdated software and programs.

You should worry about any plugin, theme and custom code used on your site, no matter where you downloaded it or got it from. It is your own responsibility to go through all code and find possible loopholes a hacker can exploit. Unescaped, non sanitized and non validated input coming from form fields and globals such as $_POST and $_GET and PHP used in text fields are most often the number one cause of a site being hacked.

A simple jquery script added to a variable in your URL can be used to hack your site if you use that $_GET variable without escaping, sanitizing and validating it. It is that easy.

Another popular place which is abused by hackers are SQL injection. Improper use of SQL can leave a backdoor open for a hacker. That is why you should always use the prepare() method in the wpdb class to run custom SQL.

You have to remember, no code on this entire world are save. Every piece of code is hackable, any site is hackable (which has been proved many times with huge huge sites), and all you can really do is to make it as hard as possible for a hacker to hack your site by keeping everything up to date and not using dodgy code, plugins or themes. Apart from that, there is absolutely nothing you can do to avoid been hacked

  • What you told is right. But this is not answer for my problem. Is there any possibility to find backdoor login codes? – Kvvaradha Nov 21 '15 at 9:44
  • That is something you need to do yourself unfortunately, or hire security proffesionals to help with this. This is really not the place to ask such VIP questions as we are not security pros (at least me) – Pieter Goosen Nov 21 '15 at 9:50

If you are serious about security you will not install any plugin to which you haven't done a security audit (or paid someone else to do).

Backdoors can be a problem, and well written ones will be hard to block, but it seems like just purely bad code is so far causing much more damage than intentional backdoors.

  • I asked the way to finding the backdoor login codes. Not suggestions for plugins. Please if you have real answer post it. Don't post ur suggestions. – Kvvaradha Nov 21 '15 at 9:43
  • 1
    No one works for you over here. If you want answers exactly as you want them, please pay someone. – Mark Kaplun Nov 21 '15 at 10:40
  • I am not asking to work for me. I thought there might be some possible tricks to find it. But you guys think I am asking to work for me. And voting it down. This is bullshit to ask a problem in stackoverflow. – Kvvaradha Nov 21 '15 at 16:25
  • I didn't downvote you, so what do you want from me? I gave you an answer that it is possible to detect backdoors only by code review, which is exactly what you asked for..... You asked - "How can i find the backdoor login issues?". And now you are going and complaining about the people that devoted their time to try to help you because I guess you decided that there should be an easy way and you don't like the answer that there isn't. – Mark Kaplun Nov 21 '15 at 16:47

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.