how to find the way they hacked my WP site

Question

Last night, one of my clients' sites was hacked.

The only thing that's been done by the hackers, as far as I can see, it that they changed the content of the index.php file to theirs.

The fix for that was done very quickly, of course, simply by replacing this file back to the original one I had from the latest backup.

As far as I can tell, they didn't reach the WP admin, as nothing else is missing from the files, and once the main file was restored, everything worked fine.

So how do I find out how they did it?? In order to prevent it from happening again, of course.

I have a paid account at WPMU and the Defender plugin installed as part of this, but it doesn't provide much valuable information and nothing relevant to this case, anyway.

Answer 1

There are many things that I do to check a possible hack on the site. Changing FTP users/passwords, reinstalling WP, reinstalling themes/plugins, changing user account passwords (especially admin level), change hosting credentials.

I wrote an entry on my own site to remind me (most of the stuff there is my own 'notes' to myself). May be helpful: http://securitydawg.com/recovering-from-a-hacked-wordpress-site/ (Not trying to promote my site; there are many googles on how to recover from a hacked site. That link is just my personal list.)

Answer 2

In general if a file is being overwritten, it means that your permissions are lacking. in general no one should be able to write to code files, not other user and IMHO not even the webserver (yes, this will make running updates from the admin somewhat harder, you have to select between convenience and security)

As for your assumption that nothing else was changed that is just false and you should do a fall restore from a backup. If someone was able to change your code he could easily created an admin user for himself and covered his tracks. Might not have happened this time but better be safe than sorry.

Answer 3

I can't say, how do you find out how they did it, but I can say something for security.

1. Always update your wordpress, themes and plugins.

2. Disable file edit. in wp-config.php

   define('DISALLOW_FILE_EDIT', true);

3. Deny acces to wp-config.php file. in .htaccess

<files wp-config.php> order allow,deny deny from all </files>

4. Deny acces to xmlrpc.php file. in .htaccess

   <files xmlrpc.php> order allow,deny deny from all </files>

Maybe, you can find the answers, your server logs.