1

I have a managed server with several WP and non-WP sites, and code has been prepended to the content of all files (for all domains on the sever) which begin with a php command.

I'm wondering whether the cause was a vulnerability or password-guess in one WP install, or instead a guess of the ftp password or other reason.

Improve this question

3 Answers 3

Reset to default
1

If a WP install is hacked, can it spread to other domains on a server?

Sorry to hear that.

WordPress security depends on a trust you have in plugins, themes, and the WordPress core itself.

If only a single PHP file is damaged, the whole web farm that runs WordPress can be damaged.

So the fair answer to your question is Yes.

In WordPress plugins and theme have the access privileges of the web server process that runs the web server.

Improve this answer
1
  • 1
    @ prosti ... thanks. I'm now wiser for knowing and shall be more careful.
    – glvr
    Commented Jan 27, 2017 at 6:08
1

This got nothing to do with wordpress by itself. To limit the "spread" of an "virus" between sites you should isolate them - use different OS user for each site, use different DBs for each site, and don't have a 777 permissions on any directory.

Sites that are "money generators", should just be on a totally different VPS.

Obviously, this makes maintenance harder, and I will be the first to admit of not fully following all of it, but that is the way to go.

Improve this answer
4
  • @ Mark Kaplun ... thanks. I realised this issue wasn't solely WP, though this forum seemed an appropriate place to post. Although I use different DBs (even within a single site) and don't have 777s, I now realise that by having multiple sites on my server I'm effectively operating as 'shared hosting'.
    – glvr
    Commented Jan 27, 2017 at 6:11
  • yes you do, and important sites should be separate not only because of security but also because of performance (again easier said then done in the real world)
    – Mark Kaplun
    Commented Jan 27, 2017 at 7:54
  • @ Mark Kaplun ... good point. My thinking had been that because they're relatively small and low traffic sites, controlled by me, that it's ok - but I'd only considered performance not security.
    – glvr
    Commented Jan 30, 2017 at 8:06
  • well, real life is always about compromises...
    – Mark Kaplun
    Commented Jan 30, 2017 at 11:56
1

Think you asked this in another question.. yes, cross contamination like this is very possible. The exact vector however is hard to ascertain without more details, you're going to need to perform forensics to get to the question of - how..

Improve this answer
3
  • @ Pedro Salazar ...thanks. I don't know enough to forensically investigate, but it's making me more aware of the potential problems with plugins (however useful they may be).
    – glvr
    Commented Jan 27, 2017 at 6:07
  • You might want to look at bog.sucuri.net they seem to do a lot of research on hacked sites... you might find their stuff useful.. they also have labs.sucuri.net that might be helpful
    – Pedro Salazar
    Commented Jan 27, 2017 at 16:34
  • @ Pedro Salazar ... good links, thanks. I think I have to accept that I don't have enough tech knowledge, and be more careful... but it's hard for those of us who don't know enough to be able to understand the security of plugins. Oh well.
    – glvr
    Commented Jan 30, 2017 at 8:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.