1

I have just had to deal with a few of my WordPress websites being hacked. First time put an index.html file in the cpanel of each site and replenished my admin user. Once I felt I cleaned this up, it's happened once again but it changed my title tag to "Hacked by Bala Sniper" and the widgets from the footer of each website were removed.

My WHM account isn't WP only websites so I know it can't be a hacker accessing from there.

I've Googled this many times and rectified a few issues such as not making the id=1 to be admin, captcha plugin amongst a few others.

I feel this is going to happen once again. I'm on here to ask if anyone has had this problem today or yesterday or if you've ever had this hacked by bala sniper title tag change etc. and if you cleaned up the problem and tightened your security, to hopefully help me out amongst anyone else who reads this.

What is concerning me the most is that it's been every single wordpress site on my WHM was compromised and I've not found anything where every single site has something similar to them all.

Thanks for anyone to helps, I have googled this and rectified as much issues I've neglected, just need to know why all of my WP accounts were effected.

Dev

Improve this question
3
  • 1
    Are you using a single cPanel account to manage multiple websites or a cPanel account per website?
    – drabello
    Mar 8, 2016 at 23:55
  • 1
    +1 to @drabello's comment - if one site is compromised and it's on the same account as other sites, it's likely the rest will get compromised at the same time. If that's not the set up in your case, then is there any particular plugin that is common across all the sites, that could potentially have a security hole? Is Wordpress, or any plugins, out of date?
    – Tim Malone
    Mar 9, 2016 at 2:30
  • I updated all sites to latest version of WP and plugins. I removed the 2016,2015 themes etc. - I added the sucuri plugin which is pretty good along with Wordfence. I made sure no admin has an id of 1. I've even found a plugin which forces my wp site to stay on utf-8 as when it got hacked it went to utf-7 which made sense why they'd do that. I edited file permissions through cpanel. I've generated new security keys. Not sure what else to do really. 24 hours in and so far so good.
    – Dev
    Mar 9, 2016 at 14:41

2 Answers 2

Reset to default
3

wordpress configuration file is located in the root.In the event that PHP stops functioning on webserver for any reason.we run the risk of this file being displayed in plaintext,which will give our password and database information to visitor. you can safely move wp-config directory up out of root directory.this will stop if from accidentally served. Wordpress has built-in functionality that automatic check parent directory if it cannot find a configuration file.

In this situations on certain hosts, is not option. An alternative on Apache web servers is to set your .htaccess to not serve up the wp-config file. Add the following line to ur .htaccess file in the root directory.

<FilesMatch ^wp-config.php$>deny from all</FilesMatch>
Improve this answer
1
  • +1 for reminding me of what happens when php stops functioning for any reason.
    – Johansson ♦
    Apr 22, 2017 at 3:16
2

I wanted to state, this happened to me a few times in the early WP 3.x days. Am using GoDaddy shared hsoting etc.

My solution, i compiled my own HTaccess file(if ur using Apache) against RFI / LFI / SQL injects etc, just very basic ones, disabling the use of base64, bogus image hacks, finger printing and so on. Then you need to check your CHMOD aka Permissions, you can also do that through FTP or filemanager, or better HTACCESS, the one of the last things, is actualy hardening your WP, and this is not a easy task, stop relying on Revolution Slider(just for example), and keep a whatch out on epxloit-db or vulndb for things concerning plugins that you use.

All

Check this out, and edit the .htaccess file at the start ull see YOURDOMAIN.COM and change them -> lines 21 and 22

https://github.com/dexit/wp-ht-access-se

Improve this answer
3
  • If needed i can provide a much much bigger list of thangs which can be modified for WP ( jsut have this neat compilation :P )
    – dExIT
    Apr 25, 2016 at 17:01
  • 1
    sorry, but that htaccess is not even half complete. You should protect also from execution of all languages not ph, protect execution from the uploads directory (but do serve the file) and protect from execution on the plugins and themes directory. Some of the stuff you do there just have nothing to do with security like blocking proxies.
    – Mark Kaplun
    Apr 25, 2016 at 17:16
  • Thx for pointing out things, I willa mend them, but that's not the point, i'm doing that as a Test and it is hell a lot better than def htaccess, and getting raped by script kiddies using public exploits....
    – dExIT
    Apr 25, 2016 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.