1

This might be a broad topic but I am searching and reading but not able to clear my doubts, please advice in answer or links from where I can understand about how codes are injected to WP by attackers.

While clicking on site name from google search it was taking to spam links. After doing some scanning I found there was plugin https://wordpress.org/plugins/pc-google-analytics/ we were using which was outdated. And in wp-config.php there was some code like below screenshot :

enter image description here

Is that means site got hacked ?

I have performed all required updates or core and plugins etc and gone thorugh Verifying that I have fully removed a WordPress hack?

Is that kind of code means site is hacked. We are on shared hosting Bluehost.

I am not sure if that code is due to hosting installation process. I have gone thorugh video https://vimeo.com/153926756 as well.

Please give some valuable thoughts if thats malicious code and how is malicious code like this normally injected into WordPress pages?

Thanks!

Improve this question
1
  • 3
    Yes, that's malicious code. Revert to a known good backup, fix the hole, don't trust the files you have right now.
    – janh
    Jan 2, 2018 at 14:53

1 Answer 1

Reset to default
4

Once hacked there is no real (at least not easy) way to verify that you have removed all traces of the malware. Good malware will leave an hard to detect backdoor, and there is always the question of whether you have actually removed the attack vector. Therefor the only 100% working way to remove a malware is to revert to a known good backup first, than improve your security.

It seems like your core security failing is to let the webserver to write to your config (and I assume also code) files. This is just going to make it harder for you to avoid being hacked again with the next software bug.

Improve this answer
5
  • 1
    Thanks for the answer +1 , is there any way to detect how files got written I mean how is malicious code like this normally injected into WordPress pages? And what security we can follow in shared hosting. Please suggest !
    – jas
    Jan 2, 2018 at 16:20
  • 2
    There is always a possibility, especially if you are on shared hosting, that a bug in the enviroment lets other users/sites write to your directories. If the site is alone on a VPS, the only likely vector is through remote code execution being made possible by bug in plugins/themes (and there is always the remote possibility that a plugin was "bought" and new release have a backdoor as a feature). This can even be more complex like a bug in a plugin lets the attacker create a user with admin permissions and than it is used to make changes.
    – Mark Kaplun
    Jan 2, 2018 at 16:52
  • 2
    In the shared host context, there is no way for you to audit or improve their security setup, therefor using a provider which has a record of good security is an important thing. Even in shared hosting enviroment keeping your files read only (except for the uploads directory) will make the possibility of hacking them much smaller. the down side is that you will have to use the FTP credentials when updating plugins and core. As for users, don't let users subscribe unless you need this functionality.
    – Mark Kaplun
    Jan 2, 2018 at 16:59
  • 2
    And last but not least, you can change your htaccess rules to deny access to the wp-content directory and that way prevent the remote execution type of attacks
    – Mark Kaplun
    Jan 2, 2018 at 16:59
  • File permissions are as required and not accessible as last comment suggest but one of plugin used was outdated may be that was reason.
    – jas
    Jan 3, 2018 at 3:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.