Last day I've noticed that my site is hacked and a PHP backdoor is installed on my site. Virus scanner reported that a plugin file is inside my wp-content/uploads which I did not upload it myself. It included a wordpress plugin plus some php shells.

I don't know how this file placed there, by using this file, hacker could access root folder of my host, create files and change permission of file to allow them to be executed.

I don't know how does it help the hacker and what was the benefit for him/her but he could create a file on my host and claim my site as its property on google search console. I want to know:

  1. How can I find the security hole on my site?
  2. What was the benefit for hacker to claim my site as his/her property on Google search console? I removed him/her from google search console of my site but I want to know the risks that it might bring for me.

I'm using wordpress 4.6.9, I've used plain-ftp sometime for file transfers which I guess it might put me in trouble but I'm not sure. I also noticed change in size of database and host disk usage.

  • link to dirty plugin: files.fm/u/e3wrcurq – VSB Jun 10 '18 at 8:56
  • if a hacker can modify files, security holes can be in any files. then it's better to delete all files and reinstall a clean backup. – mmm Jun 10 '18 at 9:01
  • @ mmm I could find the first file which was placed in uploads folder. Other files then created using php files included on that plugin file. Plugin also included .htaccess file with this content: AddType application/x-httpd-php .suspected AddType application/x-httpd-php5 .suspected AddHandler application/x-httpd-php .suspected which I don't know what does .suspected means. Besides installing older backups does not guarantee that security hole is blocked and this might be repeated. I would be thankful if I could have your opinion about this. :) – VSB Jun 10 '18 at 9:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.