1

I have a managed server with several WP and non-WP sites, and code has been prepended to the content of all files (for all domains on the sever) which begin with a php command.

I'm wondering whether the cause was a vulnerability or password-guess in one WP install, or instead a guess of the ftp password or other reason.

1

If a WP install is hacked, can it spread to other domains on a server?

Sorry to hear that.

WordPress security depends on a trust you have in plugins, themes, and the WordPress core itself.

If only a single PHP file is damaged, the whole web farm that runs WordPress can be damaged.

So the fair answer to your question is Yes.

In WordPress plugins and theme have the access privileges of the web server process that runs the web server.

  • 1
    @ prosti ... thanks. I'm now wiser for knowing and shall be more careful. – glvr Jan 27 '17 at 6:08
1

This got nothing to do with wordpress by itself. To limit the "spread" of an "virus" between sites you should isolate them - use different OS user for each site, use different DBs for each site, and don't have a 777 permissions on any directory.

Sites that are "money generators", should just be on a totally different VPS.

Obviously, this makes maintenance harder, and I will be the first to admit of not fully following all of it, but that is the way to go.

  • @ Mark Kaplun ... thanks. I realised this issue wasn't solely WP, though this forum seemed an appropriate place to post. Although I use different DBs (even within a single site) and don't have 777s, I now realise that by having multiple sites on my server I'm effectively operating as 'shared hosting'. – glvr Jan 27 '17 at 6:11
  • yes you do, and important sites should be separate not only because of security but also because of performance (again easier said then done in the real world) – Mark Kaplun Jan 27 '17 at 7:54
  • @ Mark Kaplun ... good point. My thinking had been that because they're relatively small and low traffic sites, controlled by me, that it's ok - but I'd only considered performance not security. – glvr Jan 30 '17 at 8:06
  • well, real life is always about compromises... – Mark Kaplun Jan 30 '17 at 11:56
1

Think you asked this in another question.. yes, cross contamination like this is very possible. The exact vector however is hard to ascertain without more details, you're going to need to perform forensics to get to the question of - how..

  • @ Pedro Salazar ...thanks. I don't know enough to forensically investigate, but it's making me more aware of the potential problems with plugins (however useful they may be). – glvr Jan 27 '17 at 6:07
  • You might want to look at bog.sucuri.net they seem to do a lot of research on hacked sites... you might find their stuff useful.. they also have labs.sucuri.net that might be helpful – Pedro Salazar Jan 27 '17 at 16:34
  • @ Pedro Salazar ... good links, thanks. I think I have to accept that I don't have enough tech knowledge, and be more careful... but it's hard for those of us who don't know enough to be able to understand the security of plugins. Oh well. – glvr Jan 30 '17 at 8:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.