Last night, one of my clients' sites was hacked.

The only thing that's been done by the hackers, as far as I can see, it that they changed the content of the index.php file to theirs.

The fix for that was done very quickly, of course, simply by replacing this file back to the original one I had from the latest backup.

As far as I can tell, they didn't reach the WP admin, as nothing else is missing from the files, and once the main file was restored, everything worked fine.

So how do I find out how they did it?? In order to prevent it from happening again, of course.

I have a paid account at WPMU and the Defender plugin installed as part of this, but it doesn't provide much valuable information and nothing relevant to this case, anyway.

  • There is a very good chance the hack will be back. Likely there is some malicious code on the server that will continuously inject the same code into the index.php file every day or few days. – deflime Aug 28 '17 at 8:32

There are many things that I do to check a possible hack on the site. Changing FTP users/passwords, reinstalling WP, reinstalling themes/plugins, changing user account passwords (especially admin level), change hosting credentials.

I wrote an entry on my own site to remind me (most of the stuff there is my own 'notes' to myself). May be helpful: http://securitydawg.com/recovering-from-a-hacked-wordpress-site/ (Not trying to promote my site; there are many googles on how to recover from a hacked site. That link is just my personal list.)

In general if a file is being overwritten, it means that your permissions are lacking. in general no one should be able to write to code files, not other user and IMHO not even the webserver (yes, this will make running updates from the admin somewhat harder, you have to select between convenience and security)

As for your assumption that nothing else was changed that is just false and you should do a fall restore from a backup. If someone was able to change your code he could easily created an admin user for himself and covered his tracks. Might not have happened this time but better be safe than sorry.

I can't say, how do you find out how they did it, but I can say something for security.

  1. Always update your wordpress, themes and plugins.
  2. Disable file edit. in wp-config.php

    define('DISALLOW_FILE_EDIT', true);

  3. Deny acces to wp-config.php file. in .htaccess

<files wp-config.php> order allow,deny deny from all </files>

  1. Deny acces to xmlrpc.php file. in .htaccess

    <files xmlrpc.php> order allow,deny deny from all </files>

Maybe, you can find the answers, your server logs.

  • none of this is relevant to the question, and except for point 1, none of them actually provide much of an additional security – Mark Kaplun Aug 28 '17 at 4:44
  • @MarkKaplun - why not? isn't this the minimum measurement i need to take in order to tighten the security of my WP site?? maybe this information is not a direct answer to the question at the title of this topic, but it is relevant to the issue of security in general, which is the overall matter here. --- Unless, these actions are wrong or redundant... – TheCuBeMan Aug 28 '17 at 12:58
  • no, if this is all you do, then it is far from being enough. point 2 is a UI thing which do not protect against any hacker (wordpress can not prevent the usage of php to write to file from someone that hacked into your system. 3. If your server is configured correctly and wordpress works accessing that file will do nothing, but if you plan for a time when your server might malfunction in some partial way it is better to move the config file one directory up and eliminate the ability to access it in the first place – Mark Kaplun Aug 28 '17 at 13:27
  • point 4.... everybody hates xml-rpc, but realy the only way anyone will break into your site from there is if you have a weak password, and if you have one, it is possible to break in via the normal login – Mark Kaplun Aug 28 '17 at 13:29

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.